Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-9861 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T02:59:03.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94535 - https://www.phpmyadmin.net/security/PMASA-2016-66 - https://security.gentoo.org/glsa/201701-32 - https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
CVE ID: CVE-2016-9862 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T02:59:03.525Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94528 - https://www.phpmyadmin.net/security/PMASA-2016-67 - https://security.gentoo.org/glsa/201701-32
CVE ID: CVE-2016-9863 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T02:59:03.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94526 - https://www.phpmyadmin.net/security/PMASA-2016-68 - https://security.gentoo.org/glsa/201701-32
CVE ID: CVE-2016-9864 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T02:59:03.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. Addition
ons (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpmyadmin.net/security/PMASA-2016-69 - https://security.gentoo.org/glsa/201701-32 - http://www.securityfocus.com/bid/94533 - https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
CVE ID: CVE-2016-9865 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T02:59:03.621Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html - https://www.phpmyadmin.net/security/PMASA-2016-70 - http://www.securityfocus.com/bid/94531 - https://secu
sg00006.html - https://www.phpmyadmin.net/security/PMASA-2016-70 - http://www.securityfocus.com/bid/94531 - https://security.gentoo.org/glsa/201701-32
CVE ID: CVE-2016-9866 State: PUBLISHED Published: 2016-12-11T02:00:00 Last Updated: 2024-08-06T03:07:30.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94536 - https://www.phpmyadmin.net/security/PMASA-2016-71 - https://security.gentoo.org/glsa/201701-32
CVE ID: CVE-2016-9867 State: PUBLISHED Published: 2017-01-06T22:00:00 Last Updated: 2024-08-06T03:07:30.158Z Vendors: n/a Products: EMC ScaleIO versions before 2.0.1.1 Problem Types: Privilege escalation vulnerability Description: An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95300 - http://www.securityfocus.com/archive/1/539983/30/0/threaded
CVE ID: CVE-2016-9868 State: PUBLISHED Published: 2017-01-06T22:00:00 Last Updated: 2024-08-06T03:07:30.164Z Vendors: n/a Products: EMC ScaleIO versions before 2.0.1.1 Problem Types: Denial-of-service vulnerability via IOCTL calls Description: An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may cause a denial-of-service by generating a kernel panic in the SCINI driver using IOCTL calls which may render the ScaleIO Data Client (SDC) server unavailable until the next reboot. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95301 - http://www.securityfocus.com/archive/1/539983/30/0/threaded
CVE ID: CVE-2016-9869 State: PUBLISHED Published: 2017-01-06T22:00:00 Last Updated: 2024-08-06T03:07:30.831Z Vendors: n/a Products: EMC ScaleIO versions before 2.0.1.1 Problem Types: Denial-of-service through configuration API Description: An issue was discovered in EMC ScaleIO versions before 2.0.1.1. Incorrect permissions on the SCINI driver may allow a low-privileged local attacker to modify the configuration and render the ScaleIO Data Client (SDC) server unavailable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95303 - http://www.securityfocus.com/archive/1/539983/30/0/threaded
CVE ID: CVE-2016-9870 State: PUBLISHED Published: 2017-01-23T06:49:00 Last Updated: 2024-08-06T03:07:30.140Z Vendors: n/a Products: EMC Isilon OneFS Problem Types: LDAP Injection Description: EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by a malicious user to compromise the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/540020/30/0/threaded - http://www.securityfocus.com/bid/95626
CVE ID: CVE-2016-9871 State: PUBLISHED Published: 2017-02-03T07:24:00 Last Updated: 2024-08-06T03:07:30.796Z Vendors: n/a Products: EMC Isilon OneFS EMC Isilon OneFS 7.2.1.0 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x Problem Types: Privilege Escalation Vulnerability Description: EMC Isilon OneFS 7.2.1.0 - 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x is affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95800 -
ected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95800 - http://www.securityfocus.com/archive/1/540050/30/0/threaded
CVE ID: CVE-2016-9872 State: PUBLISHED Published: 2017-02-03T07:24:00 Last Updated: 2024-08-06T03:07:30.181Z Vendors: n/a Products: EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 Problem Types: Reflected Cross-Site Scripting Description: EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/540060/30/0/threaded - http://www.securitytracker.com/id/1037733 - http://www.securityfocus.com/bid/95824
CVE ID: CVE-2016-9873 State: PUBLISHED Published: 2017-02-03T07:24:00 Last Updated: 2024-08-06T03:07:30.174Z Vendors: n/a Products: EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 Problem Types: DQL Injection Vulnerability Description: EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information, modify data or disrupt services by causing execution of arbitrary DQL commands on the application. Additional Analyst Notes: - CVE Pr
r disrupt services by causing execution of arbitrary DQL commands on the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95828 - http://www.securityfocus.com/archive/1/540060/30/0/threaded - http://www.securitytracker.com/id/1037733
CVE ID: CVE-2016-9874 State: REJECTED Published: 2017-01-06T21:00:00 Last Updated: 2017-01-06T20:57:01 Description: No description available.
