rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-3241 
Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate binary file-format information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Out-of-Bounds Memory Write in Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T18:00:00.000Z
CVE-2010-3242 
Microsoft Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information, which allows remote attackers to execute arbitrary code via a crafted Excel document, aka "Ghost Record Type Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T18:00:00.000Z
CVE-2010-3243 
Cross-site scripting (XSS) vulnerability in the toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2 and Office SharePoint Server 2007 SP2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "HTML Sanitization Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T18:00:00.000Z
CVE-2010-3244 
BbtsConnection_Edit.exe in Blackboard Transact Suite (formerly Blackboard Commerce Suite) before 3.6.0.2 relies on field names when determining whether it is appropriate to decrypt a connection.xml field value, which allows local users to discover the database password via a modified connection.xml file that contains an encrypted password in the <Server> field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3245 
The automated-backup functionality in Blackboard Transact Suite (formerly Blackboard Commerce Suite) stores the (1) database username and (2) database password in cleartext in (a) script and (b) batch (.bat) files, which allows local users to obtain sensitive information by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3246 
Google Chrome before 6.0.472.53 does not properly handle the _blank value for the target attribute of unspecified elements, which allows remote attackers to bypass the pop-up blocker via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3247 
Google Chrome before 6.0.472.53 does not properly restrict the characters in URLs, which allows remote attackers to spoof the appearance of the URL bar via homographic sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3248 
Google Chrome before 6.0.472.53 does not properly restrict copying to the clipboard, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3249 
Google Chrome before 6.0.472.53 does not properly implement SVG filters, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "stale pointer" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3250 
Unspecified vulnerability in Google Chrome before 6.0.472.53 allows remote attackers to enumerate the set of installed extensions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3251 
The WebSockets implementation in Google Chrome before 6.0.472.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3252 
Use-after-free vulnerability in the Notifications presenter in Google Chrome before 6.0.472.53 allows attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3253 
The implementation of notification permissions in Google Chrome before 6.0.472.53 allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3254 
The WebSockets implementation in Google Chrome before 6.0.472.53 does not properly handle integer values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3255 
Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3256 
Google Chrome before 6.0.472.53 does not properly limit the number of stored autocomplete entries, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3257 
Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element focus.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3258 
The sandbox implementation in Google Chrome before 6.0.472.53 does not properly deserialize parameters, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3259 
WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-3260 
oxf/xml/xerces/XercesSAXParserFactoryImpl.java in the xforms-server component in the XForms service in Orbeon Forms before 3.9 does not properly restrict DTDs in Ajax requests, which allows remote attackers to read arbitrary files or send HTTP requests to intranet servers via an entity declaration in conjunction with an entity reference, related to an "XML injection" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-27T00:00:00.000Z
CVE-2010-3261 
Directory traversal vulnerability in RSA Authentication Agent 7.0 before P2 for Web allows remote attackers to read unspecified data via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3262 
Cross-site scripting (XSS) vulnerability in Flock Browser 3.x before 3.0.0.4114 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T20:00:00.000Z
CVE-2010-3263 
Cross-site scripting (XSS) vulnerability in setup/frames/index.inc.php in the setup script in phpMyAdmin 3.x before 3.3.7 allows remote attackers to inject arbitrary web script or HTML via a server name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-10T19:00:00.000Z
CVE-2010-3264 
The engine installer in Novell Identity Manager (aka IDM) 3.6.1 stores admin tree credentials in /tmp/idmInstall.log, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-08T19:00:00.000Z
CVE-2010-3266 
Multiple cross-site scripting (XSS) vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the pcd parameter to edit_bug.aspx, (2) the bug_id parameter to edit_comment.aspx, (3) the id parameter to edit_user_permissions2.aspx, or (4) the default_name parameter to edit_customfield.aspx.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-02T16:00:00.000Z
CVE-2010-3267 
Multiple SQL injection vulnerabilities in BugTracker.NET before 3.4.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the qu_id parameter to bugs.aspx, (2) the row_id parameter to delete_query.aspx, the (3) new_project or (4) us_id parameter to edit_bug.aspx, or (5) the bug_list parameter to massedit.aspx.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-02T16:00:00.000Z
CVE-2010-3268 
The GetStringAMSHandler function in prgxhndl.dll in hndlrsvc.exe in the Intel Alert Handler service (aka Symantec Intel Handler service) in Intel Alert Management System (AMS), as used in Symantec Antivirus Corporate Edition 10.1.4.4010 on Windows 2000 SP4 and Symantec Endpoint Protection before 11.x, does not properly validate the CommandLine field of an AMS request, which allows remote attackers to cause a denial of service (application crash) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-22T20:00:00.000Z
CVE-2010-3269 
Multiple stack-based buffer overflows in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players T27LB before SP21 EP3 and T27LC before SP22 allow remote attackers to execute arbitrary code via a crafted (1) .wrf or (2) .arf file, related to use of a function pointer in a callback mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T22:00:00.000Z
CVE-2010-3270 
Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC before SP22 allows user-assisted remote authenticated users to execute arbitrary code by providing a crafted .atp file and then disconnecting from a meeting.  NOTE: since this is a site-specific issue with no expected action for consumers, it might be REJECTed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T22:00:00.000Z
CVE-2010-3271 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-18T22:00:00.000Z
CVE-2010-3272 
accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-17T17:00:00.000Z
CVE-2010-3273 
ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-17T17:00:00.000Z
CVE-2010-3274 
Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in the Employee Search Engine in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allow remote attackers to inject arbitrary web script or HTML via the searchString parameter in a (1) showList or (2) Search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-17T17:00:00.000Z
CVE-2010-3275 
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-28T16:00:00.000Z
CVE-2010-3276 
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-28T16:00:00.000Z
CVE-2010-3277 
The installer in VMware Workstation 7.x before 7.1.2 build 301548 and VMware Player 3.x before 3.1.2 build 301548 renders an index.htm file if present in the installation directory, which might allow local users to trigger unintended interpretation of web script or HTML by creating this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-28T17:00:00.000Z
CVE-2010-3279 
The default configuration of the CCAgent option before 9.0.8.4 in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition enables maintenance access, which allows remote attackers to monitor or reconfigure Contact Center operations via vectors involving TSA_maintenance.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-23T18:00:00.000Z
CVE-2010-3280 
The CCAgent option 9.0.8.4 and earlier in the management server (aka TSA) component in Alcatel-Lucent OmniTouch Contact Center Standard Edition relies on client-side authorization checking, and unconditionally sends the SuperUser password to the client for use during an authorized session, which allows remote attackers to monitor or reconfigure Contact Center operations via a modified client application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-23T18:00:00.000Z
CVE-2010-3281 
Stack-based buffer overflow in the HTTP proxy service in Alcatel-Lucent OmniVista 4760 server before R5.1.06.03.c_Patch3 allows remote attackers to execute arbitrary code or cause a denial of service (service crash) via a long request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-23T18:00:00.000Z
CVE-2010-3282 
389 Directory Server before 1.2.7.1 (aka Red Hat Directory Server 8.2) and HP-UX Directory Server before B.08.10.03, when audit logging is enabled, logs the Directory Manager password (nsslapd-rootpw) in cleartext when changing cn=config:nsslapd-rootpw, which might allow local users to obtain sensitive information by reading the log.
Problem types: description: Path Disclosure
Affected products: vendor: Red Hat
product: 389 Directory Server
vendor: HP
product: HP-UX Directory Server
Published: 2020-01-09T20:52:18.000Z
CVE-2010-3283 
Open redirect vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3284 
Unspecified vulnerability in HP System Management Homepage (SMH) before 6.2 allows remote attackers to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3285 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3286 
Unspecified vulnerability in HP Systems Insight Manager (SIM) 6.0 and 6.1 allows remote attackers to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T16:00:00.000Z
CVE-2010-3287 
Unspecified vulnerability on HP ProCurve Access Points, Access Controllers, and Mobility Controllers with software 5.1.x through 5.1.9, 5.2.x through 5.2.7, 5.3.x through 5.3.5, and 5.4.x through 5.4.0 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T16:00:00.000Z
CVE-2010-3288 
Cross-site request forgery (CSRF) vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-22T22:00:00.000Z
CVE-2010-3289 
Cross-site scripting (XSS) vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-22T22:00:00.000Z
CVE-2010-3290 
Unspecified vulnerability in HP Systems Insight Manager (SIM) before 6.2 allows remote authenticated users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-22T22:00:00.000Z
CVE-2010-3291 
Cross-site scripting (XSS) vulnerability in HP AssetCenter 5.0x through AC_5.03, and AssetManager 5.1x through AM_5.12 and 5.2x through AM_5.22, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-21T18:12:00.000Z
CVE-2010-3292 
The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could allow an attacker to replace certain configuration files (e.g., phishing whitelist) via dns/packet spoofing.
Problem types: description: may use spoofed data
Affected products: vendor: mailscanner
product: mailscanner
Published: 2019-11-12T20:37:57.000Z
CVE-2010-3293 
mailscanner can allow local users to prevent virus signatures from being updated
Problem types: description: virus updates DoS
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T14:08:51.000Z
CVE-2010-3294 
Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3296 
The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-3297 
The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an EQL_GETMASTRCFG ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-3298 
The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-3299 
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
Problem types: description: on rails: padding oracle attack
Affected products: vendor: rails
product: rails
Published: 2019-11-12T20:55:04.000Z
CVE-2010-3300 
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
Problem types: cwe_id: CWE-649
description: CWE-649
Affected products: vendor: n/a
product: OWASP ESAPI
Published: 2021-06-22T11:56:27.000Z
CVE-2010-3301 
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register.  NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T18:00:00.000Z
CVE-2010-3302 
Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 might allow remote authenticated gateways to execute arbitrary code or cause a denial of service via long (1) cisco_dns_info or (2) cisco_domain_info data in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3303 
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3304 
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3305 
Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.
Problem types: description: CSRF
Affected products: vendor: pixelpost
product: pixelpost
Published: 2019-11-12T21:09:43.000Z
CVE-2010-3306 
Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-3307 
Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) body, (2) footer, (3) header, (4) menu_left, or (5) menu_right parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z