rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-2630 
The Puella Magi Madoka Magica iP application 1.05 and earlier for Android places cleartext Twitter credentials in a log file, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-04T15:00:00.000Z
CVE-2012-2631 
Cross-site scripting (XSS) vulnerability in WEBLOGIC @WEB ShoppingCart before 1.5.2.0, and @WEB ShoppingCart T 1.5.0.1 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T14:00:00.000Z
CVE-2012-2632 
SEIL routers with firmware SEIL/x86 1.00 through 2.35, SEIL/X1 2.30 through 3.75, SEIL/X2 2.30 through 3.75, and SEIL/B1 2.30 through 3.75, when the http-proxy and application-gateway features are enabled, do not properly handle the CONNECT command, which allows remote attackers to bypass intended URL restrictions via a TCP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T19:00:00.000Z
CVE-2012-2633 
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T19:00:00.000Z
CVE-2012-2634 
Cross-site scripting (XSS) vulnerability in FeedDemon before 4.0, when the feed preview option is enabled, allows remote attackers to inject arbitrary web script or HTML via a feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T19:00:00.000Z
CVE-2012-2635 
The Dolphin Browser HD application before 7.6 and Dolphin for Pad application before 1.0.1 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T19:00:00.000Z
CVE-2012-2636 
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-19T16:00:00.000Z
CVE-2012-2637 
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB PATIO 4.04 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-19T16:00:00.000Z
CVE-2012-2638 
Cross-site scripting (XSS) vulnerability in SmallPICT.cgi in SmallPICT before 2.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-19T16:00:00.000Z
CVE-2012-2640 
The NEC BIGLOBE Yome Collection application 1.8.3 and earlier for Android allows remote attackers to read the IMEI value from an SD card via a crafted application that lacks the READ_PHONE_STATE permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-05T17:00:00.000Z
CVE-2012-2641 
Cross-site scripting (XSS) vulnerability in Zenphoto before 1.4.3 allows remote attackers to inject arbitrary web script or HTML by triggering improper interaction with an unspecified library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-05T17:00:00.000Z
CVE-2012-2642 
Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2644.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-07T10:00:00.000Z
CVE-2012-2643 
Cross-site scripting (XSS) vulnerability in KENT-WEB YY-BOARD before 6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted form entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-07T10:00:00.000Z
CVE-2012-2644 
Cross-site scripting (XSS) vulnerability in the MT4i plugin 3.1 beta 4 and earlier for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-2642.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-07T10:00:00.000Z
CVE-2012-2645 
The Yahoo! Japan Yahoo! Browser application 1.2.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T17:00:00.000Z
CVE-2012-2646 
The Sleipnir Mobile application before 2.1.0 and Sleipnir Mobile Black Edition application before 2.1.0 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T10:00:00.000Z
CVE-2012-2647 
Yahoo! Toolbar 1.0.0.5 and earlier for Chrome and Safari allows remote attackers to modify the configured search URL, and intercept search terms, via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-31T10:00:00.000Z
CVE-2012-2648 
Cross-site scripting (XSS) vulnerability in the GoodReader app 3.16 and earlier for iOS on the iPad, and 3.15.1 and earlier for iOS on the iPhone and iPod touch, allows remote attackers to inject arbitrary web script or HTML via vectors involving use of this app in conjunction with a web browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T19:00:00.000Z
CVE-2012-2649 
The Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allow remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-08T18:00:00.000Z
CVE-2012-2652 
The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T20:00:00.000Z
CVE-2012-2653 
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T20:00:00.000Z
CVE-2012-2654 
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2012-2655 
PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T23:00:00.000Z
CVE-2012-2656 
An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information.
Problem types: description: vulnerability in Restlet
Affected products: vendor: www.restlet.org/
product: Restlet
Published: 2019-12-18T18:16:54.000Z
CVE-2012-2657 
Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T00:00:00.000Z
CVE-2012-2658 
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T00:00:00.000Z
CVE-2012-2660 
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-22T14:00:00.000Z
CVE-2012-2661 
The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-22T14:00:00.000Z
CVE-2012-2662 
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-2663 
extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow remote attackers to bypass intended firewall restrictions via crafted packets.  NOTE: the CVE-2012-6638 fix makes this issue less relevant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-15T11:00:00.000Z
CVE-2012-2664 
The sosreport utility in the Red Hat sos package before 2.2-29 does not remove the root user password information from the Kickstart configuration file (/root/anaconda-ks.cfg) when creating an archive of debugging information, which might allow attackers to obtain passwords or password hashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-29T19:00:00.000Z
CVE-2012-2665 
Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag, (2) duplicate tags, or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T18:00:00.000Z
CVE-2012-2666 
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: n/a
product: go/golang
Published: 2021-07-09T10:50:05.000Z
CVE-2012-2667 
Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web sessions via vectors related to the regenerate method and unspecified "database backed session classes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-07T19:00:00.000Z
CVE-2012-2668 
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2669 
The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-27T11:00:00.000Z
CVE-2012-2670 
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2671 
The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2672 
Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2673 
Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2674 
Multiple integer overflows in the (1) chk_malloc, (2) leak_malloc, and (3) leak_memalign functions in libc/bionic/malloc_debug_leak.c in Bionic (libc) for Android, when libc.debug.malloc is set, make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2675 
Multiple integer overflows in the (1) CallMalloc (malloc) and (2) nedpcalloc (calloc) functions in nedmalloc (nedmalloc.c) before 1.10 beta2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2676 
Multiple integer overflows in the (1) malloc and (2) calloc functions in Hoard before 3.9 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows on implementing code via a large size value, which causes less memory to be allocated than expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2677 
Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2678 
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), after the password for a LDAP user has been changed and before the server has been reset, allows remote attackers to read the plaintext password via the unhashed#user#password attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2012-2679 
Red Hat Network (RHN) Configuration Client (rhncfg-client) in rhncfg before 5.10.27-8 uses weak permissions (world-readable) for /var/log/rhncfg-actions, which allows local users to obtain sensitive information about the rhncfg-client actions by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-2680 
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, does not properly restrict access to resources, which allows remote attackers to obtain sensitive information via unspecified vectors related to (1) "web pages," (2) "export functionality," and (3) "image viewing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2681 
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2682 
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, allows attackers with certain database privileges to cause a denial of service (inaccessible page) via a non-ASCII character in the name of a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-07-19T19:00:00.000Z
CVE-2012-2683 
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) "error message displays" or (2) "in source HTML on certain pages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2684 
Multiple SQL injection vulnerabilities in the get_sample_filters_by_signature function in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to execute arbitrary SQL commands via the (1) agent or (2) object id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2685 
Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote authenticated users to cause a denial of service (memory consumption) via a large size in an image request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2686 
crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T19:00:00.000Z
CVE-2012-2687 
Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T19:00:00.000Z
CVE-2012-2688 
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2012-2690 
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-29T19:00:00.000Z
CVE-2012-2691 
The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2692 
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2693 
libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2694 
actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-22T14:00:00.000Z