CVE ID: CVE-2016-9875 State: REJECTED Published: 2017-01-06T21:00:00 Last Updated: 2017-01-06T20:57:01 Description: No description available.
CVE ID: CVE-2016-9876 State: REJECTED Published: 2017-01-06T21:00:00 Last Updated: 2017-01-06T20:57:01 Description: No description available.
CVE ID: CVE-2016-9877 State: PUBLISHED Published: 2016-12-29T09:02:00 Last Updated: 2024-08-06T03:07:30.822Z Vendors: n/a Products: Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 Problem Types: RabbitMQ authentication vulnerability Description: An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Conn
password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03880en_us - http://www.securityfocus.com/bid/95065 - https://pivotal.io/security/cve-2016-9877 - http://www.debian.org/security/2017/dsa-3761
CVE ID: CVE-2016-9878 State: PUBLISHED Published: 2016-12-29T09:02:00 Last Updated: 2024-08-06T03:07:30.827Z Vendors: n/a Products: Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5 Problem Types: Directory Traversal Description: An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040698 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle
tracker.com/id/1040698 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://security.netapp.com/advisory/ntap-20180419-0002/ - https://pivotal.io/security/cve-2016-9878 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://www.securityfocus.com/bid/95072 - https://access.redhat.com/errata/RHSA-2017:3115 - https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2016-9879 State: PUBLISHED Published: 2017-01-06T22:00:00 Last Updated: 2024-08-06T03:07:30.183Z Vendors: n/a Products: Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1 Problem Types: Encoded "/" in path variables Description: An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servl
ity constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletP
provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1832 - http://www.securityfocus.com/bid/95142 - https://pivotal.io/security/cve-2016-9879
CVE ID: CVE-2016-9880 State: PUBLISHED Published: 2018-03-16T20:00:00Z Last Updated: 2024-09-16T19:31:47.833Z Vendors: Dell EMC Products: GemFire broker for Cloud Foundry Problem Types: Unauthenticated access Description: The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2016-9880 - http://www.securityfocus.com/bid/96146
CVE ID: CVE-2016-9881 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9882 State: PUBLISHED Published: 2017-01-13T09:00:00 Last Updated: 2024-08-06T03:07:30.857Z Vendors: n/a Products: Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0 Problem Types: Logs Service Credentials Description: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log aggregator via syslog. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid
aggregator via syslog. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95441 - https://www.cloudfoundry.org/cve-2016-9882/
CVE ID: CVE-2016-9883 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9884 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9885 State: PUBLISHED Published: 2017-01-06T22:00:00 Last Updated: 2024-08-06T03:07:30.811Z Vendors: n/a Products: GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1 Problem Types: gfsh exposed over go router for GemFire for PCF Description: An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker co
ons are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker could run any command available on gfsh and could cause denial of service, lost confidentiality of data, escalate privileges, or eavesdrop on other communications between the gorouter and the cluster. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95270 - https://pivotal.io/security/cve-2016-9885
CVE ID: CVE-2016-9886 State: REJECTED Published: 2017-01-06T21:00:00 Last Updated: 2017-01-06T20:57:01 Description: No description available.
