rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-2695 
The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-22T14:00:00.000Z
CVE-2012-2696 
The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-2697 
Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T21:00:00.000Z
CVE-2012-2698 
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-29T19:00:00.000Z
CVE-2012-2702 
The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2703 
Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2704 
The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T20:00:00.000Z
CVE-2012-2705 
The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2706 
Cross-site scripting (XSS) vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to user registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2707 
The Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal does not properly exit when users do not have access to package/task nodes, which allows remote attackers to bypass intended access restrictions and edit unauthorized nodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2708 
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2710 
Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2711 
Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2712 
Multiple cross-site scripting (XSS) vulnerabilities in the Search API module 7.x-1.x before 7.x-1.1 for Drupal, when supporting manual entry of field identifiers, allow remote attackers to inject arbitrary web script or HTML via vectors related to thrown exceptions and logging errors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2713 
Cross-site request forgery (CSRF) vulnerability in the BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that login a user to another web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2714 
The BrowserID (Mozilla Persona) module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier.
Problem types: description: Other
Affected products: vendor: BrowserID
product: BrowserID
Published: 2020-01-09T19:56:31.000Z
CVE-2012-2715 
Cross-site scripting (XSS) vulnerability in the themes_links function in template.php in the Amadou theme module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to class attributes in a list of links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2716 
Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2012-2717 
Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page, or the (3) message to the Mobile Tools block message options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T21:00:00.000Z
CVE-2012-2718 
SQL injection vulnerability in the Counter module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "recording visits."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2012-2719 
The filedepot module 6.x-1.x before 6.x-1.3 for Drupal, when accessed using multiple different browsers from the same IP address, causes Internet Explorer sessions to "switch users" when uploading a file, which has unspecified impact possibly involving file uploads to the wrong user directory, aka "Session Management Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2720 
The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2721 
The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2722 
The node selection interface in the WYSIWYG editor (CKEditor) in the Node Embed module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.0 for Drupal does not properly check permissions, which allows remote attackers to bypass intended access restrictions and read node titles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2723 
Cross-site scripting (XSS) vulnerability in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with maestro admin permissions to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2724 
The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page.
Problem types: description: Path Disclosure
Affected products: vendor: Simplenews
product: Simplenews
Published: 2020-01-09T19:51:42.000Z
CVE-2012-2725 
classes/Filter/WhitelistedExternalFilter.php in the Authoring HTML module 6.x-1.x before 6.x-1.1 for Drupal does not properly validate sources with the host white list, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2726 
Cross-site scripting (XSS) vulnerability in the Protest module 6.x-1.x before 6.x-1.2 or 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer protest" permission to inject arbitrary web script or HTML via the protest_body parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2727 
Open redirect vulnerability in the Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when synchronizing user data, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2728 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Node Hierarchy module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to hijack the authentication of administrators for requests that change a node hierarchy position via an (1) up or (2) down action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2729 
Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) delete or (2) add a meta tag entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2730 
The Protected Node module 6.x-1.x before 6.x-1.6 for Drupal does not properly "protect node access when nodes are accessed outside of the standard node view," which allows remote attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2731 
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-2733 
java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-16T21:00:00.000Z
CVE-2012-2734 
Multiple cross-site request forgery (CSRF) vulnerabilities in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allow remote attackers to hijack the authentication of arbitrary users for requests that execute commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2735 
Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T17:00:00.000Z
CVE-2012-2736 
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.
Problem types: description: Insecure Permissions
Affected products: vendor: network-manager
product: network-manager
Published: 2019-12-26T19:53:17.000Z
CVE-2012-2737 
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-2738 
The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-2739 
Oracle Java SE before 7 Update 6, and OpenJDK 7 before 7u6 build 12 and 8 before build 39, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-2740 
SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T17:00:00.000Z
CVE-2012-2741 
Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T17:00:00.000Z
CVE-2012-2742 
Revelation 0.4.13-2 and earlier uses only the first 32 characters of a password followed by a sequence of zeros, which reduces the entropy and makes it easier for context-dependent attackers to crack passwords and obtain access to keys via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T22:00:00.000Z
CVE-2012-2743 
Revelation 0.4.13-2 and earlier does not iterate through SHA hashing algorithms for AES encryption, which makes it easier for context-dependent attackers to guess passwords via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T22:00:00.000Z
CVE-2012-2744 
net/ipv6/netfilter/nf_conntrack_reasm.c in the Linux kernel before 2.6.34, when the nf_conntrack_ipv6 module is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via certain types of fragmented IPv6 packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-09T10:00:00.000Z
CVE-2012-2745 
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-09T10:00:00.000Z
CVE-2012-2746 
389 Directory Server before 1.2.11.6 (aka Red Hat Directory Server before 8.2.10-3), when the password of a LDAP user has been changed and audit logging is enabled, saves the new password to the log in plain text, which allows remote authenticated users to read the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2012-2747 
Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to gain privileges via unknown attack vectors related to "Inadequate checking."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T19:00:00.000Z
CVE-2012-2748 
Unspecified vulnerability in Joomla! 2.5.x before 2.5.5 allows remote attackers to obtain sensitive information via vectors related to "Inadequate filtering" and a "SQL error."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T19:00:00.000Z
CVE-2012-2749 
MySQL 5.1.x before 5.1.63 and 5.5.x before 5.5.24 allows remote authenticated users to cause a denial of service (mysqld crash) via vectors related to incorrect calculation and a sort order index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-2750 
Unspecified vulnerability in MySQL 5.5.x before 5.5.23 has unknown impact and attack vectors related to a "Security Fix", aka Bug #59533. NOTE: this might be a duplicate of CVE-2012-1689, but as of 20120816, Oracle has not commented on this possibility.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-2751 
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-2752 
Untrusted search path vulnerability in VMware vMA 4.x and 5.x before 5.0.0.2 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-01T20:00:00.000Z
CVE-2012-2753 
Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect (aka EPC) GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platform, Endpoint Security VPN R75, Endpoint Connect R73.x, and Remote Access Clients E75.x allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-19T20:00:00.000Z
CVE-2012-2759 
Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-22T16:00:00.000Z
CVE-2012-2760 
mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-2762 
SQL injection vulnerability in include/functions_trackbacks.inc.php in Serendipity 1.6.2 allows remote attackers to execute arbitrary SQL commands via the url parameter to comment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-07T19:00:00.000Z
CVE-2012-2763 
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-2764 
Untrusted search path vulnerability in Google Chrome before 20.0.1132.43 on Windows might allow local users to gain privileges via a Trojan horse Metro DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T10:00:00.000Z
CVE-2012-2768 
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the RTFM extension 2.0.4 through 2.4.3 for Best Practical Solutions RT allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T21:00:00.000Z
CVE-2012-2769 
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T21:00:00.000Z
CVE-2012-2770 
The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote attackers to obtain a logged-in session via unspecified vectors related to the "URL of a RSS feed of the user."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T21:00:00.000Z
CVE-2012-2771 
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T18:00:00.000Z
CVE-2012-2772 
Unspecified vulnerability in the ff_rv34_decode_frame function in libavcodec/rv34.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing with frame threading."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-10T22:00:00.000Z