Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-9118 State: PUBLISHED Published: 2016-10-30T22:00:00 Last Updated: 2024-08-06T02:42:10.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201710-26 - https://github.com/uclouvain/openjpeg/issues/861 - http://www.debian.org/security/2017/dsa-4013 - http://www.securityfocus.com/bid/93976
CVE ID: CVE-2016-9119 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-06T02:42:10.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://moinmo.in/SecurityFixes - http://www.securityfocus.com/bid/94501 - http://www.ubuntu.com/usn/USN-3137-1 - http://www.debian.org/security/2016/dsa-3715
CVE ID: CVE-2016-9120 State: PUBLISHED Published: 2016-12-08T21:00:00 Last Updated: 2024-08-06T02:42:10.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 - http://www.security
l.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 - http://www.securityfocus.com/bid/94669 - http://source.android.com/security/bulletin/2016-12-01.html
CVE ID: CVE-2016-9121 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.399Z Vendors: n/a Products: Go JOSE All versions before 1.0.4 Problem Types: Cryptographic Issue Description: go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507
CVE Program Container: References: - https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507 - https://hackerone.com/reports/164590 - http://www.openwall.com/lists/oss-security/2016/11/03/1
CVE ID: CVE-2016-9122 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.637Z Vendors: n/a Products: Go JOSE All versions before 1.0.4 Problem Types: Cryptographic Issue Description: go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated. Additional Analyst Notes: - CVE Program Container: Refer
signature that was different from the one originally validated. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/169629 - https://github.com/square/go-jose/commit/2c5656adca9909843c4ff50acf1d2cf8f32da7e6 - http://www.openwall.com/lists/oss-security/2016/11/03/1
CVE ID: CVE-2016-9123 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.771Z Vendors: n/a Products: Go JOSE All versions before 1.0.5 Problem Types: Memory Corruption Description: go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/square/go-jose/commit/789a4c4bd4c118f7564954f441b29c153ccd6a96 - http://www.openwall.com/lists/oss-security/2016/11/03/1 - https://hackerone.com/reports/165170
CVE ID: CVE-2016-9124 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.831Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-307 Description: Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effec
measure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/96115 - https://www.revive-adserver.com/security/revive-sa-2016-001/ - https://github.com/revive-adserver/revive-adserver/commit/847941390f5b3310d51b07c92ec91cc1f4cc82c9
CVE ID: CVE-2016-9125 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.467Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-384 Description: Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2016-001/ - https://hackerone.com/reports/93813
ainer: References: - https://www.revive-adserver.com/security/revive-sa-2016-001/ - https://hackerone.com/reports/93813 - https://hackerone.com/reports/93809 - https://github.com/revive-adserver/revive-adserver/commit/4910365631eabbb208961c36149f41cc8159fb39
CVE ID: CVE-2016-9126 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.468Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-79 Description: Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449
Container: References: - https://github.com/revive-adserver/revive-adserver/commit/8d8c6df309ff5fde9dd4770abcd4ec5d2449b3ec - https://www.revive-adserver.com/security/revive-sa-2016-001/ - https://hackerone.com/reports/97073
CVE ID: CVE-2016-9127 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.914Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-352 Description: Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-
Both issues have been fixed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/revive-adserver/revive-adserver/commit/3aaebcc765797d2c684e031f2836e0a69d6b7bc2 - https://hackerone.com/reports/99452 - https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE ID: CVE-2016-9128 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.588Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-79 Description: Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/99004 - https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e282