CVE ID: CVE-2016-9888 State: PUBLISHED Published: 2016-12-08T08:08:00 Last Updated: 2024-08-06T03:07:31.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file. Additional Analyst Notes: - CVE Program Container: References: - https://secunia.com/advisories/71201/ - https://secunia.com/secunia_research/2016-17/ - http://www.securityfocus.com/bid/94860 - https://github.com/GNOME/libgsf/commit/95a8351a75758cf10b3bf6abae0b6b461f90d9e5 - https://lists.debian.or
om/bid/94860 - https://github.com/GNOME/libgsf/commit/95a8351a75758cf10b3bf6abae0b6b461f90d9e5 - https://lists.debian.org/debian-lts-announce/2020/04/msg00016.html
CVE ID: CVE-2016-9889 State: PUBLISHED Published: 2016-12-23T05:00:00 Last Updated: 2024-08-06T03:07:30.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95083 - http://www.securitytracker.com/id/1037531 - https://tiki.org/article443-Security-update-Tiki-16-1-Tiki-15-3-and-Tiki-12-10-released
CVE ID: CVE-2016-9891 State: PUBLISHED Published: 2016-12-29T18:00:00 Last Updated: 2024-08-06T03:07:32.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title). Additional Analyst Notes: - CVE Program Container: References: - https://dev.dotclear.org/2.0/ticket/2224 - http://www.securityfocus.com/bid/95156 - https://hg.dotclear.org/dotclear/rev/712559193a6e - https://dev.dotclear.org/2.0/changeset/5536ac77e915 - https://dotclear.org/blog/p
tclear.org/dotclear/rev/712559193a6e - https://dev.dotclear.org/2.0/changeset/5536ac77e915 - https://dotclear.org/blog/post/2016/12/28/Dotclear-2.11 - https://smarterbitbybit.com/cve-2016-9891-dotclear-xss-vulnerability-in-version-2-10-4/
CVE ID: CVE-2016-9892 State: PUBLISHED Published: 2017-03-02T23:00:00 Last Updated: 2024-08-06T03:07:30.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate. NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root. Additional Analyst Notes: - CVE Program Container: References: - http://supp
to execute arbitrary code remotely as root. Additional Analyst Notes: - CVE Program Container: References: - http://support.eset.com/ca6333/ - http://seclists.org/fulldisclosure/2017/Feb/68 - http://www.securityfocus.com/bid/96462 - http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html
CVE ID: CVE-2016-9893 State: PUBLISHED Published: 2018-06-11T21:00:00 Last Updated: 2024-08-06T03:07:30.912Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Memory safety bugs fixed in Thunderbird 45.6 Description: Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2016-94/ - https://www.mozilla.org/security/adv
Container: References: - https://www.mozilla.org/security/advisories/mfsa2016-94/ - https://www.mozilla.org/security/advisories/mfsa2016-95/ - https://bugzilla.mozilla.org/buglist.cgi?bug_id=1319524%2C1298773%2C1299098%2C1309834%2C1312609%2C1313212%2C1317805%2C1312548%2C1315631%2C1287912 - http://www.securityfocus.com/bid/94885 - http://www.securitytracker.com/id/1037461 - https://security.gentoo.org/glsa/201701-15 - https://www.debian.org/security/2017/dsa-3757 - http://rhn.redhat.com/errata/RHSA-2016-2973.html - https://www.mozilla.org/security/advisories/mfsa2016-96/ - http://rhn.redhat.com/errata/RHSA-2016-2946.html
CVE ID: CVE-2016-9894 State: PUBLISHED Published: 2018-06-11T21:00:00 Last Updated: 2024-08-06T03:07:30.900Z Vendors: Mozilla Products: Firefox Problem Types: Buffer overflow in SkiaGL Description: A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2016-94/ - http://www.securityfocus.com/bid/94883 - http://www.securitytracker.com/id/1037461 - https://bugzilla.mozilla.org/show_bug.cgi?id=1306628
CVE ID: CVE-2016-9895 State: PUBLISHED Published: 2018-06-11T21:00:00 Last Updated: 2024-08-06T03:07:31.051Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: CSP bypass using marquee tag Description: Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.mozilla.org/security/advisories/mfsa2016-94/ - https://www.mozilla.org/security/advisories/mfsa2016-95/ - http://www.securityfocus.com/bid/94885 - http://www.securitytracker.co
ww.mozilla.org/security/advisories/mfsa2016-95/ - http://www.securityfocus.com/bid/94885 - http://www.securitytracker.com/id/1037461 - https://security.gentoo.org/glsa/201701-15 - https://www.debian.org/security/2017/dsa-3757 - https://bugzilla.mozilla.org/show_bug.cgi?id=1312272 - http://rhn.redhat.com/errata/RHSA-2016-2973.html - https://www.mozilla.org/security/advisories/mfsa2016-96/ - http://rhn.redhat.com/errata/RHSA-2016-2946.html