Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2016-0674
Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality and integrity via vectors related to Email.
Affected Products: n/a
References: [{'name': '1035598', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035598'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0675
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0700.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '1035615', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035615'}, {'name': '86450', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/86450'}]
CVE State: PUBLISHED
Explain CVE-2016-0676
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to the kernel.
Affected Products: n/a
References: [{'name': '1035629', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035629'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0677
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote attackers to affect availability via unknown vectors.
Affected Products: n/a
References: [{'name': '1035590', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0678
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.18 allows local users to affect confidentiality, integrity, and availability via vectors related to Core.
Affected Products: n/a
References: [{'name': '1035607', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035607'}, {'name': 'openSUSE-SU-2016:1451', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-05/msg00130.html'}, {'name': 'openSUSE-SU-2016:1462', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-06/msg00002.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0679
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect integrity and availability via vectors related to PIA Grids.
Affected Products: n/a
References: [{'name': '1035610', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0680
Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Services Procurement.
Affected Products: n/a
References: [{'name': '1035610', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0681
Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unspecified vectors.
Affected Products: n/a
References: [{'name': '1035590', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0682
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0689, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0683
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Search Framework.
Affected Products: n/a
References: [{'name': '1035610', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0684
Unspecified vulnerability in the Oracle Retail MICROS ARS POS component in Oracle Retail Applications 1.5 allows remote authenticated users to affect confidentiality via vectors related to POS.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '1035600', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035600'}]
CVE State: PUBLISHED
Explain CVE-2016-0685
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to File Processing.
Affected Products: n/a
References: [{'name': '1035610', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0688
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components.
Affected Products: n/a
References: [{'name': '86469', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/86469'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '1035615', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035615'}]
CVE State: PUBLISHED
Explain CVE-2016-0689
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0690
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0691.
Affected Products: n/a
References: [{'name': '1035590', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0691
Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0690.
Affected Products: n/a
References: [{'name': '1035590', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035590'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0692
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0694, and CVE-2016-3418.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0693
Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the PAM LDAP module.
Affected Products: n/a
References: [{'name': '1035629', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035629'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0694
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0692, and CVE-2016-3418.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0696
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors related to Console.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '86443', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/86443'}, {'name': '1035615', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035615'}]
CVE State: PUBLISHED
Explain CVE-2016-0697
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows local users to affect confidentiality and integrity via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '1035603', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035603'}]
CVE State: PUBLISHED
Explain CVE-2016-0698
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Rich Text Editor, a different vulnerability than CVE-2016-3423.
Affected Products: n/a
References: [{'name': '1035610', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035610'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0699
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to the Login sub-component.
Affected Products: n/a
References: [{'name': '1035604', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035604'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0700
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0675.
Affected Products: n/a
References: [{'name': '86453', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/86453'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html'}, {'name': '1035615', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035615'}]
CVE State: PUBLISHED
Explain CVE-2016-0701
The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
Affected Products: n/a
References: [{'name': 'FEDORA-2016-527018d2ff', 'tags': ['vendor-advisory'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176373.html'}, {'name': '1034849', 'tags': ['vdb-entry'], 'url': 'http://www.securitytracker.com/id/1034849'}, {'name': 'GLSA-201601-05', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/201601-05'}, {'name': '82233', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/82233'}, {'name': '91787', 'tags': ['vdb-entry'], 'url': 'http://www.securityfocus.com/bid/91787'}, {'name': 'VU#257823', 'tags': ['third-party-advisory'], 'url': 'https://www.kb.cert.org/vuls/id/257823'}, {'name': 'openSUSE-SU-2016:0637', 'tags': ['vendor-advisory'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00009.html'}, {'name': 'USN-2883-1', 'tags': ['vendor-advisory'], 'url': 'http://www.ubuntu.com/usn/USN-2883-1'}, {'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'url': 'http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html'}, {'url': 'https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=c5b831f21d0d29d1e517d139d9d101763f60c9a2'}, {'url': 'https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=878e2c5b13010329c203f309ed0c8f2113f85648'}, {'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821'}, {'url': 'http://www.openssl.org/news/secadv/20160128.txt'}, {'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'url': 'https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893'}, {'url': 'http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html'}, {'url': 'https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us'}, {'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759'}, {'url': 'https://www.oracle.com/security-alerts/cpuoct2020.html'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf'}]
CVE State: PUBLISHED
Explain CVE-2016-0707
The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.1.2'}]
CVE State: PUBLISHED
Explain CVE-2016-0708
Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.
Affected Products: Cloud Foundry
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cloudfoundry.org/blog/cve-2016-0708/'}]
CVE State: PUBLISHED
Explain CVE-2016-0709
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
Affected Products: n/a
References: [{'name': '39643', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39643/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709'}, {'name': '[portals-jetspeed-user] 20160303 [CVE-2016-0709] Apache Jetspeed information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C281D02D0-6A03-4421-9D86-E73B001C8677%40bluesunrise.com%3E'}, {'tags': ['x_refsource_MISC'], 'url': 'http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0710
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
Affected Products: n/a
References: [{'name': '39643', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/39643/'}, {'name': '[portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3E'}, {'tags': ['x_refsource_MISC'], 'url': 'http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710'}]
CVE State: PUBLISHED
Explain CVE-2016-0711
Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.
