rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-4424 
Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T22:00:00.000Z
CVE-2012-4425 
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-18T17:00:00.000Z
CVE-2012-4426 
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4427 
The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions.gnome.org via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T01:00:00.000Z
CVE-2012-4428 
openslp: SLPIntersectStringList()' Function has a DoS vulnerability
Problem types: description: out-of-bounds read in SLPIntersectStringList() can cause DoS
Affected products: vendor: openslp-dfsg
product: openslp-dfsg
Published: 2019-12-02T17:41:11.000Z
CVE-2012-4429 
Vino 2.28, 2.32, 3.4.2, and earlier allows remote attackers to read clipboard activity by listening on TCP port 5900.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-4430 
The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4431 
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-19T11:00:00.000Z
CVE-2012-4432 
Use-after-free vulnerability in opngreduc.c in OptiPNG Hg and 0.7.x before 0.7.3 might allow remote attackers to execute arbitrary code via unspecified vectors related to "palette reduction."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T01:00:00.000Z
CVE-2012-4433 
Multiple integer overflows in operations/external/ppm-load.c in GEGL (Generic Graphics Library) 0.2.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a large (1) width or (2) height value in a Portable Pixel Map (ppm) image, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-18T23:00:00.000Z
CVE-2012-4434 
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.
Problem types: description: Buffer Overflow
Affected products: vendor: fwknop
product: fwknop
Published: 2020-01-09T20:30:49.000Z
CVE-2012-4435 
fwknop before 2.0.3 does not properly validate IP addresses, which allows remote authenticated users to cause a denial of service (server crash) via a long IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4436 
Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4437 
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T01:00:00.000Z
CVE-2012-4438 
Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code.
Problem types: description: Other
Affected products: vendor: jenkins
product: jenkins
Published: 2019-11-18T20:46:21.000Z
CVE-2012-4439 
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.
Problem types: description: Cross-Site Scripting
Affected products: vendor: jenkins
product: jenkins
Published: 2019-11-18T20:56:45.000Z
CVE-2012-4440 
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin.
Problem types: description: Cross-Site Scripting
Affected products: vendor: jenkins
product: jenkins
Published: 2019-11-18T21:03:04.000Z
CVE-2012-4441 
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
Problem types: description: Cross-Site Scripting
Affected products: vendor: jenkins
product: jenkins
Published: 2019-11-18T21:07:09.000Z
CVE-2012-4442 
Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-05T21:00:00.000Z
CVE-2012-4443 
Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-05T17:00:00.000Z
CVE-2012-4444 
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-21T11:00:00.000Z
CVE-2012-4445 
Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4446 
The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T15:00:00.000Z
CVE-2012-4447 
Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-28T15:00:00.000Z
CVE-2012-4448 
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T21:00:00.000Z
CVE-2012-4449 
Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T19:00:00.000Z
CVE-2012-4450 
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T01:00:00.000Z
CVE-2012-4451 
Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Zend Technologies
product: Zend Framework
Published: 2020-01-03T16:03:03.000Z
CVE-2012-4452 
MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value.  NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4453 
dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4454 
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4455 
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4456 
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-4457 
OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-4458 
The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T15:00:00.000Z
CVE-2012-4459 
Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T15:00:00.000Z
CVE-2012-4460 
The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.  NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T15:00:00.000Z
CVE-2012-4461 
The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-22T23:00:00.000Z
CVE-2012-4462 
aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T15:00:00.000Z
CVE-2012-4463 
Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4464 
Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the (1) exc_to_s or (2) name_err_to_s API function, which marks the string as tainted, a different vulnerability than CVE-2012-4466.  NOTE: this issue might exist because of a CVE-2011-1005 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2012-4465 
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-4466 
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-25T23:00:00.000Z
CVE-2012-4467 
The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T21:00:00.000Z
CVE-2012-4468 
Cross-site scripting (XSS) vulnerability in the Privatemsg module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a user name in a private message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4469 
Cross-site scripting (XSS) vulnerability in the Hashcash module 6.x-2.x before 6.x-2.6 and 7.x-2.x before 7.x-2.2 for Drupal, when "Log failed hashcash" is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid token, which is not properly handled when administrators use the Database logging module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4470 
The Listhandler module 6.x-1.x before 6.x-1.1 for Drupal does not properly check permissions when importing emails, which allows remote comment authors to bypass access restrictions and possibly have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4471 
The Search Autocomplete module 7.x-2.x before 7.x-2.4 for Drupal does not properly restrict access to the module admin page, which allows remote attackers to disable an autocompletion or change the priority order via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4472 
Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4473 
The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node {type} page" permission to access unpublished nodes via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4474 
Multiple cross-site scripting (XSS) vulnerabilities in the Colorbox Node module 7.x-2.x before 7.x-2.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4475 
The Security Questions module for Drupal 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1 does not properly restrict access, which allows remote attackers to edit an arbitrary user's questions and answers via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4476 
Cross-site scripting (XSS) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4477 
Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4478 
Cross-site request forgery (CSRF) vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4479 
SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4480 
mom creates world-writable pid files in /var/run
Problem types: description: creates world-writable pid file
Affected products: vendor: mom
product: mom
Published: 2019-12-02T17:44:10.000Z
CVE-2012-4481 
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects.  NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2012-4482 
The Ubercart SecureTrading Payment Method module 6.x for Drupal does not properly verify payment notification information, which allows remote attackers to purchase an item without paying via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4483 
The commons_discussion_views_default_views function in modules/features/commons_discussion/commons_discussion.views_default.inc in the Drupal Commons module 6.x-2.x before 6.x-2.8 for Drupal does not properly enforce intended node access restrictions, which might allow remote attackers to obtain sensitive information via the recent comments listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4484 
Cross-site scripting (XSS) vulnerability in the administrative interface in the Campaign Monitor module before 6.x-2.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this refers to an issue in an independently developed Drupal module, and NOT an issue in the Campaign Monitor software itself (described on the campaignmonitor.com web site).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4485 
Multiple cross-site scripting (XSS) vulnerabilities in the galleryformatter_field_formatter_view functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or HTML via the (1) title or (2) alt parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4486 
Cross-site request forgery (CSRF) vulnerability in the Subuser module before 6.x-1.8 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T15:00:00.000Z
CVE-2012-4487 
The Subuser module before 6.x-1.8 for Drupal does not properly check "switch subuser" permissions, which allows remote authenticated parent users to change their role by switching to a subuser they created.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T15:00:00.000Z
CVE-2012-4488 
The Location module 6.x before 6.x-3.2 and 7.x before 7.x-3.0-alpha1 for Drupal does not properly check user or node access permissions, which allows remote attackers to read node or user results via the location search page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z