rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-6627 
Cross-site scripting (XSS) vulnerability in admin/test_mail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6628 
Multiple cross-site scripting (XSS) vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) xyz_em_campName to admin/create_campaign.php or (2) admin/edit_campaign.php, (3) xyz_em_email parameter to admin/edit_email.php, (4) xyz_em_exportbatchSize parameter to import_export.php, or (5) pagination limit in the Newsletter Manager options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6629 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change an email address or (2) conduct script insertion attacks.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6630 
Multiple cross-site scripting (XSS) vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) bulk parameter to media-library-categories/add.php or (2) q parameter to media-library-categories/view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6631 
Cross-site request forgery (CSRF) vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6632 
Multiple cross-site scripting (XSS) vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) file title to accounts/admin/index.php or (3) comment parameter in the support page to accounts/index2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-16T21:00:00.000Z
CVE-2012-6633 
Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2012-6634 
wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2012-6635 
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2012-6636 
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2012-6637 
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T02:00:00.000Z
CVE-2012-6638 
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-15T11:00:00.000Z
CVE-2012-6639 
An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.
Problem types: description: insecure transmission of EC2 instance data can lead to root privilege escalation
Affected products: vendor: cloud-init
product: cloud-init
Published: 2019-11-25T17:29:09.000Z
CVE-2012-6640 
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-05T21:00:00.000Z
CVE-2012-6641 
Cross-site scripting (XSS) vulnerability in redirect.php in the Socolissimo module (modules/socolissimo/) in PrestaShop before 1.4.7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to "parameter names and values."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-07T15:00:00.000Z
CVE-2012-6642 
Cross-site scripting (XSS) vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to view_channel.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2012-6643 
Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to (1) videos.php or (2) channels.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2012-6644 
Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to channels.php, (2) collections.php, (3) groups.php, or (4) videos.php; (5) query parameter to search_result.php; or (6) type parameter to view_collection.php or (7) view_item.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2012-6645 
Cross-site scripting (XSS) vulnerability in the autocomplete functionality in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via the title of a node, a different vulnerability than CVE-2012-1561.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2012-6646 
F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T14:00:00.000Z
CVE-2012-6647 
The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-26T22:00:00.000Z
CVE-2012-6648 
gdm/guest-session-cleanup.sh in gdm-guest-session 0.24 and earlier, as used in Ubuntu Linux 10.04 LTS, 10.10, and 11.04, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT from CVE-2012-0943 per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-0943 is used for the guest-account issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-22T23:00:00.000Z
CVE-2012-6649 
WordPress WP GPX Maps Plugin 1.1.21 allows remote attackers to execute arbitrary PHP code via improper file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T21:53:13.000Z
CVE-2012-6651 
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-31T14:00:00.000Z
CVE-2012-6652 
Directory traversal vulnerability in pageflipbook.php script from index.php in Page Flip Book plugin for WordPress (wppageflip) allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pageflipbook_language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-13T13:28:03.000Z
CVE-2012-6653 
Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-06T19:00:00.000Z
CVE-2012-6654 
Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-14T14:00:00.000Z
CVE-2012-6655 
An issue exists AccountService 0.6.37 in the user_change_password_authorized_cb() function in user.c which could let a local users obtain encrypted passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-27T17:13:02.000Z
CVE-2012-6656 
iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-05T16:00:00.000Z
CVE-2012-6657 
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-28T10:00:00.000Z
CVE-2012-6658 
Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.conf.  NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different vulnerability types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-17T15:00:00.000Z
CVE-2012-6659 
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-19T14:00:00.000Z
CVE-2012-6660 
GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator user, and (3) PlatinumOne for the administrator user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether these passwords are default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2012-6661 
Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which makes it easier for remote attackers to guess the value via unspecified vectors.  NOTE: this issue was SPLIT from CVE-2012-5508 due to different vulnerability types (ADT2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-03T22:00:00.000Z
CVE-2012-6662 
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T16:00:00.000Z
CVE-2012-6663 
General Electric D20ME devices are not properly configured and reveal plaintext passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T21:47:21.000Z
CVE-2012-6664 
Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. (dot dot) in the (1) get or (2) put commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-21T00:00:00.000Z
CVE-2012-6665 
Directory traversal vulnerability in index.php in phpMoneyBooks 1.0.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2012-1669. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue might have been fixed in 1.0.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-17T22:00:00.000Z
CVE-2012-6666 
vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-10T13:44:07.000Z
CVE-2012-6667 
Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T16:00:00.000Z
CVE-2012-6668 
Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T20:00:00.000Z
CVE-2012-6670 
Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T20:00:00.000Z
CVE-2012-6671 
Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the (1) monster[title] or (2) monster[description] parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T20:00:00.000Z
CVE-2012-6682 
Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-11T20:00:00.000Z
CVE-2012-6684 
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-08T01:00:00.000Z
CVE-2012-6685 
Nokogiri before 1.5.4 is vulnerable to XXE attacks
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-19T14:41:27.000Z
CVE-2012-6687 
FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T15:00:00.000Z
CVE-2012-6689 
The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have an unspecified impact by spoofing Netlink messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2012-6691 
Multiple cross-site request forgery (CSRF) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) status parameter to admin/stats_monthly_sales.php or (2) country parameter in a process action to admin/create_account_process.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T18:00:00.000Z
CVE-2012-6692 
Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-17T18:00:00.000Z
CVE-2012-6693 
GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasrw for the nasrw (Read/Write) user, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2012-6694 
GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0, has a password of 2charGE for the geservice account, which has unspecified impact and attack vectors related to TimbuktuPro.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2012-6695 
GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 has a password of ddpadmin for the ddpadmin user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2012-6696 
inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2012-6697 
InspIRCd before 2.0.7 allows remote attackers to cause a denial of service (infinite loop).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2012-6698 
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2012-6699 
The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2012-6700 
The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a denial of service via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2012-6701 
Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2012-6702 
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-16T18:00:00.000Z
CVE-2012-6703 
Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2012-6704 
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-28T07:42:00.000Z
CVE-2012-6705 
Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-03T22:00:00.000Z
CVE-2012-6706 
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-22T13:00:00.000Z