Affected Products: n/a
References: [{'name': '[portals-jetspeed-user] 20160303 [CVE-2016-0711] Apache Jetspeed information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C73AC0763-D44B-4BDF-867C-05AD4674A62F%40bluesunrise.com%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0711'}]
CVE State: PUBLISHED
Explain CVE-2016-0712
Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0712'}, {'name': '[portals-jetspeed-user] 20160303 [CVE-2016-0712] Apache Jetspeed information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3CF868DBFC-A05C-4ABB-8B91-17CA54C174B9%40bluesunrise.com%3E'}]
CVE State: PUBLISHED
Explain CVE-2016-0713
Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests.
Affected Products: n/a
References: [{'name': '[cf-dev] 20160201 CVE-2016-0713 Gorouter XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/VWDLUNTDKW5CW5JWEM5BOHLJ3J32TAFF/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bosh.io/releases/github.com/cloudfoundry/cf-release?version=229'}]
CVE State: PUBLISHED
Explain CVE-2016-0715
Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.
Affected Products: Pivotal Cloud Foundry Elastic Runtime
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pivotal.io/security/cve-2016-0715'}]
CVE State: PUBLISHED
Explain CVE-2016-0720
Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1299614'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pcs/commit/b9e7f061788c3b86a0c67d2d4158f067ec5eb625'}, {'name': 'FEDORA-2016-cdd4228cc7', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178384.html'}, {'name': '97984', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97984'}, {'name': 'RHSA-2016:2596', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-2596.html'}, {'name': 'FEDORA-2016-3b20c4ec9d', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178261.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0721
Session fixation vulnerability in pcsd in pcs before 0.9.157.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pcs/commit/bc6ad9086857559db57f4e3e6de66762291c0774'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1299615'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pcs/commit/e9b28833d54a47ec441f6dbad0db96e1fc662a5b'}, {'name': 'FEDORA-2016-cdd4228cc7', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178384.html'}, {'name': '97977', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/97977'}, {'name': 'RHSA-2016:2596', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-2596.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ClusterLabs/pcs/commit/acdbbe8307e6f4a36b2c7754765e732e43fe8d17'}, {'name': 'FEDORA-2016-3b20c4ec9d', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178261.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0724
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
Affected Products: n/a
References: [{'name': '1034694', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034694'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=326205'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52072'}, {'name': '[oss-security] 20160118 [vs] moodle security release', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/18/1'}, {'name': 'FEDORA-2016-fb2597f4eb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html'}, {'name': 'FEDORA-2016-1c10ab3c35', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0725
Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
Affected Products: n/a
References: [{'name': '1034694', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034694'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52552'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=326206'}, {'name': '[oss-security] 20160118 [vs] moodle security release', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/01/18/1'}, {'name': 'FEDORA-2016-fb2597f4eb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html'}, {'name': 'FEDORA-2016-1c10ab3c35', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0726
The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1295446'}]
CVE State: PUBLISHED
Explain CVE-2016-0727
The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.
Affected Products: n/a
References: [{'name': 'USN-3096-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-3096-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1382369'}, {'name': '1034808', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034808'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html'}, {'name': '81552', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/81552'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050'}]
CVE State: PUBLISHED
Explain CVE-2016-0729
Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.
