Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-4994 State: PUBLISHED Published: 2016-07-12T19:00:00 Last Updated: 2024-08-06T00:46:40.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036226 - https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f - https://bugzilla.gnome.org/show_bug.cgi?id=767873 - http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.html
- https://bugzilla.gnome.org/show_bug.cgi?id=767873 - http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.html - http://www.securityfocus.com/bid/91425 - http://www.debian.org/security/2016/dsa-3612 - http://www.ubuntu.com/usn/USN-3025-1 - http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.431987 - http://rhn.redhat.com/errata/RHSA-2016-2589.html
CVE ID: CVE-2016-4995 State: PUBLISHED Published: 2016-08-19T21:00:00 Last Updated: 2024-08-06T00:46:40.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information via a URL with a hostname. Additional Analyst Notes: - CVE Program Container: References: - https://theforeman.org/security.html#2016-4995 - https://access.redhat.com/errata/RHSA-2018:0336 - http://projects.theforeman.org/issues/15490 - http://projects.theforeman.org/projects/foreman/repos
ata/RHSA-2018:0336 - http://projects.theforeman.org/issues/15490 - http://projects.theforeman.org/projects/foreman/repository/revisions/c3c186de12be15e55d9582e54659f765304a1073
CVE ID: CVE-2016-4996 State: PUBLISHED Published: 2017-07-14T20:00:00 Last Updated: 2024-08-06T00:46:40.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0336 - https://bugzilla.redhat.com/show_bug.cgi?id=1349136
CVE ID: CVE-2016-4997 State: PUBLISHED Published: 2016-07-03T21:00:00 Last Updated: 2024-08-06T00:46:40.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00053.html - http://www.oracle.com/technetwork/topics/security/l
ists.opensuse.org/opensuse-security-announce/2016-08/msg00053.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00060.html - http://www.ubuntu.com/usn/USN-3017-1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html - http://www.ubuntu.com/usn/USN-3017-3 - http://rhn.redhat.com/errata/RHSA-2016-1847.html - https://bugzilla.redhat.com/show_bug.cgi?id=1349722 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html - http://www.ubuntu.com/usn/USN-3018-2 - http:/
tp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html - http://www.ubuntu.com/usn/USN-3018-2 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00048.html - http://www.ubuntu.com/usn/USN-3017-2 - http://rhn.redhat.com/errata/RHSA-2016-1875.html - http://www.ubuntu.com/usn/USN-3019-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.html - http://www.debian.org/security/2016/dsa-3607 - http://www.ubuntu.com/usn/USN-3016-2 - http://www.ubuntu.com/usn/USN-3016-1 - http://www.openwall.com/lists/oss-security/2016/06/24/5 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.html - http://lists.opensuse.org/opensuse-security
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00051.html - https://www.exploit-db.com/exploits/40435/ - https://github.com/torvalds/linux/commit/ce683e5f9d045e5d67d1312a42b359cb2ab2a13c - http://www.ubuntu.com/usn/USN-3018-1 - http://www.securitytracker.com/id/1036171 - https://www.exploit-db.com/exploits/40489/ - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541 - http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.html - http://rhn.redhat.com/errata/RHSA-201
tml - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.html - http://rhn.redhat.com/errata/RHSA-2016-1883.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00052.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html - http://www.ubuntu.com/usn/USN-3016-3 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00061.html - http://www.openwall.com/lists/oss-security/2016/09/29/10 - http://www.ubuntu.com/usn/USN-3016-4 - http://www.securityfocus.com/bid/91451 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d13
l/v4.x/ChangeLog-4.6.3 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c - http://www.ubuntu.com/usn/USN-3020-1 - https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpt - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
CVE ID: CVE-2016-4998 State: PUBLISHED Published: 2016-07-03T21:00:00 Last Updated: 2024-08-06T00:46:40.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://www.ubuntu.c
References: - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - http://www.ubuntu.com/usn/USN-3017-1 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html - http://www.ubuntu.com/usn/USN-3017-3 - http://rhn.redhat.com/errata/RHSA-2016-1847.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html - http://www.ubuntu.com/usn/USN-3018-2 - http://www.ubuntu.com/usn/USN-3017-2 - http://rhn.redhat.com/errata/RHSA-2016-1875.html - http://www.ubuntu.com/usn/USN-3019-1 - http://www.debian.org/security/2016/dsa-3607 - http://www.ubuntu.com/usn/USN-3016-2 - http://www.ubuntu.com/usn/USN-3016-1 - http://www.ope
rg/security/2016/dsa-3607 - http://www.ubuntu.com/usn/USN-3016-2 - http://www.ubuntu.com/usn/USN-3016-1 - http://www.openwall.com/lists/oss-security/2016/06/24/5 - http://www.ubuntu.com/usn/USN-3018-1 - http://www.securitytracker.com/id/1036171 - https://github.com/torvalds/linux/commit/6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 - https://bugzilla.redhat.com/show_bug.cgi?id=1349886 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 - http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html - http://rhn.redhat.com/errata/RHSA-2016-1883.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/ms
tml - http://rhn.redhat.com/errata/RHSA-2016-1883.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html - http://www.ubuntu.com/usn/USN-3016-3 - http://rhn.redhat.com/errata/RHSA-2017-0036.html - http://www.ubuntu.com/usn/USN-3016-4 - http://www.securityfocus.com/bid/91451 - http://www.ubuntu.com/usn/USN-3020-1
CVE ID: CVE-2016-4999 State: PUBLISHED Published: 2016-08-05T15:00:00 Last Updated: 2024-08-06T00:46:40.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:1429 - https://issues.jboss.org/browse/DASHBUILDE-113 - https://access.redhat.com/errata/RHSA-2016:1428 - h
ta/RHSA-2016:1429 - https://issues.jboss.org/browse/DASHBUILDE-113 - https://access.redhat.com/errata/RHSA-2016:1428 - http://www.securityfocus.com/bid/91795 - https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b - https://bugzilla.redhat.com/show_bug.cgi?id=1349990
CVE ID: CVE-2016-582384 State: REJECTED Published: 2016-12-14T16:00:00 Last Updated: 2016-12-14T21:57:01 Description: No description available.
