Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2016-1476
Cross-site scripting (XSS) vulnerability on Cisco IP Phone 8800 devices with software 11.0 allows remote authenticated users to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCuz03024.
Affected Products: n/a
References: [{'name': '20160810 Cisco IP Phone 8800 Series Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-ip-phone-8800'}, {'name': '92404', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92404'}, {'name': '1036595', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036595'}]
CVE State: PUBLISHED
Explain CVE-2016-1477
Cisco Connected Streaming Analytics 1.1.1 allows remote authenticated users to discover a notification service password by reading administrative pages, aka Bug ID CSCuz92891.
Affected Products: n/a
References: [{'name': '92398', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92398'}, {'name': '20160810 Cisco Connected Streaming Analytics Unauthorized Access Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-csa'}]
CVE State: PUBLISHED
Explain CVE-2016-1478
Cisco IOS 15.5(3)S3, 15.6(1)S2, 15.6(2)S1, and 15.6(2)T1 does not properly dequeue invalid NTP packets, which allows remote attackers to cause a denial of service (interface wedge) by sending many crafted NTP packets, aka Bug ID CSCva35619.
Affected Products: n/a
References: [{'name': '92317', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92317'}, {'name': '20160804 Cisco IOS Software Crafted Network Time Protocol Packets Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160804-wedge'}, {'name': '1036541', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036541'}]
CVE State: PUBLISHED
Explain CVE-2016-1479
Cisco IP Phone 8800 devices with software 11.0(1) allow remote attackers to cause a denial of service (memory corruption) via a crafted HTTP request, aka Bug ID CSCuz03038.
Affected Products: n/a
References: [{'name': '1036646', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036646'}, {'name': '92515', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92515'}, {'name': '20160817 Cisco IP Phone 8800 Series Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-ipp'}]
CVE State: PUBLISHED
Explain CVE-2016-1480
A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. Affected Products: all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco ESA and Cisco WSA, both virtual and hardware appliances, if the software is configured with message or content filters to scan incoming email attachments. More Information: CSCuw03606, CSCux59734. Known Affected Releases: 8.0.0-000 8.5.6-106 9.0.0-000 9.1.0-032 9.6.0-042 9.5.0-444 WSA10.0.0-000. Known Fixed Releases: 9.1.1-038 9.7.1-066.
Affected Products: Cisco AsyncOS through WSA10.0.0-000
References: [{'name': '1037117', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037117'}, {'name': '1037116', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037116'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esawsa1'}, {'name': '93914', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/93914'}]
CVE State: PUBLISHED
Explain CVE-2016-1481
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter that contains certain rules. More Information: CSCux59873. Known Affected Releases: 8.5.6-106 9.1.0-032 9.7.0-125. Known Fixed Releases: 9.1.1-038 9.7.1-066.
Affected Products: Cisco AsyncOS through 9.7.0-125
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa1'}, {'name': '1037123', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037123'}, {'name': '93908', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/93908'}]
CVE State: PUBLISHED
Explain CVE-2016-1482
Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script, aka Bug ID CSCuy83130.
Affected Products: n/a
References: [{'name': '1036809', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036809'}, {'name': '92959', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92959'}, {'name': '20160914 Cisco WebEx Meetings Server Remote Command Execution Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-wem'}]
CVE State: PUBLISHED
Explain CVE-2016-1483
Cisco WebEx Meetings Server 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service, aka Bug ID CSCuy92704.
Affected Products: n/a
References: [{'name': '20160914 Cisco WebEx Meetings Server Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160914-wms'}, {'name': '92957', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92957'}, {'name': '1036808', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036808'}]
CVE State: PUBLISHED
Explain CVE-2016-1484
Cisco WebEx Meetings Server 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors, aka Bug ID CSCuy92724.
Affected Products: n/a
References: [{'name': '20160817 Cisco WebEx Meetings Server Information Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-wms1'}, {'name': '92519', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92519'}, {'name': '1036649', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036649'}]
CVE State: PUBLISHED
Explain CVE-2016-1485
Cross-site scripting (XSS) vulnerability in Cisco Identity Services Engine 1.3(0.876) allows remote attackers to inject arbitrary web script or HTML via crafted parameters, aka Bug ID CSCva46497.