Affected Products: n/a
References: [{'name': 'FEDORA-2016-880b91c090', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182597.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/135949/Apache-Xerces-C-XML-Parser-Buffer-Overflow.html'}, {'name': '1035113', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035113'}, {'name': '83423', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/83423'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?view=revision&revision=1727978'}, {'name': 'FEDORA-2016-ae9ac16cf3', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182131.html'}, {'name': 'openSUSE-SU-2016:1121', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-04/msg00086.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'name': '20160225 CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/537620/100/0/threaded'}, {'name': 'GLSA-201612-46', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-46'}, {'name': 'openSUSE-SU-2016:0966', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-04/msg00012.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/XERCESC-2061'}, {'name': 'FEDORA-2016-9ff972ca42', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182062.html'}, {'name': 'DSA-3493', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3493'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html'}, {'name': 'openSUSE-SU-2016:1808', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-07/msg00053.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0731
The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/AMBARI-14780'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.0/bk_releasenotes_ambari_2.2.1.0/content/ambari_relnotes-2.2.1.0-cves.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.2.1'}]
CVE State: PUBLISHED
Explain CVE-2016-0732
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pivotal.io/security/cve-2016-0732'}]
CVE State: PUBLISHED
Explain CVE-2016-0733
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
Affected Products: n/a
References: [{'name': '82871', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/82871'}, {'name': '[ranger-dev] 20160205 CVE update (CVE-2015-5167 & CVE-2016-0733) - Fixed in Ranger 0.5.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/ranger-dev/201602.mbox/%3CD2D9A4C5.114ECA%25vel%40apache.org%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/RANGER-835'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger'}]
CVE State: PUBLISHED
Explain CVE-2016-0734
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Affected Products: n/a
References: [{'name': 'RHSA-2016:1424', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:1424'}, {'name': '1035327', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1035327'}, {'name': '[oss-security] 20160310 [ANNOUNCE] CVE-2016-0734: ActiveMQ Web Console - Clickjacking', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2016/03/10/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt'}, {'name': '84321', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/84321'}, {'name': '[activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2016-0735
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
Affected Products: n/a
References: [{'name': '[ranger-dev] 20160328 CVE update (CVE-2016-0735) - Fixed in Ranger 0.5.2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/ranger-dev/201603.mbox/%3CD31EE434.14B879%25vel%40apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2016-0737
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
Affected Products: n/a
References: [{'name': 'RHSA-2016:0329', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0329.html'}, {'name': '81432', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/81432'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'RHSA-2016:0128', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0128.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://review.openstack.org/#/c/217750/'}, {'name': 'RHSA-2016:0155', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0155.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/swift/+bug/1466549'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.openstack.org/ossa/OSSA-2016-004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpad.net/swift/+milestone/2.4.0'}]
CVE State: PUBLISHED
Explain CVE-2016-0738
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
Affected Products: n/a
References: [{'name': 'RHSA-2016:0329', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0329.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/swift/blob/master/CHANGELOG'}, {'name': '81432', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/81432'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/cloud-archive/+bug/1493303'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html'}, {'name': 'RHSA-2016:0128', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0128.html'}, {'name': 'FEDORA-2016-2256c80a94', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176713.html'}, {'name': 'RHSA-2016:0155', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0155.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.openstack.org/ossa/OSSA-2016-004.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0739
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
Affected Products: n/a
References: [{'name': 'FEDORA-2016-d9f950c779', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178058.html'}, {'name': 'USN-2912-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2912-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.libssh.org/security/advisories/CVE-2016-0739.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/CVE-2016-0739'}, {'name': 'FEDORA-2016-dc9e8da03c', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178822.html'}, {'name': 'GLSA-201606-12', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-12'}, {'name': 'DSA-3488', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3488'}, {'name': 'RHSA-2016:0566', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0566.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/'}, {'name': 'openSUSE-SU-2016:0880', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-03/msg00111.html'}]
CVE State: PUBLISHED
Explain CVE-2016-0740
Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.
Affected Products: n/a
References: [{'name': 'GLSA-201612-52', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201612-52'}, {'name': 'DSA-3499', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3499'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst'}]
CVE State: PUBLISHED
Explain CVE-2016-0741
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/389/ticket/48412'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/389/changeset/cd45d032421b0ecf76d8cbb9b1c3aeef7680d9a2/'}, {'name': 'RHSA-2016:0204', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0204.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-4-7.html'}, {'name': '82343', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/82343'}]
CVE State: PUBLISHED
Explain CVE-2016-0742
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0371', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bto.bluecoat.com/security-advisory/sa115'}, {'name': 'GLSA-201606-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-06'}, {'name': '1034869', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034869'}, {'name': '[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html'}, {'name': 'RHSA-2016:1425', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:1425'}, {'name': 'DSA-3473', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3473'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1302587'}, {'name': 'USN-2892-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2892-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212818'}, {'name': '20210921 APPLE-SA-2021-09-20-4 Xcode 13', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/36'}]
CVE State: PUBLISHED
Explain CVE-2016-0746
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0371', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bto.bluecoat.com/security-advisory/sa115'}, {'name': 'GLSA-201606-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-06'}, {'name': '1034869', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034869'}, {'name': '[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html'}, {'name': 'RHSA-2016:1425', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:1425'}, {'name': 'DSA-3473', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3473'}, {'name': 'USN-2892-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2892-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1302588'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212818'}, {'name': '20210921 APPLE-SA-2021-09-20-4 Xcode 13', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/36'}]
CVE State: PUBLISHED
Explain CVE-2016-0747
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2016:0371', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bto.bluecoat.com/security-advisory/sa115'}, {'name': 'GLSA-201606-06', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201606-06'}, {'name': '1034869', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1034869'}, {'name': '[nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html'}, {'name': 'RHSA-2016:1425', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://access.redhat.com/errata/RHSA-2016:1425'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1302589'}, {'name': 'DSA-3473', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2016/dsa-3473'}, {'name': 'USN-2892-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2892-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT212818'}, {'name': '20210921 APPLE-SA-2021-09-20-4 Xcode 13', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2021/Sep/36'}]
CVE State: PUBLISHED