Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-6512 State: PUBLISHED Published: 2016-08-06T23:00:00 Last Updated: 2024-08-06T01:29:20.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvb_get_guintvar function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2016/07/28/3 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12661 - https://www.exploit-db.com/exploits/40195/ - http://www.wireshark.org/security/wnpa-se
/bugzilla/show_bug.cgi?id=12661 - https://www.exploit-db.com/exploits/40195/ - http://www.wireshark.org/security/wnpa-sec-2016-48.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=2193bea3212d74e2a907152055e27d409b59485e - http://www.securitytracker.com/id/1036480 - http://www.securityfocus.com/bid/92174
CVE ID: CVE-2016-6513 State: PUBLISHED Published: 2016-08-06T23:00:00 Last Updated: 2024-08-06T01:29:20.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 2.x before 2.0.5 does not restrict the recursion depth, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://www.wireshark.org/security/wnpa-sec-2016-49.html - http://openwall.com/lists/oss-security/2016/07/28/3 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12663 - http://www.securitytracker.com/id/1036480 - https://code.wireshark.org/
s.wireshark.org/bugzilla/show_bug.cgi?id=12663 - http://www.securitytracker.com/id/1036480 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=347f071f1b9180563c28b0f3d0627b91eb456c72
CVE ID: CVE-2016-6515 State: PUBLISHED Published: 2016-08-07T00:00:00 Last Updated: 2024-08-06T01:29:20.223Z Vendors: n/a Products: n/a Problem Types: n/a Description: The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us - https://security.netapp.com/advisory/ntap-20171130-0003/ - https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d58704
ity.netapp.com/advisory/ntap-20171130-0003/ - https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97 - http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html - https://www.exploit-db.com/exploits/40888/ - http://www.securityfocus.com/bid/92212 - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.securitytracker.com/id/1036487 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/ - https://access.redhat.com/errata/RHSA-2017:2029 - https://lists.deb
ject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/ - https://access.redhat.com/errata/RHSA-2017:2029 - https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html - http://openwall.com/lists/oss-security/2016/08/01/2 - https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
CVE ID: CVE-2016-6516 State: PUBLISHED Published: 2016-08-06T20:00:00 Last Updated: 2024-08-06T01:29:20.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/10eec60ce79187686e052092e5383c99b4420a20 - http://www.securityfocus.com/bid/92259 - http://www.openwall.com/lists/oss-security/2016/07/31/6 - http://
c99b4420a20 - http://www.securityfocus.com/bid/92259 - http://www.openwall.com/lists/oss-security/2016/07/31/6 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=10eec60ce79187686e052092e5383c99b4420a20 - https://bugzilla.redhat.com/show_bug.cgi?id=1362457
CVE ID: CVE-2016-6517 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T01:29:20.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir parameter to barebone.jsp. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/08/02/1 - http://www.securityfocus.com/bid/92215 - http://www.openwall.com/lists/oss-security/2016/08/01/5
CVE ID: CVE-2016-6518 State: PUBLISHED Published: 2016-09-26T15:00:00 Last Updated: 2024-08-06T01:29:20.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of malformed packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92968 - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160914-01-sep-en
CVE ID: CVE-2016-6519 State: PUBLISHED Published: 2017-04-21T15:00:00 Last Updated: 2024-08-06T01:29:20.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-2115.html - http://rhn.redhat.com/errata/RHSA-2016-2117.html - http://rhn.redhat.com/errata/RHSA-2016-2116.html - https://bugs.launchpad.net/manila-ui/+bug/1597738 - http://www.securityfocus.com/bid/93001
errata/RHSA-2016-2116.html - https://bugs.launchpad.net/manila-ui/+bug/1597738 - http://www.securityfocus.com/bid/93001 - http://www.openwall.com/lists/oss-security/2016/09/15/7 - https://bugzilla.redhat.com/show_bug.cgi?id=1375147
CVE ID: CVE-2016-6520 State: PUBLISHED Published: 2016-12-13T15:00:00 Last Updated: 2024-08-06T01:29:20.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036502 - http://www.openwall.com/lists/oss-security/2016/08/02/6 - http://www.imagemagick.org/script/changelog.php - http://www.openwall.com/lists/oss-security/2016/08/02/10 - https://github.com/ImageMagick/ImageMagick/commit/76401e172ea3a55182be2b8e2aca4d07270f6d
ts/oss-security/2016/08/02/10 - https://github.com/ImageMagick/ImageMagick/commit/76401e172ea3a55182be2b8e2aca4d07270f6da6
