Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-5048 State: PUBLISHED Published: 2016-08-26T19:00:00 Last Updated: 2024-08-06T00:46:40.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/294272 - http://www.securityfocus.com/bid/92487
CVE ID: CVE-2016-5049 State: PUBLISHED Published: 2016-08-26T19:00:00 Last Updated: 2024-08-06T00:46:40.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/294272 - http://www.securityfocus.com/bid/92487
CVE ID: CVE-2016-5050 State: PUBLISHED Published: 2016-08-26T19:00:00 Last Updated: 2024-08-06T00:46:40.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/294272 - http://www.securityfocus.com/bid/92487
CVE ID: CVE-2016-5051 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.251Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 Problem Types: Cleartext WPA2 PSK Description: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 stores a PSK in cleartext under /private/var/mobile/Containers/Data/Application. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5052 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.297Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 Problem Types: Lack of SSL Pinning Description: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 does not use SSL pinning. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5053 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.304Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 Problem Types: Pre-Authentication Command Execution Description: OSRAM SYLVANIA Osram Lightify Home before 2016-07-26 allows remote attackers to execute arbitrary commands via TCP port 4000. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5054 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.227Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 Problem Types: ZigBee Network Command Replay Description: OSRAM SYLVANIA Osram Lightify Home through 2016-07-26 allows Zigbee replay. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5055 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.245Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 Problem Types: XSS Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 has XSS in the username field and Wireless Client Mode configuration page. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5056 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.253Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 Problem Types: Weak Default WPA2 PSKs Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 uses only 8 hex digits for a PSK. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5057 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.248Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 Problem Types: Lack of SSL Pinning Description: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 does not use SSL pinning. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5058 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.341Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 Problem Types: ZigBee Network Command Replay Description: OSRAM SYLVANIA Osram Lightify Pro through 2016-07-26 allows Zigbee replay. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5059 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.283Z Vendors: n/a Products: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 Problem Types: Cached Screenshot Information Leak Description: OSRAM SYLVANIA Osram Lightify Pro before 2016-07-26 allows attackers to obtain sensitive information by reading screenshots under /private/var/mobile/Containers/Data/Application. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/07/26/r7-2016-10-multiple-osram-sylvania-osram-lightify-vulnerabilities-cve-2016-5051-through-5059
CVE ID: CVE-2016-5060 State: PUBLISHED Published: 2016-12-13T22:00:00 Last Updated: 2024-08-06T00:46:40.273Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/naver/ngrinder/releases/tag/ngrinder-3.4-20160525 - http://packetstormsecurity.com/files/137469/nGrinder-3.3-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2016/Jun/23 - https://github.com/naver/ngrinder/issues/103
CVE ID: CVE-2016-5061 State: PUBLISHED Published: 2016-09-29T10:00:00 Last Updated: 2024-08-06T00:46:40.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web server in Aternity before 9.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTPAgent, (2) MacAgent, (3) getExternalURL, or (4) retrieveTrustedUrl page. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/706359 - http://www.securityfocus.com/bid/93210
CVE ID: CVE-2016-5062 State: PUBLISHED Published: 2016-09-29T10:00:00 Last Updated: 2024-08-06T00:46:40.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/706359 - http://www.securityfocus.com/bid/93208
CVE ID: CVE-2016-5063 State: PUBLISHED Published: 2017-05-02T14:00:00 Last Updated: 2024-08-06T00:46:40.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93948 - https://www.exploit-db.com/exploits/43934/ - https://docs.bmc.com/docs/display/bsa87/Notification+of+Windows+RSCD+Agent+vulnerability+in+BMC+Server+Automation+CVE-2016-5063 - https://www.exploit-db.com/exploits/43902/