Affected Products: n/a
References: [{'name': '92518', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92518'}, {'name': '1036647', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036647'}, {'name': '20160817 Cisco Identity Services Engine Admin Dashboard Page Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-ise'}]
CVE State: PUBLISHED
Explain CVE-2016-1486
A vulnerability in the email attachment scanning functionality of the Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote attacker to cause an affected device to stop scanning and forwarding email messages due to a denial of service (DoS) condition. Affected Products: This vulnerability affects Cisco AsyncOS Software releases 9.7.1 and later, prior to the first fixed release, for both virtual and hardware Cisco Email Security Appliances, if the AMP feature is configured to scan incoming email attachments. More Information: CSCuy99453. Known Affected Releases: 9.7.1-066. Known Fixed Releases: 10.0.0-125 9.7.1-207 9.7.2-047.
Affected Products: Cisco AsyncOS through 9.7.1-066
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161026-esa2'}, {'name': '1037124', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1037124'}, {'name': '93906', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/93906'}]
CVE State: PUBLISHED
Explain CVE-2016-1487
Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://support.lexmark.com/index?page=content&id=TE747&locale=EN&userlocale=EN_US'}]
CVE State: PUBLISHED
Explain CVE-2016-1488
Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.00 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ics-cert.us-cert.gov/advisories/ICSA-16-019-01'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-743465.pdf'}]
CVE State: PUBLISHED
Explain CVE-2016-1489
Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files in cleartext, which allows remote attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_4058'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537365/100/0/threaded'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Jan/67'}]
CVE State: PUBLISHED
Explain CVE-2016-1490
The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_4058'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537365/100/0/threaded'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Jan/67'}]
CVE State: PUBLISHED
Explain CVE-2016-1491
The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows, when configured to receive files, has a hardcoded password of 12345678, which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_4058'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537365/100/0/threaded'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Jan/67'}]
CVE State: PUBLISHED
Explain CVE-2016-1492
The Wifi hotspot in Lenovo SHAREit before 3.5.48_ww for Android, when configured to receive files, does not require a password, which makes it easier for remote attackers to obtain access by leveraging a position within the WLAN coverage area.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135378/Lenovo-ShareIT-Information-Disclosure-Hardcoded-Password.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.lenovo.com/us/en/product_security/len_4058'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/lenovo-shareit-multiple-vulnerabilities'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537365/100/0/threaded'}, {'name': '20160125 [CORE-2016-0002] - Lenovo ShareIT Multiple Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Jan/67'}]
CVE State: PUBLISHED
Explain CVE-2016-1493
Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135314/Intel-Driver-Update-Utility-2.2.0.5-Man-In-The-Middle.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.coresecurity.com/advisories/intel-driver-update-utility-mitm'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00048&languageid=en-fr'}, {'name': '20160119 [CORE-2016-0001] - Intel Driver Update Utility MiTM', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537327/100/0/threaded'}, {'name': '20160119 [CORE-2016-0001] - Intel Driver Update Utility MiTM', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Jan/56'}]
CVE State: PUBLISHED
Explain CVE-2016-1494
The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Affected Products: n/a
References: [{'name': '[oss-security] 20160104 Re: CVE Request: python-rsa signature forgery', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/05/3'}, {'name': '79829', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/79829'}, {'tags': ['x_refsource_MISC'], 'url': 'https://blog.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/'}, {'name': '[oss-security] 20160105 CVE Request: python-rsa signature forgery', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/05/1'}, {'name': 'FEDORA-2016-70edfbbcef', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175897.html'}, {'name': 'openSUSE-SU-2016:0108', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-01/msg00032.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bitbucket.org/sybren/python-rsa/pull-requests/14/security-fix-bb06-attack-in-verify-by/diff'}, {'name': 'FEDORA-2016-c845706426', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175942.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1495
Integer overflow in the graphics drivers in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160203-01-smartphone-en'}]
CVE State: PUBLISHED
Explain CVE-2016-1496
The graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) via a crafted application, aka a "semaphore deadlock issue."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160113-01-smartphone-en'}]
CVE State: PUBLISHED
Explain CVE-2016-1497
The Configuration utility in F5 BIG-IP systems 11.0.x, 11.1.x, 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4 HF2, 1.6.x before 11.6.1, and 12.0.0 before HF1 allows remote administrators to read Access Policy Manager (APM) access logs via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.f5.com/kb/en-us/solutions/public/k/31/sol31925518.html'}, {'name': '92671', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92671'}, {'name': '1036631', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036631'}]
CVE State: PUBLISHED
Explain CVE-2016-1498
Cross-site scripting (XSS) vulnerability in the OCS discovery provider component in ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://owncloud.org/security/advisory/?id=oc-sa-2016-001'}]
CVE State: PUBLISHED
Explain CVE-2016-1499
ownCloud Server before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2 allow remote authenticated users to obtain sensitive information from a directory listing and possibly cause a denial of service (CPU consumption) via the force parameter to index.php/apps/files/ajax/scan.php.