://hackerone.com/reports/99004 - https://github.com/revive-adserver/revive-adserver/commit/a323fd626627e8d42819fd5b7e2829196b5c54a3 - https://github.com/revive-adserver/revive-adserver/commit/e17a7ec3412ded751cda50b82338de471d656d74 - https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE ID: CVE-2016-9129 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.602Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-203 Description: Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/98612 -
uires a username. Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/98612 - https://github.com/revive-adserver/revive-adserver/commit/38223a841190bebd7a137c7bed84fbbcb2b0c2a5 - https://www.revive-adserver.com/security/revive-sa-2016-001/
CVE ID: CVE-2016-9130 State: PUBLISHED Published: 2017-03-28T02:46:00 Last Updated: 2024-08-06T02:42:10.521Z Vendors: n/a Products: Revive Adserver All versions before 3.2.3 Problem Types: CWE-79 Description: Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script. Additional Analyst Notes: - CVE Program Container: References: - https://www.revive-adserver.com/security/revive-sa-2016-001/ - https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1
urity/revive-sa-2016-001/ - https://github.com/revive-adserver/revive-adserver/commit/f6880330a8e11e804663f132867e9eb9b1f94e83
CVE ID: CVE-2016-9131 State: PUBLISHED Published: 2017-01-12T06:06:00 Last Updated: 2024-08-06T02:42:10.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037582 - https://security.gentoo.org/glsa/201708-01 - https://kb.isc.org/article/AA-01439/74/CVE-2016-9131 - http://www.securityfocus.com/bid/95386 - https://security.netapp.com/advisory/ntap-20180926-00
-01439/74/CVE-2016-9131 - http://www.securityfocus.com/bid/95386 - https://security.netapp.com/advisory/ntap-20180926-0005/ - http://www.debian.org/security/2017/dsa-3758 - https://access.redhat.com/errata/RHSA-2017:1583 - http://rhn.redhat.com/errata/RHSA-2017-0062.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05381687
CVE ID: CVE-2016-9132 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-06T02:42:10.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/ - https://github.com/randombit/botan/
ckage-announce%40lists.fedoraproject.org/message/Z2Y3JLMTE3VIV4X5X6SXVZTJBDDLCS3D/ - https://github.com/randombit/botan/commit/987ad747db6d0d7e36f840398f3cf02e2fbfd90f - http://www.securityfocus.com/bid/95879 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OUDGVRQYQUL7F5MRP3LAV7EHRJG4BBE/
CVE ID: CVE-2016-9134 State: PUBLISHED Published: 2016-11-03T10:00:00 Last Updated: 2024-08-06T02:42:10.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/commit/d5c3c175b60bd26b2b74ec85b8f0d2544db2c8db - http://www.securityfocus.com/bid/94127 - https://github.com/exponentcms/exponent-cms/commit/45a7a62797e64e8abbae35d4859097c26f1874b1
CVE ID: CVE-2016-9135 State: PUBLISHED Published: 2016-11-03T10:00:00 Last Updated: 2024-08-06T02:42:10.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/exponentcms/exponent-cms/commit/d5c3c175b60bd26b2b74ec85b8f0d2544db2c8db - http://www.securityfocus.com/bid/94127
CVE ID: CVE-2016-9136 State: PUBLISHED Published: 2016-11-03T10:00:00 Last Updated: 2024-08-06T02:42:10.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83acfa950ec8a8a89 allows context-dependent attackers to obtain sensitive information by using the "crafted JavaScript" approach, related to a "Buffer Over-read" issue. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.ghostscript.com/show_bug.cgi?id=697244 - http://www.securityfocus.com/bid/94223
CVE ID: CVE-2016-9137 State: PUBLISHED Published: 2017-01-04T20:00:00 Last Updated: 2024-08-06T02:42:10.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=73147 - http://www.php.net/ChangeLog-7.php - http://www.php.net/ChangeLog-5.php - https://www.tenable.com/security/tns-2016-19 - http://ww
.php.net/ChangeLog-7.php - http://www.php.net/ChangeLog-5.php - https://www.tenable.com/security/tns-2016-19 - http://www.securityfocus.com/bid/93577 - http://www.openwall.com/lists/oss-security/2016/11/01/2 - http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=0e6fe3a4c96be2d3e88389a5776f878021b4c59f - http://www.debian.org/security/2016/dsa-3698
CVE ID: CVE-2016-9138 State: PUBLISHED Published: 2017-01-04T20:00:00 Last Updated: 2024-08-06T02:42:10.493Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=73147 - http://www.openwall.com/lists/oss-security/2016/11/01/2 - http://www.securityfocus.com/bid/95268
CVE ID: CVE-2016-9139 State: PUBLISHED Published: 2017-02-16T18:00:00 Last Updated: 2024-08-06T02:42:10.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94141 - https://www.otrs.com/security-advisory-2016-02-security-update-otrs/
CVE ID: CVE-2016-9140 State: REJECTED Published: 2018-08-15T18:00:00 Last Updated: 2018-08-15T17:57:01 Description: No description available.