CVE ID: CVE-2016-5065 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.264Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: command injection Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5066 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.286Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: weak passwords Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5067 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.333Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: command injection Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5068 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.266Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: no authentication Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 do not require authentication for Embedded_Ace_Get_Task.cgi requests. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5069 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.270Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: guessable session tokens Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 use guessable session tokens, which are in the URL. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5070 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.335Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: stored passwords in cleartext Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 store passwords in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5071 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.296Z Vendors: n/a Products: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 Problem Types: wrong privileges Description: Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root. Additional Analyst Notes: - CVE Program Container: References: - https://carvesystems.com/sierra-wireless-2016-advisory.html
CVE ID: CVE-2016-5072 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.289Z Vendors: n/a Products: OXID eShop before 2016-06-13 Problem Types: RCE Description: OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12, Enterprise Edition v5.2.9, Professional Edition v4.8.12, Professional Edition v4.9.9, Community Edition v4.8.12, Community Edition v4.9.9. Additional Analyst Notes: - CVE Program Container: References: - https://oxidforge.org/en/security-bulletin-2016-001.html
CVE ID: CVE-2016-5073 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.268Z Vendors: n/a Products: CloudView NMS before 2.10a Problem Types: XSS Description: CloudView NMS before 2.10a has XSS via SNMP. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5074 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.263Z Vendors: n/a Products: CloudView NMS before 2.10a Problem Types: format string Description: CloudView NMS before 2.10a has a format string issue exploitable over SNMP. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98723 - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5075 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.275Z Vendors: n/a Products: CloudView NMS before 2.10a Problem Types: XSS Description: CloudView NMS before 2.10a has XSS via a TELNET login. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5076 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.285Z Vendors: n/a Products: CloudView NMS before 2.10a Problem Types: DOA Description: CloudView NMS before 2.10a allows remote attackers to obtain sensitive information via a direct request for admin/auto.def. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5077 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:46:40.341Z Vendors: n/a Products: Netikus EventSentry before 3.2.1.44 Problem Types: XSS Description: Netikus EventSentry before 3.2.1.44 has XSS via SNMP. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5078 State: PUBLISHED Published: 2017-04-10T03:00:00 Last Updated: 2024-08-06T00:53:47.120Z Vendors: n/a Products: Paessler PRTG before 16.2.24.4045 Problem Types: XSS Description: Paessler PRTG before 16.2.24.4045 has XSS via SNMP. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/09/07/multiple-disclosures-for-multiple-network-management-systems-part-2
CVE ID: CVE-2016-5080 State: PUBLISHED Published: 2016-07-19T22:00:00 Last Updated: 2024-08-06T00:53:47.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled by ASN1C, via crafted ASN.1 data. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2017-01-01.html - http://www.securityfocus.com/archive/1/538952/100/0/threaded - https://github.com/programa-