Affected Products: n/a
References: [{'name': '20160107 [SYSS-2015-062] ownCloud Information Exposure Through Directory Listing (CVE-2016-1499)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537244/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-062.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135158/ownCloud-8.2.1-8.1.4-8.0.9-Information-Exposure.html'}, {'name': '20160219 [SYSS-2015-062] ownCloud - Information Exposure Through Directory Listing (CWE-548)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537556/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://owncloud.org/security/advisory/?id=oc-sa-2016-002'}]
CVE State: PUBLISHED
Explain CVE-2016-1500
ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return value of getOwner, which allows remote authenticated users to read the files with names starting with ".v" and belonging to a sharing user by leveraging an incoming share.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://owncloud.org/security/advisory/?id=oc-sa-2016-003'}]
CVE State: PUBLISHED
Explain CVE-2016-1501
ownCloud Server before 8.0.9 and 8.1.x before 8.1.4 allow remote authenticated users to obtain sensitive information via unspecified vectors, which reveals the installation path in the resulting exception messages.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://owncloud.org/security/advisory/?id=oc-sa-2016-004'}]
CVE State: PUBLISHED
Explain CVE-2016-1502
NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kb.netapp.com/support/s/article/authentication-bypass-vulnerability-in-snapcenter-server-1-0-1-0p1'}]
CVE State: PUBLISHED
Explain CVE-2016-1503
dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.
Affected Products: n/a
References: [{'name': 'GLSA-201606-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-07'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://android.googlesource.com/platform/external/dhcpcd/+/1390ace71179f04a09c300ee8d0300aa69d9db09'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://roy.marples.name/projects/dhcpcd/info/76a1609352263bd9def1300d7ba990679571fa30'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://source.android.com/security/bulletin/2016-04-02.html'}, {'name': 'HPSBPI03554', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388711'}, {'name': '1034601', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034601'}]
CVE State: PUBLISHED
Explain CVE-2016-1504
dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length.
Affected Products: n/a
References: [{'name': '[oss-security] 20160107 CVE id request: dhcpcd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/07/3'}, {'name': '[oss-security] 20160107 Re: CVE id request: dhcpcd', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/07/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://roy.marples.name/projects/dhcpcd/info/595883e2a431f65d8fabf33059aa4689cca17403'}, {'name': 'GLSA-201606-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-07'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://roy.marples.name/projects/dhcpcd/timeline?r=trunk&nd&c=2016-01-07+16%3A47%3A19&n=200'}, {'name': '1034601', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034601'}]
CVE State: PUBLISHED
Explain CVE-2016-1505
The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
Affected Products: n/a
References: [{'name': '[oss-security] 20160106 Re: CVE request for radicale', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/06/7'}, {'name': '80255', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/80255'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Unrud/Radicale/commit/b4b3d51f33c7623d312f289252dd7bbb8f58bbe6'}, {'name': '[oss-security] 20160105 CVE request for radicale', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/05/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/Kozea/Radicale/pull/343'}, {'name': '[oss-security] 20160106 Re: CVE request for radicale', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/06/4'}, {'name': '[oss-security] 20160107 Re: CVE request for radicale', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/07/7'}]
CVE State: PUBLISHED
Explain CVE-2016-1513
The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bz.apache.org/ooo/show_bug.cgi?id=127045'}, {'name': '92079', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/92079'}, {'name': 'GLSA-201703-01', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201703-01'}, {'name': '1036443', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1036443'}, {'name': 'USN-3046-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-3046-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.talosintelligence.com/reports/TALOS-2016-0051/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openoffice.org/security/cves/CVE-2016-1513.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1516
OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code.