CVE ID: CVE-2016-9141 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9142 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9143 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9144 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9145 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9147 State: PUBLISHED Published: 2017-01-12T06:06:00 Last Updated: 2024-08-06T02:42:11.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037582 - https://security.gentoo.org/glsa/201708-01 - https://kb.isc.org/article/AA-01440/74/CVE-2016-9147 - https://security.netapp.com/advisory/ntap-20180926-0005/ - https://access.redhat.com/errata/RHS
01440/74/CVE-2016-9147 - https://security.netapp.com/advisory/ntap-20180926-0005/ - https://access.redhat.com/errata/RHSA-2017:1582 - http://www.debian.org/security/2017/dsa-3758 - https://access.redhat.com/errata/RHSA-2017:1583 - http://www.securityfocus.com/bid/95390 - http://rhn.redhat.com/errata/RHSA-2017-0064.html - http://rhn.redhat.com/errata/RHSA-2017-0063.html - http://rhn.redhat.com/errata/RHSA-2017-0062.html
CVE ID: CVE-2016-9148 State: PUBLISHED Published: 2017-03-07T15:00:00 Last Updated: 2024-08-06T02:42:11.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94258 - http://www.securitytracker.com/id/1037262 - http://packetstormsecurity.com/files/139660/CA-Service-Desk-Manaager-12.9-14.1-Code-Execution.html - http://seclists.org/fulldisclosure/2016/Nov/53 - http://www.ca.com/us/servi
esk-Manaager-12.9-14.1-Code-Execution.html - http://seclists.org/fulldisclosure/2016/Nov/53 - http://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-02-security-notice-for-ca-service-desk-manager.html
CVE ID: CVE-2016-9149 State: PUBLISHED Published: 2016-11-19T06:29:00 Last Updated: 2024-08-06T02:42:10.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037379 - http://www.securityfocus.com/bid/94401 - https://security.paloaltonetworks.com/CVE-2016-9149
CVE ID: CVE-2016-9150 State: PUBLISHED Published: 2016-11-19T06:29:00 Last Updated: 2024-08-06T02:42:10.932Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037382 - https://www.exploit-db.com/exploits/40790/ - http://www.securityfocus.com/bid/94399 - https://security.paloaltonetworks.com/CVE-2016-9150
CVE ID: CVE-2016-9151 State: PUBLISHED Published: 2016-11-19T06:29:00 Last Updated: 2024-08-06T02:42:11.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/40789/ - https://www.exploit-db.com/exploits/40788/ - http://www.securityfocus.com/bid/94400 - http://www.securitytracker.com/id/1037381 - https://security.paloaltonetworks.com/CVE-2016-91
urityfocus.com/bid/94400 - http://www.securitytracker.com/id/1037381 - https://security.paloaltonetworks.com/CVE-2016-9151
CVE ID: CVE-2016-9152 State: PUBLISHED Published: 2016-12-05T18:00:00 Last Updated: 2024-08-06T02:42:11.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94658 - http://www.securitytracker.com/id/1037392 - https://core.spip.net/projects/spip/repository/revisions/23290
CVE ID: CVE-2016-9154 State: PUBLISHED Published: 2016-12-23T05:00:00 Last Updated: 2024-08-06T02:42:11.004Z Vendors: n/a Products: Desigo PX Web modules with all firmware versions < V6.00.046 Problem Types: CWE-332 Description: Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to
number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf - http://www.securityfocus.com/bid/94962 - https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01