CVE ID: CVE-2016-6521 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T01:29:20.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/08/02/2 - http://www.openwall.com/lists/oss-security/2016/08/02/11 - https://github.com/sheehan/grails-console/issues/54 - http://www.securit
openwall.com/lists/oss-security/2016/08/02/11 - https://github.com/sheehan/grails-console/issues/54 - http://www.securityfocus.com/bid/92267 - https://github.com/sheehan/grails-console/issues/55 - http://www.openwall.com/lists/oss-security/2016/08/03/9
CVE ID: CVE-2016-6522 State: PUBLISHED Published: 2017-03-07T16:00:00 Last Updated: 2024-08-06T01:29:20.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/08/02/8 - http://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/023_uvmisavail.patch.sig - http://www.openwall.com/lists/oss-security/2016/08/02/12 - http://www.securityfocus.com/bid
n/023_uvmisavail.patch.sig - http://www.openwall.com/lists/oss-security/2016/08/02/12 - http://www.securityfocus.com/bid/92264
CVE ID: CVE-2016-6523 State: PUBLISHED Published: 2016-12-09T20:00:00 Last Updated: 2024-08-06T01:29:20.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) link_type parameter to admin/media.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/08/02/13 - http://www.openwall.com/lists/oss-security/2016/08/02/3 - https://hg.dotclear.org/dotclear/file/18dc878c1178/CHANGELOG - https://hg.dotclear.org/dotclear/rev/40d0207e520d - http://www.secu
.dotclear.org/dotclear/file/18dc878c1178/CHANGELOG - https://hg.dotclear.org/dotclear/rev/40d0207e520d - http://www.securityfocus.com/bid/92272
CVE ID: CVE-2016-6525 State: PUBLISHED Published: 2016-09-22T15:00:00 Last Updated: 2024-08-06T01:29:20.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the pdf_load_mesh_params function in pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a large decode array. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3655 - http://www.openwall.com/lists/oss-security/2016/08/03/8 - http://bugs.ghostscript.com/show_bug.cgi?id=696954 - http://www.securityfocus.com/bid/92266 - http://git.ghostscript.com/?p=mupdf.git%3Bh=39b0f07dd960f34e7e6
cgi?id=696954 - http://www.securityfocus.com/bid/92266 - http://git.ghostscript.com/?p=mupdf.git%3Bh=39b0f07dd960f34e7e6bf230ffc3d87c41ef0f2e - https://security.gentoo.org/glsa/201702-12
CVE ID: CVE-2016-6526 State: PUBLISHED Published: 2017-01-18T17:00:00 Last Updated: 2024-08-06T01:29:20.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object. Additional Analyst Notes: - CVE Program Container: References: - http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016 - http://www.openwall.com/lists/oss-security/2016/08/05/1 - http://www.securityfocus.com/bid/92330
CVE ID: CVE-2016-6527 State: PUBLISHED Published: 2017-01-18T17:00:00 Last Updated: 2024-08-06T01:29:20.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and reboot) or possibly gain privileges via a malformed serializable object. Additional Analyst Notes: - CVE Program Container: References: - http://security.samsungmobile.com/smrupdate.html#SMR-AUG-2016 - http://www.openwall.com/lists/oss-security/2016/08/05/1 - http://www.securityfocus.com/bid/92330
CVE ID: CVE-2016-6530 State: PUBLISHED Published: 2016-09-21T01:00:00 Last Updated: 2024-08-06T01:36:27.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier has default passwords for the sa and cdr accounts, which allows remote attackers to obtain administrative access by leveraging knowledge of these passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/548399 - https://www.schickbysirona.com/items.php?itemid=19189 - http://www.securityfocus.com/bid/92777
CVE ID: CVE-2016-6531 State: PUBLISHED Published: 2016-09-24T10:00:00 Last Updated: 2024-08-06T01:36:27.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intranet TCP port 3306. NOTE: the vendor disputes this issue, stating that the "vulnerability note ... is factually false ... there is indeed a default blank password, but it can be changed ... We recommend that users change it, each customer receives direction. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/6197
n. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/619767 - http://www.securityfocus.com/bid/92780 - http://www.kb.cert.org/vuls/id/GWAN-ACVSBM
CVE ID: CVE-2016-6532 State: PUBLISHED Published: 2016-09-24T10:00:00 Last Updated: 2024-08-06T01:36:27.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: DEXIS Imaging Suite 10 has a hardcoded password for the sa account, which allows remote attackers to obtain administrative access by entering this password in a DEXIS_DATA SQL Server session. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/282991 - http://www.securityfocus.com/bid/92823
CVE ID: CVE-2016-6534 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T01:36:27.363Z Vendors: n/a Products: Opmantek NMIS before 8.5.12G Problem Types: command injection Description: Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-6535 State: PUBLISHED Published: 2016-09-19T01:00:00 Last Updated: 2024-08-06T01:36:27.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVer Information EH6108H+ devices with firmware X9.03.24.00.07l have hardcoded accounts, which allows remote attackers to obtain root access by leveraging knowledge of the credentials and establishing a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/667480 - http://www.securityfocus.com/bid/92936