Affected Products: OpenCV 3.0.0
References: [{'name': '[debian-lts-announce] 20180722 [SECURITY] [DLA 1438-1] opencv security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/opencv/opencv/issues/5956'}, {'tags': ['x_refsource_MISC'], 'url': 'https://arxiv.org/pdf/1701.04739.pdf'}, {'name': '[debian-lts-announce] 20211030 [SECURITY] [DLA 2799-1] opencv security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1517
OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks.
Affected Products: OpenCV 3.0.0
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/opencv/opencv/issues/5956'}, {'tags': ['x_refsource_MISC'], 'url': 'https://arxiv.org/pdf/1701.04739.pdf'}]
CVE State: PUBLISHED
Explain CVE-2016-1518
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have unspecified other impact by leveraging failure to use an HTTPS session for downloading configuration files from http://fm.grandstream.com/gs/.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1518-insecure-provisioning.pdf'}, {'name': '20160317 CVE-2016-1518: GrandStream Android VoIP Phone / App Provisioning Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537818/100/0/threaded'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136280/Grandstream-Wave-1.0.1.26-Man-In-The-Middle.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1519
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1519-gswave-tls-mitm.pdf'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136290/Grandstream-Wave-1.0.1.26-TLS-Man-In-The-Middle.html'}, {'name': '20160317 CVE-2016-1519: GrandStream Android VoIP App TLS MitM Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537819/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2016-1520
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1520-app-update-redirection.pdf'}, {'name': '20160317 CVE-2016-1520: GrandStream Android VoIP App Update Redirection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537821/100/0/threaded'}]
CVE State: PUBLISHED
Explain CVE-2016-1521
The directrun function in directmachine.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0875', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html'}, {'name': 'GLSA-201701-35', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-35'}, {'name': '82991', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/82991'}, {'name': 'USN-2902-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2902-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html'}, {'name': 'RHSA-2016:0594', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0594.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': 'openSUSE-SU-2016:0791', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html'}, {'name': 'DSA-3479', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3479'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html'}, {'name': 'RHSA-2016:0258', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0258.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722'}, {'name': 'FEDORA-2016-4154a4d0ba', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html'}, {'name': 'RHSA-2016:0197', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0197.html'}, {'name': 'SUSE-SU-2016:0779', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html'}, {'name': 'GLSA-201701-63', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-63'}, {'name': 'FEDORA-2016-338a7e9925', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2016/mfsa2016-14.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1522
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font.
Affected Products: n/a
References: [{'name': 'GLSA-201701-35', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-35'}, {'name': '82991', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/82991'}, {'name': 'USN-2902-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2902-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html'}, {'name': 'RHSA-2016:0594', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0594.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': 'openSUSE-SU-2016:0791', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html'}, {'name': 'DSA-3479', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3479'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html'}, {'name': 'RHSA-2016:0258', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0258.html'}, {'name': 'FEDORA-2016-4154a4d0ba', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html'}, {'name': 'RHSA-2016:0197', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0197.html'}, {'name': 'GLSA-201701-63', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-63'}, {'name': 'FEDORA-2016-338a7e9925', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2016/mfsa2016-14.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1524
Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI.