CVE ID: CVE-2016-5000 State: PUBLISHED Published: 2016-08-05T14:00:00 Last Updated: 2024-08-06T00:46:40.237Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/538981/100/0/threaded - http://www.securityfocus.com/bid/92100 - http://www.securitytracker.com/id/1037741 - https://lists.apache.org/list.html?user%40poi.apache.org - http
/bid/92100 - http://www.securitytracker.com/id/1037741 - https://lists.apache.org/list.html?user%40poi.apache.org - https://www.oracle.com/security-alerts/cpuoct2020.html - http://www-01.ibm.com/support/docview.wss?uid=swg21996759
CVE ID: CVE-2016-5001 State: PUBLISHED Published: 2017-08-30T19:00:00Z Last Updated: 2024-09-16T19:51:02.745Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Information Disclosure Description: This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94950 - http://seclists.org/oss-sec/2016/q4/698 - https://lists.apache.org
eferences: - http://www.securityfocus.com/bid/94950 - http://seclists.org/oss-sec/2016/q4/698 - https://lists.apache.org/thread.html/r66de86b9a608c1da70b2d27d765c11ec88edf6e5dd6f379ab33e072a%40%3Cuser.flink.apache.org%3E
CVE ID: CVE-2016-5002 State: PUBLISHED Published: 2017-10-27T18:00:00.000Z Last Updated: 2025-02-13T16:27:14.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/07/12/5 - http://www.securitytracker.com/id/1036294 - https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/115042 - ht
t.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/115042 - http://www.securityfocus.com/bid/91736 - https://access.redhat.com/errata/RHSA-2018:3768 - https://security.gentoo.org/glsa/202401-26
CVE ID: CVE-2016-5003 State: PUBLISHED Published: 2017-10-27T18:00:00.000Z Last Updated: 2025-02-13T16:27:15.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/07/12/5 - https://access.redhat.com/errata/RHSA-2018:1779 - https://access.redhat.com/errata/RHSA-2018:1784 - http://www.securityfocus.com/bid/91738 - https://access.redhat.com/errata/RHSA-2018:2317 - http://www.secur
-2018:1784 - http://www.securityfocus.com/bid/91738 - https://access.redhat.com/errata/RHSA-2018:2317 - http://www.securitytracker.com/id/1036294 - https://access.redhat.com/errata/RHSA-2018:1780 - https://0ang3el.blogspot.ru/2016/07/beware-of-ws-xmlrpc-library-in-your.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/115043 - http://www.securityfocus.com/bid/91736 - https://access.redhat.com/errata/RHSA-2018:3768 - http://www.openwall.com/lists/oss-security/2020/01/16/1 - http://www.openwall.com/lists/oss-security/2020/01/24/2 - https://security.gentoo.org/glsa/202401-26
CVE ID: CVE-2016-5004 State: PUBLISHED Published: 2017-06-06T18:00:00 Last Updated: 2024-08-06T00:46:40.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/07/12/5 - http://www.securitytracker.com/id/1036294 - https://github.com/0ang3el/unsafe-xmlrpc - https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html - http://www.securityfocus.com/bid
xmlrpc - https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html - http://www.securityfocus.com/bid/91736
CVE ID: CVE-2016-5005 State: PUBLISHED Published: 2016-07-28T16:00:00 Last Updated: 2024-08-06T00:46:40.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/538878/100/0/threaded - http://www.securitytracker.com/id/1036475 - http://packetstormsecurity.com/files/137870/Apache-Archiva-1.3.9-Cross-Site-Scripting.html - http://www.securityfocus.
