Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-9155 State: PUBLISHED Published: 2016-11-22T11:00:00 Last Updated: 2024-08-06T02:42:10.946Z Vendors: n/a Products: SIEMENS-branded IP Cameras Problem Types: incorrect access control Description: The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances. Additional Analys
ith network access to the web server to obtain administrative credentials under certain circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-322-01 - http://www.securityfocus.com/bid/94392 - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284765.pdf
CVE ID: CVE-2016-9156 State: PUBLISHED Published: 2016-12-05T08:09:00 Last Updated: 2024-08-06T02:42:11.125Z Vendors: n/a Products: Siemens SICAM PAS through V8.08 Problem Types: file manipulation Description: A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94549 - http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf
CVE ID: CVE-2016-9157 State: PUBLISHED Published: 2016-12-05T08:09:00 Last Updated: 2024-08-06T02:42:11.024Z Vendors: n/a Products: Siemens SICAM PAS through V8.08 Problem Types: remote code execution Description: A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94549 - http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-946325.pdf
CVE ID: CVE-2016-9158 State: PUBLISHED Published: 2016-12-17T03:34:00 Last Updated: 2024-08-06T02:42:10.987Z Vendors: Siemens AG Products: SIMATIC S7-300 CPU family, SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-400 V6 and earlier CPU family, SIMATIC S7-400 V7 CPU family Problem Types: CWE-20 Description: A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SI
ly (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions). Specially crafted packets sent to port 80/tcp could cause the affected devices to go into defect mode. A cold restart is required to recover the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94820 - http://www.securitytracker.com/id/1037434 - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05 - https://www.
4820 - http://www.securitytracker.com/id/1037434 - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05 - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf
CVE ID: CVE-2016-9159 State: PUBLISHED Published: 2016-12-17T03:34:00 Last Updated: 2024-08-06T02:42:11.143Z Vendors: Siemens AG Products: SIMATIC S7-300 CPU family, SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-400 V6 and earlier CPU family, SIMATIC S7-400 V7 CPU family, SIMATIC S7-410 V8 CPU family, SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) Problem Types: CWE-200 Description: A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SI
been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices.
TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94820 - http://www.securitytracker.com/id/1037434 - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05 - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf
CVE ID: CVE-2016-9160 State: PUBLISHED Published: 2016-12-17T03:34:00 Last Updated: 2024-08-06T02:42:11.100Z Vendors: n/a Products: SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) Problem Types: CWE-111 Description: A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.
ious link under certain conditions. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-693129.pdf - http://www.securitytracker.com/id/1037435 - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-04 - http://www.securityfocus.com/bid/94825
CVE ID: CVE-2016-9161 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9162 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9163 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9164 State: PUBLISHED Published: 2017-03-07T15:00:00 Last Updated: 2024-08-06T02:42:10.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94257 - http://packetstormsecurity.com/files/139661/CA-Unified-Infrastructure-Management-Bypass-Traversal-Disclosure.html - http://seclists
etstormsecurity.com/files/139661/CA-Unified-Infrastructure-Management-Bypass-Traversal-Disclosure.html - http://seclists.org/fulldisclosure/2016/Nov/55 - https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html - http://www.zerodayinitiative.com/advisories/ZDI-16-607
CVE ID: CVE-2016-9165 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-06T02:42:11.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to obtain active session ids and consequently bypass authentication or gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94257 - http://www.zerodayinitiative.com/advisories/ZDI-16-606 - https://www.ca.com/us/services-support/ca-supp
.com/bid/94257 - http://www.zerodayinitiative.com/advisories/ZDI-16-606 - https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html
CVE ID: CVE-2016-9166 State: PUBLISHED Published: 2019-03-18T14:41:58 Last Updated: 2024-08-06T02:42:11.074Z Vendors: n/a Products: NetIQ eDirectory Problem Types: Downgrade of communication security Description: NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/edirectory-9/edirectory902_releasenotes/data/edirectory902_releasenotes.html
CVE ID: CVE-2016-9167 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-06T02:42:10.930Z Vendors: n/a Products: Novell eDirectory Problem Types: privilege escalation Description: NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7016794 - http://www.securityfocus.com/bid/97315
CVE ID: CVE-2016-9168 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-06T02:42:10.939Z Vendors: n/a Products: Novell eDirectory Problem Types: clickjacking Description: A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7016794 - http://www.securityfocus.com/bid/97320
CVE ID: CVE-2016-9169 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-06T02:42:10.947Z Vendors: n/a Products: Novell GroupWise Problem Types: XSS Description: A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially crafted link. This could lead to session compromise or other browser-based attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018371 - http://www.security
Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7018371 - http://www.securityfocus.com/bid/97318
CVE ID: CVE-2016-9170 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:24 Description: No description available.
CVE ID: CVE-2016-9171 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:37 Description: No description available.
CVE ID: CVE-2016-9172 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:05 Description: No description available.
CVE ID: CVE-2016-9173 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:15:30 Description: No description available.
