rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-0688 
Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary commands via crafted messages over TCP, as discovered by Junaid Bohio, a different vulnerability than CVE-2010-0110 and CVE-2010-0111.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-31T20:00:00.000Z
CVE-2011-0694 
RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T17:00:00.000Z
CVE-2011-0695 
Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which triggers an invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-15T17:00:00.000Z
CVE-2011-0696 
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0697 
Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0698 
Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0699 
Integer signedness error in the btrfs_ioctl_space_info function in the Linux kernel 2.6.37 allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted slot value.
Problem types: description: Integer Signedness Error
Affected products: vendor: n/a
product: Linux kernel
Published: 2020-02-20T17:18:53.000Z
CVE-2011-0700 
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-14T19:00:00.000Z
CVE-2011-0701 
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-14T19:00:00.000Z
CVE-2011-0702 
The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0703 
In gksu-polkit before 0.0.3, the source file for xauth may contain arbitrary commands that may allow an attacker to overtake an administrator X11 session.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: gksu-polkit
product: gksu-polkit
Published: 2019-11-15T16:09:29.000Z
CVE-2011-0704 
389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica crash) by sending an empty modify request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-04T20:00:00.000Z
CVE-2011-0706 
The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T23:00:00.000Z
CVE-2011-0707 
Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T18:00:00.000Z
CVE-2011-0708 
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-20T01:00:00.000Z
CVE-2011-0709 
The br_mdb_ip_get function in net/bridge/br_multicast.c in the Linux kernel before 2.6.35-rc5 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an IGMP packet, related to lack of a multicast table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T19:00:00.000Z
CVE-2011-0710 
The task_show_regs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T19:00:00.000Z
CVE-2011-0711 
The xfs_fs_geometry function in fs/xfs/xfs_fsops.c in the Linux kernel before 2.6.38-rc6-git3 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an FSGEOMETRY_V1 ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-01T22:00:00.000Z
CVE-2011-0712 
Multiple buffer overflows in the caiaq Native Instruments USB audio functionality in the Linux kernel before 2.6.38-rc4-next-20110215 might allow attackers to cause a denial of service or possibly have unspecified other impact via a long USB device name, related to (1) the snd_usb_caiaq_audio_init function in sound/usb/caiaq/audio.c and (2) the snd_usb_caiaq_midi_init function in sound/usb/caiaq/midi.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T19:00:00.000Z
CVE-2011-0713 
Heap-based buffer overflow in wiretap/dct3trace.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long record in a Nokia DCT3 trace file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-03T00:00:00.000Z
CVE-2011-0714 
Use-after-free vulnerability in a certain Red Hat patch for the RPC server sockets functionality in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 might allow remote attackers to cause a denial of service (crash) via malformed data in a packet, related to lockd and the svc_xprt_received function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-04T22:00:00.000Z
CVE-2011-0715 
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T22:00:00.000Z
CVE-2011-0716 
The br_multicast_add_group function in net/bridge/br_multicast.c in the Linux kernel before 2.6.38, when a certain Ethernet bridge configuration is used, allows local users to cause a denial of service (memory corruption and system crash) by sending IGMP packets to a local interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-0717 
Session fixation vulnerability in Red Hat Network (RHN) Satellite Server 5.4 allows remote attackers to hijack web sessions via unspecified vectors related to Spacewalk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z
CVE-2011-0718 
Red Hat Network (RHN) Satellite Server 5.4 does not use a time delay after a failed login attempt, which makes it easier for remote attackers to conduct brute force password guessing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z
CVE-2011-0719 
Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-01T22:00:00.000Z
CVE-2011-0720 
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-03T16:00:00.000Z
CVE-2011-0721 
Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T23:00:00.000Z
CVE-2011-0722 
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-20T22:00:00.000Z
CVE-2011-0723 
FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed VC-1 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-20T22:00:00.000Z
CVE-2011-0724 
The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T23:00:00.000Z
CVE-2011-0725 
Absolute path traversal vulnerability in the org.debian.apt.UpdateCachePartially method in worker.py in Aptdaemon 0.40 in Ubuntu 10.10 and 11.04 allows local users to read arbitrary files via a full pathname in the sources_list argument, related to the D-Bus interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-23T18:00:00.000Z
CVE-2011-0726 
The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-18T22:00:00.000Z
CVE-2011-0727 
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-31T22:00:00.000Z
CVE-2011-0728 
Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-29T18:00:00.000Z
CVE-2011-0729 
dbus_backend/ls-dbus-backend in the D-Bus backend in language-selector before 0.6.7 does not restrict access on the basis of a PolicyKit check result, which allows local users to modify the /etc/default/locale and /etc/environment files via a (1) SetSystemDefaultLangEnv or (2) SetSystemDefaultLanguageEnv call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-29T22:00:00.000Z
CVE-2011-0730 
Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud (UEC) and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signature Element Wrapping" or a "SOAP signature replay" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-02T19:00:00.000Z
CVE-2011-0731 
Buffer overflow in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP7, and 9.7 before FP3 on Linux, UNIX, and Windows allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0732 
Multiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim Fix 9, have unknown impact and attack vectors, related to "security vulnerabilities of Websphere Application Server bundled within" and "many internal defects and APARs."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0733 
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header in an id=- query to a .cfm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0734 
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack.  NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0735 
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0736 
Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database structure via an id=- query to a .cfm file.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0737 
Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message.  NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explain the requirement for settings that prevent this information disclosure
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-01T17:00:00.000Z
CVE-2011-0738 
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2011-0739 
The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2011-0740 
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2011-0741 
Multiple cross-site scripting (XSS) vulnerabilities in ModX Evolution before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) installer or (2) image editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2011-0742 
Buffer overflow in ZfHIPCND.exe in Novell ZENworks Handheld Management 7.0 allows remote attackers to execute arbitrary code via a crafted IP Conduit packet to TCP port 2400.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2011-0745 
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-16T22:00:00.000Z
CVE-2011-0746 
Cross-site request forgery (CSRF) vulnerability in Forms/PortForwarding_Edit_1 on the ZyXEL O2 DSL Router Classic allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the PortRule_Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-13T14:00:00.000Z
CVE-2011-0748 
Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) edit administrator accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-13T14:00:00.000Z
CVE-2011-0751 
Directory traversal vulnerability in nhttpd (aka Nostromo webserver) before 1.9.4 allows remote attackers to execute arbitrary programs or read arbitrary files via a ..%2f (encoded dot dot slash) in a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-16T22:00:00.000Z
CVE-2011-0752 
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T21:00:00.000Z
CVE-2011-0753 
Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T21:00:00.000Z
CVE-2011-0754 
The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T21:00:00.000Z
CVE-2011-0755 
Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T21:00:00.000Z
CVE-2011-0756 
The application server in Trustwave WebDefend Enterprise before 5.0 uses hardcoded console credentials, which makes it easier for remote attackers to read security-event data by using the remote console GUI to connect to the management port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-05T01:00:00.000Z
CVE-2011-0757 
IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP2 on Linux, UNIX, and Windows does not properly revoke the DBADM authority, which allows remote authenticated users to execute non-DDL statements by leveraging previous possession of this authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T22:00:00.000Z
CVE-2011-0758 
The eCS component (ECSQdmn.exe) in CA ETrust Secure Content Manager 8.0 and CA Gateway Security 8.1 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a crafted request to port 1882, involving an incorrect integer calculation and a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T17:00:00.000Z
CVE-2011-0759 
Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z