- http://packetstormsecurity.com/files/137870/Apache-Archiva-1.3.9-Cross-Site-Scripting.html - http://www.securityfocus.com/bid/91707 - http://seclists.org/fulldisclosure/2016/Jul/38 - https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2016-5006 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-06T00:46:40.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/CVE-2016-5006/ - https://pivotal.io/security/cve-2016-5006
CVE ID: CVE-2016-5007 State: PUBLISHED Published: 2017-05-25T17:00:00 Last Updated: 2024-08-06T00:46:40.202Z Vendors: Pivotal Products: Spring Security, Spring Framework Problem Types: Security Control Bypass Description: Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The prob
nize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://www.securityfocus.com/bid/91687 - https://pivotal.io/security/cve-2016-5007 - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2016-5008 State: PUBLISHED Published: 2016-07-13T15:00:00 Last Updated: 2024-08-06T00:46:40.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1180092 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZZMOMRXNPALA34XDF5NK363KDLAYSTL/ - http://www.debian.org/security/2016/dsa-3613 - h
e%40lists.fedoraproject.org/message/DZZMOMRXNPALA34XDF5NK363KDLAYSTL/ - http://www.debian.org/security/2016/dsa-3613 - http://www.securityfocus.com/bid/91562 - http://security.libvirt.org/2016/0001.html - http://lists.opensuse.org/opensuse-updates/2016-07/msg00055.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QTQF6LXKEEMJG4VOOCIAPJAD6ACBYP4W/ - http://lists.opensuse.org/opensuse-updates/2016-08/msg00024.html - http://lists.opensuse.org/opensuse-updates/2016-07/msg00054.html - http://rhn.redhat.com/errata/RHSA-2016-2577.html - https://usn.ubuntu.com/3576-1/
CVE ID: CVE-2016-5009 State: PUBLISHED Published: 2016-07-12T19:00:00 Last Updated: 2024-08-06T00:46:40.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix. Additional Analyst Notes: - CVE Program Container: References: - http://tracker.ceph.com/issues/16297 - https://access.redhat.com/errata/RHSA-2016:1384 - https://github.com/ceph/ceph/commit/957ece7e95d8f8746191fd9629622d4457d690d6 - https://access.redhat.com/errata/RHSA-2016:1385 - https://github.com/ceph/ceph/pull/9700 - http://
d9629622d4457d690d6 - https://access.redhat.com/errata/RHSA-2016:1385 - https://github.com/ceph/ceph/pull/9700 - http://lists.opensuse.org/opensuse-updates/2016-12/msg00126.html
CVE ID: CVE-2016-5010 State: PUBLISHED Published: 2017-04-20T18:00:00 Last Updated: 2024-08-06T00:46:40.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file. Additional Analyst Notes: - CVE Program Container: References: - http://git.imagemagick.org/repos/ImageMagick/commit/c20de102cc57f3739a8870f79e728e3b0bea18c0 - https://security.gentoo.org/glsa/201611-21 - https://bugzilla.redhat.com/show_bug.cgi?id=1354500
CVE ID: CVE-2016-5011 State: PUBLISHED Published: 2017-04-11T15:00:00 Last Updated: 2024-08-06T00:46:40.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/?id=7164a1c3 - http://www.securityfocus.com/bid/91683 - http://www.securitytracker.com/id/1036272 - http://www.openwall.com/list
a1c3 - http://www.securityfocus.com/bid/91683 - http://www.securitytracker.com/id/1036272 - http://www.openwall.com/lists/oss-security/2016/07/11/2 - http://www-01.ibm.com/support/docview.wss?uid=nas8N1021801 - http://www-01.ibm.com/support/docview.wss?uid=isg3T1024543 - http://rhn.redhat.com/errata/RHSA-2016-2605.html
CVE ID: CVE-2016-5012 State: PUBLISHED Published: 2017-01-20T08:39:00 Last Updated: 2024-08-06T00:46:40.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Moodle 3.x, glossary search displays entries without checking user permissions to view them. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92041 - https://moodle.org/mod/forum/discuss.php?d=336697
CVE ID: CVE-2016-5013 State: PUBLISHED Published: 2017-01-20T08:39:00 Last Updated: 2024-08-06T00:46:40.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=336698 - http://www.securityfocus.com/bid/92040
CVE ID: CVE-2016-5014 State: PUBLISHED Published: 2017-01-20T08:39:00 Last Updated: 2024-08-06T00:46:40.233Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92042 - https://moodle.org/mod/forum/discuss.php?d=336699
CVE ID: CVE-2016-5015 State: REJECTED Published: 2018-07-09T16:00:00 Last Updated: 2018-07-09T15:57:01 Description: No description available.
CVE ID: CVE-2016-5016 State: PUBLISHED Published: 2017-04-24T19:00:00 Last Updated: 2024-08-06T00:46:40.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudfoundry/uaa/releases/tag/2.7.4.6 - https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3 - https://github.com/cloudfoundry/uaa-release/releases
.7.4.6 - https://github.com/cloudfoundry/uaa/releases/tag/3.3.0.3 - https://github.com/cloudfoundry/uaa-release/releases/tag/v12.3 - https://github.com/cloudfoundry/uaa/releases/tag/3.4.2 - https://github.com/cloudfoundry/cf-release/releases/tag/v240 - https://pivotal.io/security/cve-2016-5016 - https://github.com/cloudfoundry/uaa-release/releases/tag/v11.3