rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4576 
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T01:00:00.000Z
CVE-2011-4577 
OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T01:00:00.000Z
CVE-2011-4578 
event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T22:00:00.000Z
CVE-2011-4579 
The svq1_decode_frame function in the SVQ1 decoder (svq1dec.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (memory corruption) via a crafted SVQ1 stream, related to "dimensions changed."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T20:00:00.000Z
CVE-2011-4580 
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T15:00:00.000Z
CVE-2011-4581 
mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4582 
Open redirect vulnerability in the Calendar set page in Moodle 2.1.x before 2.1.3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via a redirection URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4583 
Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4584 
The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4585 
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4586 
CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4587 
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4588 
The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4589 
backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4590 
The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to a webservice server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4591 
Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object states.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4592 
The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4593 
Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2011-4594 
The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4595 
Pretty-Link WordPress plugin 1.5.2 has XSS
Problem types: description: XSS
Affected products: vendor: pretty-link
product: pretty-link plugin
Published: 2020-01-10T13:20:12.000Z
CVE-2011-4596 
Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T22:00:00.000Z
CVE-2011-4597 
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4598 
The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4599 
Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2011-4600 
The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T15:00:00.000Z
CVE-2011-4601 
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-25T01:00:00.000Z
CVE-2011-4602 
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T02:00:00.000Z
CVE-2011-4603 
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T02:00:00.000Z
CVE-2011-4604 
The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T10:00:00.000Z
CVE-2011-4605 
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x before 5.2.2, and BRMS Platform before 5.3.0 do not properly restrict write access, which allows remote attackers to add, delete, or modify items in a JNDI tree via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2011-4606 
Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4607 
PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-23T16:00:00.000Z
CVE-2011-4608 
mod_cluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from an external vhost that does not enforce security constraints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4609 
The svc_run function in the RPC implementation in glibc before 2.15 allows remote attackers to cause a denial of service (CPU consumption) via a large number of RPC connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2011-4610 
JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T23:00:00.000Z
CVE-2011-4611 
Integer overflow in the perf_event_interrupt function in arch/powerpc/kernel/perf_event.c in the Linux kernel before 2.6.39 on powerpc platforms allows local users to cause a denial of service (unhandled performance monitor exception) via vectors that trigger certain outcomes of performance events.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4612 
icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-20T00:00:00.000Z
CVE-2011-4613 
The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T19:00:00.000Z
CVE-2011-4614 
PHP remote file inclusion vulnerability in Classes/Controller/AbstractController.php in the workspaces system extension in TYPO3 4.5.x before 4.5.9, 4.6.x before 4.6.2, and development versions of 4.7 allows remote attackers to execute arbitrary PHP code via a URL in the BACK_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-18T00:00:00.000Z
CVE-2011-4615 
Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php, the update action to (3) hosts.php and (4) scripts.php, and (5) maintenance.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-29T22:00:00.000Z
CVE-2011-4616 
Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary web script or HTML via template parameters, related to improper handling of > (greater than) and < (less than) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T02:00:00.000Z
CVE-2011-4617 
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-31T01:00:00.000Z
CVE-2011-4618 
Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T01:00:00.000Z
CVE-2011-4619 
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T01:00:00.000Z
CVE-2011-4620 
Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message, as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-31T01:00:00.000Z
CVE-2011-4621 
The Linux kernel before 2.6.37 does not properly implement a certain clock-update optimization, which allows local users to cause a denial of service (system hang) via an application that executes code in a loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4622 
The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and possibly other versions, does not properly handle when Programmable Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt controller (irqchip) is not available, which allows local users to cause a denial of service (NULL pointer dereference) by starting a timer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4623 
Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T23:00:00.000Z
CVE-2011-4624 
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-01T14:00:00.000Z
CVE-2011-4625 
simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.
Problem types: description: Cryptography
Affected products: vendor: simplesamlphp
product: simplesamlphp
Published: 2019-11-06T14:53:31.000Z
CVE-2011-4626 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function.
Problem types: description: Cross-Site Scripting
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:07:45.000Z
CVE-2011-4627 
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
Problem types: description: Other
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:16:40.000Z
CVE-2011-4628 
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
Problem types: description: Weak Authentication
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:22:56.000Z
CVE-2011-4629 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel.
Problem types: description: Cross-Site Scripting
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:30:30.000Z
CVE-2011-4630 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:34:04.000Z
CVE-2011-4631 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.
Problem types: description: Cross-Site Scripting
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:36:09.000Z
CVE-2011-4632 
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
Problem types: description: Cross-Site Scripting
Affected products: vendor: TYPO3
product: TYPO3
Published: 2019-11-06T16:39:08.000Z
CVE-2011-4634 
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name, related to the Database Synchronize panel; (2) a crafted database name, related to the Database rename panel; (3) a crafted SQL query, related to the table overview panel; (4) a crafted SQL query, related to the view creation dialog; (5) a crafted column type, related to the table search dialog; or (6) a crafted column type, related to the create index dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-22T20:00:00.000Z
CVE-2011-4638 
Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login-x.php, and allow remote authenticated users to execute arbitrary SQL commands via the (2) bldomain, (3) wldomain, or (4) temid parameter to urls-x.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-08T10:00:00.000Z
CVE-2011-4639 
The (1) Traceroute and (2) Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute arbitrary commands via shell metacharacters in an argument, as demonstrated by an && (ampersand ampersand) sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-08T10:00:00.000Z
CVE-2011-4640 
Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-08T10:00:00.000Z
CVE-2011-4642 
mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as demonstrated by a cross-site request forgery (CSRF) attack, aka SPL-45172.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T11:00:00.000Z