rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-3590 
The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, includes all of root's SSH private keys within a vmcore file, which allows context-dependent attackers to obtain sensitive information by inspecting the file content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-15T11:00:00.000Z
CVE-2011-3591 
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to (1) js/functions.js and (2) js/tbl_structure.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T02:00:00.000Z
CVE-2011-3592 
Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name, (2) table name, or (3) column name that is not properly handled after an inline-editing operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T02:00:00.000Z
CVE-2011-3593 
A certain Red Hat patch to the vlan_hwaccel_do_receive function in net/8021q/vlan_core.c in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 allows remote attackers to cause a denial of service (system crash) via priority-tagged VLAN frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-3594 
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-3595 
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
Problem types: description: XSS
Affected products: vendor: Joomla!
product: Joomla!
Published: 2020-01-22T15:20:54.000Z
CVE-2011-3596 
Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.
Problem types: description: Other
Affected products: vendor: polipo
product: polipo
Published: 2019-11-25T23:53:10.000Z
CVE-2011-3597 
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T18:00:00.000Z
CVE-2011-3598 
Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-08T01:00:00.000Z
CVE-2011-3599 
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-10T10:00:00.000Z
CVE-2011-3600 
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.
Problem types: description: Other
Affected products: vendor: OFBiz
product: OFBiz
Published: 2019-11-26T00:07:23.000Z
CVE-2011-3601 
Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative value in a label_len value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2011-3602 
Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T21:00:00.000Z
CVE-2011-3603 
The router advertisement daemon (radvd) before 1.8.2 does not properly handle errors in the privsep_init function, which causes the radvd daemon to run as root and has an unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-27T21:00:00.000Z
CVE-2011-3604 
The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2011-3605 
The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2011-3606 
A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
Problem types: description: Cross-Site Scripting
Affected products: vendor: JBoss Application Server
product: JBoss Application Server
Published: 2019-11-26T01:43:14.000Z
CVE-2011-3607 
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-08T11:00:00.000Z
CVE-2011-3609 
A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: JBoss Application Server
product: JBoss Application Server
Published: 2019-11-26T02:03:48.000Z
CVE-2011-3610 
A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud parameter to plugins/serendipity_event_freetag/tagcloud.swf.
Problem types: description: XSS
Affected products: vendor: Serendipity
product: serendipity freetag plugin
Published: 2020-01-22T15:43:42.000Z
CVE-2011-3611 
A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.
Problem types: description: Local File Inclusion
Affected products: vendor: UseBB
product: UseBB
Published: 2020-01-22T16:03:07.000Z
CVE-2011-3612 
Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.
Problem types: description: CSRF
Affected products: vendor: UseBB
product: UseBB
Published: 2020-01-22T17:06:01.000Z
CVE-2011-3613 
An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.
Problem types: description: cookie theft
Affected products: vendor: Vanilla
product: Vanilla Forums
Published: 2020-01-22T17:19:54.000Z
CVE-2011-3614 
An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.
Problem types: description: incorrect access control
Affected products: vendor: Vanilla
product: Vanilla Forums
Published: 2020-01-22T17:27:15.000Z
CVE-2011-3615 
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-24T17:00:00.000Z
CVE-2011-3616 
The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-3617 
Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.
Problem types: description: Other
Affected products: vendor: Tahoe-LAFS
product: Tahoe-LAFS
Published: 2019-11-26T02:34:07.000Z
CVE-2011-3618 
atop: symlink attack possible due to insecure tempfile handling
Problem types: description: insecure tempfile handling
Affected products: vendor: atop
product: atop
Published: 2019-11-12T14:25:15.000Z
CVE-2011-3619 
The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 3.0 does not properly handle invalid parameters, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by writing to a /proc/#####/attr/current file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-3620 
Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging knowledge of a cluster-username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-03T23:00:00.000Z
CVE-2011-3621 
A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.
Problem types: description: mishandles reverse proxying
Affected products: vendor: FluxBB
product: FluxBB
Published: 2020-01-22T17:44:17.000Z
CVE-2011-3622 
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
Problem types: description: XSS
Affected products: vendor: Phorum
product: Phorum
Published: 2020-01-22T19:48:47.000Z
CVE-2011-3623 
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2011-3624 
Various methods in WEBrick::HTTPRequest in Ruby 1.9.2 and 1.8.7 and earlier do not validate the X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Server headers in requests, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: Ruby
product: Ruby
Published: 2019-11-26T02:50:40.000Z
CVE-2011-3625 
Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2011-3626 
Double free vulnerability in the prepare_exec function in src/exec.c in Logsurfer 1.5b and earlier, and Logsurfer+ 1.7 and earlier, allows remote attackers to execute arbitrary commands via crafted strings in a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-3627 
The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors related to "recursion level" and (1) libclamav/bytecode.c and (2) libclamav/bytecode_api.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-3628 
Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.04 LTS, when using certain configurations such as "session optional pam_motd.so", allows local users to gain privileges by modifying the PATH environment variable to reference a malicious command, as demonstrated via uname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-15T18:00:00.000Z
CVE-2011-3629 
Joomla! core 1.7.1 allows information disclosure due to weak encryption
Problem types: description: information disclosure
Affected products: vendor: Joomla!
