rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-1541 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an interaction error in between the JRE plug-in for WebKit-based browsers and the Javascript engine, which allows remote attackers to execute arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect reference count and a use after free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T00:00:00.000Z
CVE-2012-1543 
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.  NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an invalid type cast in the JSObject class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T00:00:00.000Z
CVE-2012-1545 
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-09T11:00:00.000Z
CVE-2012-1556 
Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-09-12T14:00:00.000Z
CVE-2012-1557 
SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-12T19:00:00.000Z
CVE-2012-1558 
yaSSL CyaSSL before 2.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-12T19:00:00.000Z
CVE-2012-1561 
Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-08T14:00:00.000Z
CVE-2012-1562 
Joomla! core before 2.5.3 allows unauthorized password change.
Problem types: description: authentication error
Affected products: vendor: Joomla!
product: Joomla! core
Published: 2020-01-15T12:56:07.000Z
CVE-2012-1563 
Joomla! before 2.5.3 allows Admin Account Creation.
Problem types: description: Admin Account Creation
Affected products: vendor: Joomla!
product: Joomla!
Published: 2020-01-15T12:59:50.000Z
CVE-2012-1564 
Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-06T21:00:00.000Z
CVE-2012-1565 
Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-06T21:00:00.000Z
CVE-2012-1566 
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintNanny.
Problem types: description: authentication error
Affected products: vendor: LinuxMint
product: Mint
Published: 2020-02-07T13:23:01.000Z
CVE-2012-1567 
LinuxMint as of 2012-03-19 has temporary file creation vulnerabilities in mintUpdate.
Problem types: description: authentication error
Affected products: vendor: LinuxMint
product: Mint
Published: 2020-02-07T13:25:30.000Z
CVE-2012-1568 
The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T02:00:00.000Z
CVE-2012-1569 
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-26T19:00:00.000Z
CVE-2012-1570 
The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-28T10:00:00.000Z
CVE-2012-1571 
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T21:00:00.000Z
CVE-2012-1572 
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Problem types: description: extremely long passwords can crash Keystone
Affected products: vendor: keystone
product: Keystone
Published: 2019-11-12T16:48:15.000Z
CVE-2012-1573 
gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-26T19:00:00.000Z
CVE-2012-1574 
The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-12T10:00:00.000Z
CVE-2012-1575 
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-22T18:00:00.000Z
CVE-2012-1576 
The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T20:00:00.000Z
CVE-2012-1577 
lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.
Problem types: description: Insufficient Random Number Generation
Affected products: vendor: dietlibc
product: dietlibc
Published: 2019-12-10T18:45:07.000Z
CVE-2012-1578 
Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-1579 
The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-1580 
Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-1581 
MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-1582 
Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-1583 
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T21:00:00.000Z
CVE-2012-1584 
Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T18:00:00.000Z
CVE-2012-1585 
OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-1586 
mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-1588 
Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-1589 
Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-18T20:00:00.000Z
CVE-2012-1590 
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-1591 
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T00:00:00.000Z
CVE-2012-1592 
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
Problem types: description: xsltResult local code execution flaw
Affected products: vendor: libstruts1.2-java
product: libstruts1.2-java
Published: 2019-12-05T20:57:22.000Z
CVE-2012-1593 
epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-1594 
epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-1595 
The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size, related to the pcap and pcap-ng file parsers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-1596 
The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-11T10:00:00.000Z
CVE-2012-1597 
Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-1598 
Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-1599 
Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors.  NOTE: this might be a duplicate of CVE-2012-1611.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-1600 
Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2012-1601 
The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2012-1602 
user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T23:00:00.000Z
CVE-2012-1603 
Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T23:00:00.000Z
CVE-2012-1604 
Cross-site scripting (XSS) vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T23:00:00.000Z
CVE-2012-1605 
The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1606 
Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1607 
The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1608 
The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1610 
Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-05T22:00:00.000Z
CVE-2012-1611 
Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors.  NOTE: this might be a duplicate of CVE-2012-1599.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T21:00:00.000Z
CVE-2012-1612 
Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T21:00:00.000Z
CVE-2012-1613 
Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1614 
Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid (5) newer_than or (6) older_than parameter to search.inc.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-1615 
A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: sectool
product: sectool
Published: 2019-12-06T15:46:09.000Z
CVE-2012-1616 
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2012-1617 
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-26T00:00:00.000Z
CVE-2012-1618 
Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks.  NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-06T22:00:00.000Z
CVE-2012-1620 
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-1621 
Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-19T14:00:00.000Z