rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-3383 
The (1) teamspeak and (2) teamspeak-server scripts in TeamSpeak 2.0.32 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3384 
The (1) torcs, (2) nfsperf, (3) accc, (4) texmapper, (5) trackgen, and (6) nfs2ac scripts in TORCS 1.3.1 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3385 
TuxGuitar 1.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3386 
usttrace in LTTng Userspace Tracer (aka UST) 0.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3387 
vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.  NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3389 
The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3393 
magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3394 
The (1) texmacs and (2) tm_mupad_help scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-20T17:00:00.000Z
CVE-2010-3396 
Buffer overflow in kavfm.sys in Kingsoft Antivirus 2010.04.26.648 and earlier allows local users to execute arbitrary code via a long argument to IOCTL 0x80030004.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T17:26:00.000Z
CVE-2010-3397 
Untrusted search path vulnerability in PGP Desktop 9.9.0 Build 397, 9.10.x, 10.0.0 Build 2732, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tsp.dll or tvttsp.dll that is located in the same folder as a .p12, .pem, .pgp, .prk, .prvkr, .pubkr, .rnd, or .skr file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T17:26:00.000Z
CVE-2010-3398 
Unspecified vulnerability in the webcontainer implementation in IBM Lotus Sametime Connect 8.5.1 before CF1 has unknown impact and attack vectors, aka SPRs LXUU87S57H and LXUU87S93W.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T19:00:00.000Z
CVE-2010-3399 
The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.10 through 3.5.11, 3.6.4 through 3.6.8, and 4.0 Beta1 uses a context pointer in conjunction with its successor pointer for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2010-3171.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T19:00:00.000Z
CVE-2010-3400 
The js_InitRandom function in the JavaScript implementation in Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, uses the current time for seeding of a random number generator, which makes it easier for remote attackers to guess the seed value via a brute-force attack, a different vulnerability than CVE-2008-5913.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T19:00:00.000Z
CVE-2010-3402 
Untrusted search path vulnerability in IDM Computer Solutions UltraEdit 16.20.0.1009, 16.10.0.1036, and probably other versions allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a bin, cpp, css, c, dat, hpp, html, h, ini, java, log, mak, php, prj, txt, or xml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T19:39:00.000Z
CVE-2010-3403 
Untrusted search path vulnerability in Qualcomm eXtensible Diagnostic Monitor (QXDM) 03.09.19 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse mfc71enu.dll that is located in the same folder as a .isf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T19:39:00.000Z
CVE-2010-3404 
Multiple SQL injection vulnerabilities in eshtery CMS (aka eshtery.com) allow remote attackers to execute arbitrary SQL commands via the (1) Criteria field in an unspecified form related to catlgsearch.aspx or (2) user name to an unspecified form related to adminlogin.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T19:39:00.000Z
CVE-2010-3405 
Buffer overflow in sa_snap in the bos.esagent fileset in IBM AIX 6.1, 5.3, and earlier and VIOS 2.1, 1.5, and earlier allows local users to leverage system group membership and gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3406 
Unspecified vulnerability in sa_snap in the bos.esagent fileset in IBM AIX 5.3 allows local users to leverage system group membership and delete files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3407 
Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3411 
Google Chrome before 6.0.472.59 on Linux does not properly handle cursors, which might allow attackers to cause a denial of service (assertion failure) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3412 
Race condition in the console implementation in Google Chrome before 6.0.472.59 has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3413 
Unspecified vulnerability in the pop-up blocking functionality in Google Chrome before 6.0.472.59 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3414 
Google Chrome before 6.0.472.59 on Mac OS X does not properly implement file dialogs, which allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.  NOTE: this issue exists because of an incorrect fix for CVE-2010-3112 on Mac OS X.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3415 
Google Chrome before 6.0.472.59 does not properly implement Geolocation, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3416 
Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3417 
Google Chrome before 6.0.472.59 does not prompt the user before granting access to the extension history, which allows attackers to obtain potentially sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T20:00:00.000Z
CVE-2010-3418 
Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) car_id parameter to index.php and (2) y parameter to include/images.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3419 
Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbitrary PHP code via a URL in the current_user_id parameter to (1) familynews.php and (2) settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3420 
Cross-site scripting (XSS) vulnerability in Products_Results.php in PowerStore 3.0 allows remote attackers to inject arbitrary web script or HTML via the totalRows_WADAProducts parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3421 
Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3, 4.1 SP1, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter, a different vector than CVE-2004-2174 and CVE-2005-0995. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3422 
SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3423 
SQL injection vulnerability in the Yr Weatherdata module for Drupal 6.x before 6.x-1.6 allows remote attackers to execute arbitrary SQL commands via the sorting method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3424 
Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3425 
Cross-site scripting (XSS) vulnerability in UserControls/Popups/frmHelp.aspx in SmarterStats 5.3, 5.3.3819, and possibly other 5.3 versions, allows remote attackers to inject arbitrary web script or HTML via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3426 
Directory traversal vulnerability in jphone.php in the JPhone (com_jphone) component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3427 
Multiple cross-site scripting (XSS) vulnerabilities in Open Classifieds 1.7.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) desc, (2) price, (3) title, and (4) place parameters to index.php and the (5) subject parameter to contact.htm, related to content/contact.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3428 
SQL injection vulnerability in modules/notes/json.php in Intermesh Group-Office 3.5.9 allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a category action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-16T21:00:00.000Z
CVE-2010-3429 
flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-3430 
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-24T17:00:00.000Z
CVE-2010-3431 
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-24T17:00:00.000Z
CVE-2010-3432 
The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-20T21:00:00.000Z
CVE-2010-3433 
The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-3434 
Buffer overflow in the find_stream_bounds function in pdf.c in libclamav in ClamAV before 0.96.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-3435 
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-24T17:00:00.000Z
CVE-2010-3436 
fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-3437 
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-04T20:00:00.000Z
CVE-2010-3438 
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.
Problem types: description: stripping of CR/LF allows arbitrary IRC command execution
Affected products: vendor: libpoe-component-irc-perl
product: libpoe-component-irc-perl
Published: 2019-11-12T19:43:05.000Z
CVE-2010-3439 
It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.
Problem types: description: Denial of Service - Malformed Input
Affected products: vendor: alien-arena
product: alien-arena
Published: 2019-11-12T20:00:41.000Z
CVE-2010-3440 
babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.
Problem types: description: Insecure Permissions
Affected products: vendor: babiloo
product: babiloo
Published: 2019-11-12T21:26:04.000Z
CVE-2010-3441 
Multiple buffer overflows in abcm2ps before 5.9.12 might allow remote attackers to execute arbitrary code via (1) a crafted input file, related to the PUT0 and PUT1 output macros; (2) a crafted input file, related to the trim_title function; and possibly (3) a long -O option on a command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T16:00:00.000Z
CVE-2010-3442 
Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-04T20:00:00.000Z
CVE-2010-3443 
ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-23T11:00:00.000Z
CVE-2010-3444 
Buffer overflow in the log2vis_utf8 function in pyfribidi.c in GNU FriBidi 0.19.1, 0.19.2, and possibly other versions, as used in PyFriBidi 0.10.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Arabic UTF-8 string that causes original 2-byte UTF-8 sequences to be transformed into 3-byte sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2010-3445 
Stack consumption vulnerability in the dissect_ber_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x before 1.4.1 and 1.2.x before 1.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a long string in an unknown ASN.1/BER encoded packet, as demonstrated using SNMP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T18:23:00.000Z
CVE-2010-3447 
Cross-site scripting (XSS) vulnerability in view.php in the file viewer in Horde Gollem before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the file parameter in a view_file action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-01T21:00:00.000Z
CVE-2010-3448 
drivers/platform/x86/thinkpad_acpi.c in the Linux kernel before 2.6.34 on ThinkPad devices, when the X.Org X server is used, does not properly restrict access to the video output control state, which allows local users to cause a denial of service (system hang) via a (1) read or (2) write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-03T19:26:00.000Z
CVE-2010-3449 
Cross-site request forgery (CSRF) vulnerability in Redback before 1.2.4, as used in Apache Archiva 1.0 through 1.0.3, 1.1 through 1.1.4, 1.2 through 1.2.2, and 1.3 through 1.3.1; and Apache Continuum 1.3.6, 1.4.0, and 1.1 through 1.2.3.1; allows remote attackers to hijack the authentication of administrators for requests that modify credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-06T20:00:00.000Z
CVE-2010-3450 
Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-28T21:13:00.000Z
CVE-2010-3451 
Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed tables in an RTF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-28T21:13:00.000Z
CVE-2010-3452 
Use-after-free vulnerability in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted tags in an RTF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-28T21:13:00.000Z