CVE ID: CVE-2016-6536 State: PUBLISHED Published: 2016-09-19T01:00:00 Last Updated: 2024-08-06T01:36:27.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions or modify passwords by leveraging knowledge of a handle parameter value. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/667480 - http://www.securityfocus.com/bid/92936
CVE ID: CVE-2016-6537 State: PUBLISHED Published: 2016-09-19T01:00:00 Last Updated: 2024-08-06T01:36:27.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVer Information EH6108H+ devices with firmware X9.03.24.00.07l store passwords in a cleartext base64 format and require cleartext credentials in HTTP Cookie headers, which allows context-dependent attacks to obtain sensitive information by reading these strings. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/667480 - http://www.securityfocus.com/bid/92936
CVE ID: CVE-2016-6538 State: PUBLISHED Published: 2018-07-06T21:00:00 Last Updated: 2024-08-06T01:36:27.362Z Vendors: TrackR Products: Bravo Mobile Application Problem Types: CWE-313 Description: The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7.com/2016/10/25
ttp://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - https://www.kb.cert.org/vuls/id/617567
CVE ID: CVE-2016-6539 State: PUBLISHED Published: 2018-07-06T21:00:00 Last Updated: 2024-08-06T01:36:27.350Z Vendors: TrackR Products: Bravo Mobile Application Problem Types: CWE-200 Description: The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE P
the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - https://www.kb.cert.org/vuls/id/617567
CVE ID: CVE-2016-6540 State: PUBLISHED Published: 2018-07-06T21:00:00 Last Updated: 2024-08-06T01:36:27.351Z Vendors: TrackR Products: Bravo Mobile Application Problem Types: CWE-306 Description: Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfo
CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - https://www.kb.cert.org/vuls/id/617567
CVE ID: CVE-2016-6541 State: PUBLISHED Published: 2018-07-06T21:00:00 Last Updated: 2024-08-06T01:36:27.330Z Vendors: TrackR Products: Bravo Mobile Application Problem Types: CWE-306 Description: TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7
References: - http://www.securityfocus.com/bid/93874 - https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - https://www.kb.cert.org/vuls/id/617567
CVE ID: CVE-2016-6542 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:27.289Z Vendors: iTrack Products: Easy Problem Types: CWE-200 Description: The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an iTrack device. The tracker ID is the device's BLE MAC address. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/974055 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com/bid/93875
CVE ID: CVE-2016-6543 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:27.383Z Vendors: iTrack Products: Easy Problem Types: CWE-799 Description: A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS data, which can allow unauthenticated parties to track the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/974055 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com/bid/93875
CVE ID: CVE-2016-6544 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:28.285Z Vendors: iTrack Products: Easy Problem Types: CWE-306 Description: getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps. This vulnerability can be exploited to alter the GPS data of a lost device. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/974055 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com/bid/93875
CVE ID: CVE-2016-6545 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:27.393Z Vendors: iTrack Products: Easy Problem Types: CWE-613 Description: Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/974055 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com
s://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com/bid/93875
CVE ID: CVE-2016-6546 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:27.367Z Vendors: iTrack Products: Easy Problem Types: CWE-313 Description: The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encoding format is considered equivalent to cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/974055 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - http://www.securityfocus.com/bid/93875
CVE ID: CVE-2016-6547 State: PUBLISHED Published: 2018-07-13T20:00:00 Last Updated: 2024-08-06T01:36:27.383Z Vendors: Zizai Technology Products: Tech Nut Mobile Application Problem Types: CWE-313 Description: The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Additional Analyst Notes: - CVE Program Container: References: - https://www.securityfocus.com/bid/93877 - https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/ - https://www.kb.cert.org/vuls/id/402847