CVE ID: CVE-2016-9174 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:03 Description: No description available.
CVE ID: CVE-2016-9175 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2021-01-06T16:16:01 Description: No description available.
CVE ID: CVE-2016-9176 State: PUBLISHED Published: 2016-11-04T00:00:00 Last Updated: 2024-08-06T02:42:10.918Z Vendors: Micro Focus Products: Micro Focus Rumba 9.4 Problem Types: Buffer Overflow Description: Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers able to inject arguments to these binaries to execute code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94236 - https://www.exploit-db.com/exploits/40648/
CVE ID: CVE-2016-9177 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:10.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0868 - http://www.securityfocus.com/bid/94218 - https://github.com/perwendel/spark/issues/700 - http://seclists.org/fulldisclosure/2016/Nov/13
CVE ID: CVE-2016-9178 State: PUBLISHED Published: 2016-11-28T03:01:00 Last Updated: 2024-08-06T02:42:10.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/1c109fabbd51863475cd12ac206bdd249aee35af - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1c109fabbd51863475cd12ac206bdd249aee35a
35af - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1c109fabbd51863475cd12ac206bdd249aee35af - http://www.openwall.com/lists/oss-security/2016/11/04/4 - https://bugzilla.redhat.com/show_bug.cgi?id=1391908 - http://www.securityfocus.com/bid/94144 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.5
CVE ID: CVE-2016-9179 State: PUBLISHED Published: 2016-12-22T21:00:00 Last Updated: 2024-08-06T02:42:10.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94215 - http://www.openwall.com/lists/oss-security/2016/11/04/1
CVE ID: CVE-2016-9180 State: PUBLISHED Published: 2016-12-22T21:00:00 Last Updated: 2024-08-06T02:42:11.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94219 - http://www.openwall.com/lists/oss-security/2016/11/04/2 - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00020.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00033.html
CVE ID: CVE-2016-9181 State: PUBLISHED Published: 2016-12-22T21:00:00 Last Updated: 2024-08-06T02:42:11.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/11/04/2 - http://www.securityfocus.com/bid/94220
CVE ID: CVE-2016-9182 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.065Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized method name to bypass the permission check, e.g., controller=expHTMLEditor&action=preview&editor=ckeditor and controller=expHTMLEditor&action=Preview&editor=ckeditor. An anonymous user will be rejected for the former but can access the
ller=expHTMLEditor&action=Preview&editor=ckeditor. An anonymous user will be rejected for the former but can access the latter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94227 - https://github.com/exponentcms/exponent-cms/commit/684d79424f768db8bb345d5c68aa2a886239492b
CVE ID: CVE-2016-9183 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.152Z Vendors: n/a Products: n/a Problem Types: n/a Description: In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94227 - https://github.com/exponentcm
yst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94227 - https://github.com/exponentcms/exponent-cms/commit/3b3557e9f6ba193a4c23c8ce5498fa285dddf3f3
CVE ID: CVE-2016-9184 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94227 - https://github.com/exponentcms/exponent-cms/commit/0ce8b94d745b818bd207933d9a2e7f32587c2c89
CVE ID: CVE-2016-9185 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration. Affected versions are <=5.0.3, >=6.0.0 <=6.1.0, and ==7.0.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94205 - https://access.redhat.com/errata/RHSA-2017:1464 - https://access.redhat.com/errata/RHSA-2017:1450 - https://bugs.launchpad.net/ossa/+bug/1606500 - https://access.redhat.com/errata/RHSA-2017:1456
CVE ID: CVE-2016-9186 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94190 - https://packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html
CVE ID: CVE-2016-9187 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94191 - https://packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html
CVE ID: CVE-2016-9188 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94189 - https://packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html
CVE ID: CVE-2016-9189 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/python-pillow/Pillow/pull/2146/commits/c50ebe6459a131a1ea8ca531f10da616d3ceaa0f - https://security.gentoo.org/glsa/201612-52 - http://www.securityfocus.com/bid/94234 - https://github.com/python-pillow/Pillow/issues/2105 -
too.org/glsa/201612-52 - http://www.securityfocus.com/bid/94234 - https://github.com/python-pillow/Pillow/issues/2105 - http://www.debian.org/security/2016/dsa-3710 - http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html
CVE ID: CVE-2016-9190 State: PUBLISHED Published: 2016-11-04T10:00:00 Last Updated: 2024-08-06T02:42:11.192Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201612-52 - http://www.securityfocus.com/bid/94234 - https://github.com/python-pillow/Pillow/issues/2105 - http://www.debian.org/security/2016/dsa-3710 - http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.htm
ssues/2105 - http://www.debian.org/security/2016/dsa-3710 - http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html - https://github.com/python-pillow/Pillow/pull/2146/commits/5d8a0be45aad78c5a22c8d099118ee26ef8144af
CVE ID: CVE-2016-9191 State: PUBLISHED Published: 2016-11-28T03:01:00 Last Updated: 2024-08-06T02:42:11.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/11/05/4 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03802en_us - http://git.kernel.org/cgi