y/bulletin/2017-01-01.html - http://www.securityfocus.com/archive/1/538952/100/0/threaded - https://github.com/programa-stic/security-advisories/tree/master/ObjSys/CVE-2016-5080 - http://www.kb.cert.org/vuls/id/790839 - https://www.ncsc.nl/dienstverlening/response-op-dreigingen-en-incidenten/beveiligingsadviezen/NCSC-2016-0650+1.00+Kwetsbaarheid+verholpen+in+ASN1C.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://www.securitytracker.com/id/1036386 - http://packetstormsecurity.com/files/137970/Objective-Systems-Inc.-ASN1C-For-C-C-Heap-Memory-Corruption.html - http://seclists.org/fulldisclosure/2016/Jul/65 - http://www.securityfocus.com/bid/91836 - htt
p-Memory-Corruption.html - http://seclists.org/fulldisclosure/2016/Jul/65 - http://www.securityfocus.com/bid/91836 - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160721-asn1c
CVE ID: CVE-2016-5081 State: PUBLISHED Published: 2016-08-24T01:00:00 Last Updated: 2024-08-06T00:53:47.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92449 - http://www.kb.cert.org/vuls/id/301735
CVE ID: CVE-2016-5084 State: PUBLISHED Published: 2016-10-05T10:00:00 Last Updated: 2024-08-06T00:53:47.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump - http://www.kb.cert.org/vuls/id/BLUU-A9SQRS - https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01 - http://www.kb.cert.org/vuls/id/884840 - http://
/BLUU-A9SQRS - https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01 - http://www.kb.cert.org/vuls/id/884840 - http://www.securityfocus.com/bid/93351
CVE ID: CVE-2016-5085 State: PUBLISHED Published: 2016-10-05T10:00:00 Last Updated: 2024-08-06T00:53:47.380Z Vendors: n/a Products: n/a Problem Types: n/a Description: Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump - http://www.kb.cert.org/vuls/id/BLUU-A9SQRS - https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01 - http:
ulin-pump - http://www.kb.cert.org/vuls/id/BLUU-A9SQRS - https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01 - http://www.kb.cert.org/vuls/id/884840 - http://www.securityfocus.com/bid/93351
CVE ID: CVE-2016-5086 State: PUBLISHED Published: 2016-10-05T10:00:00 Last Updated: 2024-08-06T00:53:47.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks. Additional Analyst Notes: - CVE Program Container: References: - https://community.rapid7.com/community/infosec/blog/2016/10/04/r7-2016-07-multiple-vulnerabilities-in-animas-onetouch-ping-insulin-pump - http://www.kb.cert.org/vuls/id/BLUU-A9SQRS - https://ics-cert.us-cert.gov/advisories/ICSMA-16-279-01 - http://www.kb.cert.org/vuls/id/884840 - http://www.securityfocus.com/bid/93351
CVE ID: CVE-2016-5087 State: PUBLISHED Published: 2016-06-26T01:00:00 Last Updated: 2024-08-06T00:53:47.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Alertus Desktop Notification before 2.9.31.1710 on OS X uses weak permissions for configuration files and unspecified other files, which allows local users to suppress emergency notifications or change content via standard filesystem operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.kb.cert.org/vuls/id/BLUU-A9TJHR - http://www.kb.cert.org/vuls/id/302544
CVE ID: CVE-2016-5091 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T00:53:47.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action. Additional Analyst Notes: - CVE Program Container: References: - https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/ - http://www.openwall.com/lists/oss-security/2016/05/25/4 - http://www.openwall.com/lists/oss-security/2016/05/26/2
CVE ID: CVE-2016-5092 State: PUBLISHED Published: 2016-07-13T15:00:00 Last Updated: 2024-08-06T00:53:47.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging the autolearn feature. Additional Analyst Notes: - CVE Program Container: References: - http://fortiguard.com/advisory/fortiweb-path-traversal-vulnerability
CVE ID: CVE-2016-5093 State: PUBLISHED Published: 2016-08-07T10:00:00 Last Updated: 2024-08-06T00:53:47.291Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/php/php-src/commit/97eff7eb57fc2320c267a949cffd622c38712484?w=1 - http://www.openwall.com/li
ences: - https://github.com/php/php-src/commit/97eff7eb57fc2320c267a949cffd622c38712484?w=1 - http://www.openwall.com/lists/oss-security/2016/05/26/3 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - https://bugs.php.net/bug.php?id=72241 - http://www.debian.org/security/2016/dsa-3602 - http://php.net/ChangeLog-5.php - http://php.net/ChangeLog-7.php - http://www.securityfocus.com/bid/90946 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731
CVE ID: CVE-2016-5094 State: PUBLISHED Published: 2016-08-07T10:00:00 Last Updated: 2024-08-06T00:53:47.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/90857 - http://www.openwall.com/lists/oss-security/2016/05/26/3 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://www.debian.org/security/
com/lists/oss-security/2016/05/26/3 - http://rhn.redhat.com/errata/RHSA-2016-2750.html - http://www.debian.org/security/2016/dsa-3602 - https://github.com/php/php-src/commit/0da8b8b801f9276359262f1ef8274c7812d3dfda?w=1 - http://php.net/ChangeLog-5.php - https://bugs.php.net/bug.php?id=72135 - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731