product: Joomla! core
Published: 2020-02-04T12:21:19.000Z
CVE-2011-3630 
Hardlink before 0.1.2 suffer from multiple stack-based buffer overflow flaws because of the way directory trees with deeply nested directories are processed. A remote attacker could provide a specially-crafted directory tree, and trick the local user into consolidating it, leading to hardlink executable crash, or, potentially arbitrary code execution with the privileges of the user running the hardlink executable.
Problem types: description: Buffer Overflow
Affected products: vendor: hardlink
product: hardlink
Published: 2019-11-26T03:08:52.000Z
CVE-2011-3631 
Hardlink before 0.1.2 has multiple integer overflows leading to heap-based buffer overflows because of the way string lengths concatenation is done in the calculation of the required memory space to be used. A remote attacker could provide a specially-crafted directory tree and trick the local user into consolidating it, leading to hardlink executable crash or potentially arbitrary code execution with user privileges.
Problem types: description: Integer Overflow
Affected products: vendor: hardlink
product: hardlink
Published: 2019-11-26T03:22:40.000Z
CVE-2011-3632 
Hardlink before 0.1.2 operates on full file system objects path names which can allow a local attacker to use this flaw to conduct symlink attacks.
Problem types: description: Symbolic Link Following
Affected products: vendor: hardlink
product: hardlink
Published: 2019-11-26T03:34:46.000Z
CVE-2011-3634 
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-28T18:00:00.000Z
CVE-2011-3635 
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-23T10:00:00.000Z
CVE-2011-3636 
Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T11:00:00.000Z
CVE-2011-3637 
The m_stop function in fs/proc/task_mmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vectors that trigger an m_start error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-3638 
fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases of extent splitting, which allows local users to cause a denial of service (system crash) via vectors involving ext4 umount and mount operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T11:00:00.000Z
CVE-2011-3639 
The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z
CVE-2011-3640 
Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory. NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-28T00:00:00.000Z
CVE-2011-3642 
Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system (news) extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T15:46:36.000Z
CVE-2011-3645 
Newgen OmniDocs allows remote attackers to bypass intended access restrictions via (1) a modified FolderRights parameter to doccab/doclist.jsp, which leads to arbitrary permission changes; or (2) a modified UserIndex parameter to doccab/userprofile/editprofile.jsp, which selects the settings page of an arbitrary user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3646 
phpmyadmin.css.php in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to obtain sensitive information via an array-typed js_frame parameter to phpmyadmin.css.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-3647 
The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attackers to gain privileges via a crafted web site that leverages certain unwrapping behavior, a related issue to CVE-2011-3004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3648 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3649 
Mozilla Firefox 7.0 and Thunderbird 7.0, when the Direct2D (aka D2D) API is used on Windows in conjunction with the Azure graphics back-end, allow remote attackers to bypass the Same Origin Policy, and obtain sensitive image data from a different domain, by inserting this data into a canvas.  NOTE: this issue exists because of a CVE-2011-2986 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3650 
Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted file that is accessed by debugging APIs, as demonstrated by Firebug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3651 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 7.0 and Thunderbird 7.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3652 
The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly allocate memory, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3653 
Mozilla Firefox before 8.0 and Thunderbird before 8.0 on Mac OS X do not properly interact with the GPU memory behavior of a certain driver for Intel integrated GPUs, which allows remote attackers to bypass the Same Origin Policy and read image data via vectors related to WebGL textures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3654 
The browser engine in Mozilla Firefox before 8.0 and Thunderbird before 8.0 does not properly handle links from SVG mpath elements to non-SVG elements, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3655 
Mozilla Firefox 4.x through 7.0 and Thunderbird 5.0 through 7.0 perform access control without checking for use of the NoWaiverWrapper wrapper, which allows remote attackers to gain privileges via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T11:00:00.000Z
CVE-2011-3656 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTTP 0.9 errors, non-default ports, and content-sniffing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T16:31:22.000Z