rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1014 
A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.
Problem types: cwe_id: CWE-427
description: DLL hijacking CWE-427
Affected products: vendor: Schneider Electric
product: OFS v3.5
Published: 2019-03-25T18:07:36.000Z
CVE-2015-1015 
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-03T10:00:00.000Z
CVE-2015-1026 
Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-11T14:00:00.000Z
CVE-2015-1027 
The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-28T19:00:00.000Z
CVE-2015-1028 
Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T15:00:00.000Z
CVE-2015-1029 
The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T16:00:00.000Z
CVE-2015-1030 
Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-20T15:00:00.000Z
CVE-2015-1031 
Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T19:00:00.000Z
CVE-2015-1032 
Cross-site scripting (XSS) vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T15:00:00.000Z
CVE-2015-1038 
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1039 
Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1040 
Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1041 
Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1042 
The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T20:00:00.000Z
CVE-2015-1043 
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T18:00:00.000Z
CVE-2015-1044 
vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-29T18:00:00.000Z
CVE-2015-1047 
vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-12T10:00:00.000Z
CVE-2015-1048 
Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T17:00:00.000Z
CVE-2015-1049 
The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T15:00:00.000Z
CVE-2015-1050 
Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1051 
Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1052 
Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web script or HTML via the result parameter to upload_files/pk/include.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-15T15:00:00.000Z
CVE-2015-1053 
Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1054 
Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1055 
SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1056 
Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1057 
Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1058 
Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to admin/categories/add, (2) data[Field][title] parameter to admin/fields/ajax_fields/, (3) name property in a basicInfo JSON object to admin/tools/create_theme, (4) data[Link][link_title] parameter to admin/links/links/add, or (5) data[ForumTopic][subject] parameter to forums/off-topic/new.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1059 
Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1060 
Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-16T15:00:00.000Z
CVE-2015-1061 
IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1062 
MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1063 
CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1064 
Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1065 
Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1066 
Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-12T10:00:00.000Z
CVE-2015-1067 
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-11T01:00:00.000Z
CVE-2015-1068 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1069 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1070 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1071 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1072 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1073 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1074 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1075 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1076 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1077 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1078 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1079 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1080 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1081 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1082 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1083 
WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1084 
The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-18T22:00:00.000Z
CVE-2015-1085 
AppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation interface, which makes it easier for attackers to verify correct passcode guesses via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1086 
The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1087 
Directory traversal vulnerability in Backup in Apple iOS before 8.3 allows attackers to read arbitrary files via a crafted relative path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1088 
CFURL in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly validate URLs, which allows remote attackers to execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1089 
CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1090 
CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1091 
The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z