Affected Products: n/a
References: [{'name': '20160204 [CERT 777024 / CVE-2016-1524/5]: RCE and file download in Netgear NMS300', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537446/100/0/threaded'}, {'name': '20160204 [CERT 777024 / CVE-2016-1524/5]: RCE and file download in Netgear NMS300', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Feb/30'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html'}, {'name': '39412', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39412/'}, {'name': 'VU#777024', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/777024'}]
CVE State: PUBLISHED
Explain CVE-2016-1525
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the realName parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/db/modules/exploit/windows/http/netgear_nms_rce'}, {'name': '20160204 [CERT 777024 / CVE-2016-1524/5]: RCE and file download in Netgear NMS300', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537446/100/0/threaded'}, {'name': '20160204 [CERT 777024 / CVE-2016-1524/5]: RCE and file download in Netgear NMS300', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2016/Feb/30'}, {'name': '39515', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39515/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135618/Netgear-Pro-NMS-300-Code-Execution-File-Download.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135999/NETGEAR-ProSafe-Network-Management-System-300-Arbitrary-File-Upload.html'}, {'name': '39412', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39412/'}, {'name': 'VU#777024', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/777024'}]
CVE State: PUBLISHED
Explain CVE-2016-1526
The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0875', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00088.html'}, {'name': 'GLSA-201701-35', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-35'}, {'name': '82991', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/82991'}, {'name': 'USN-2902-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2902-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html'}, {'name': 'RHSA-2016:0695', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0695.html'}, {'name': 'RHSA-2016:0594', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0594.html'}, {'name': 'openSUSE-SU-2016:0791', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00058.html'}, {'name': 'DSA-3479', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3479'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.talosintel.com/2016/02/vulnerability-spotlight-libgraphite.html'}, {'name': 'FEDORA-2016-4154a4d0ba', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177520.html'}, {'name': 'SUSE-SU-2016:0779', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00052.html'}, {'name': 'GLSA-201701-63', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-63'}, {'name': 'FEDORA-2016-338a7e9925', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184623.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.mozilla.org/security/announce/2016/mfsa2016-14.html'}]
CVE State: PUBLISHED
Explain CVE-2016-1531
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
Affected Products: n/a
References: [{'name': 'DSA-3517', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3517'}, {'name': '39535', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39535/'}, {'name': '1035512', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035512'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html'}, {'name': 'openSUSE-SU-2016:0721', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html'}, {'name': '39702', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39702/'}, {'name': 'USN-2933-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2933-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.exim.org/static/doc/CVE-2016-1531.txt'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup'}, {'name': '39549', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39549/'}]
CVE State: PUBLISHED
Explain CVE-2016-1541
Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.
Affected Products: n/a
References: [{'name': 'DSA-3574', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3574'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/libarchive/libarchive/commit/d0331e8e5b05b475f20b1f3101fe1ad772d7e7e7'}, {'name': 'USN-2981-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2981-1'}, {'name': 'RHSA-2016:1844', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-1844.html'}, {'name': 'openSUSE-SU-2016:1463', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-06/msg00003.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/libarchive/libarchive/issues/656'}, {'name': 'openSUSE-SU-2016:1663', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-06/msg00090.html'}, {'name': '89355', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/89355'}, {'name': 'SSA:2016-145-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.352685'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html'}, {'name': 'GLSA-201701-03', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201701-03'}, {'name': 'VU#862384', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/862384'}]
CVE State: PUBLISHED
Explain CVE-2016-1542
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136461/BMC-Server-Automation-BSA-RSCD-Agent-User-Enumeration.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/'}, {'name': '20160328 BMC-2015-0010: User enumeration vulnerability in BMC Server Automation (BSA) Unix/Linux RSCD Agent (CVE-2016-1542)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537909/100/0/threaded'}, {'name': '43902', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/43902/'}, {'name': '43939', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/43939/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution'}]
CVE State: PUBLISHED
Explain CVE-2016-1543
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/'}, {'name': '20160328 BMC-2015-0011: Unauthorized password reset vulnerability in BMC Server Automation (BSA) (CVE-2016-1543)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537910/100/0/threaded'}, {'name': '43902', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/43902/'}, {'name': '43939', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/43939/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution'}]
CVE State: PUBLISHED
Explain CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
Affected Products: nghttp2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1308461'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/nghttp2/nghttp2/releases/tag/v1.7.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/nghttp2/nghttp2/compare/v1.7.0...v1.7.1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.gentoo.org/glsa/201612-13'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177666.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177308.html'}]
CVE State: PUBLISHED