Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sing system resources without permission from the legitimate administrator of the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/snapcore/snapweb/commit/3f4cf9403f7687fbc8e27c0e01b2cf6aa5e7e0d5
CVE ID: CVE-2016-1588 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-1589 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-1590 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-1591 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-1592 State: PUBLISHED Published: 2016-10-27T20:00:00 Last Updated: 2024-08-05T23:02:11.763Z Vendors: n/a Products: NetIQ Designer for Identity Manager before 4.5.3 Problem Types: unspecified Description: XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93973 - https://download.novell.com/Download?buildid=QgHXVOxv310~
CVE ID: CVE-2016-1593 State: PUBLISHED Published: 2016-04-22T10:00:00 Last Updated: 2024-08-05T23:02:12.067Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a LiveTime.woa URL. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityfocus.com/archi
sories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityfocus.com/archive/1/538043/100/0/threaded - https://www.novell.com/support/kb/doc.php?id=7017428 - https://www.exploit-db.com/exploits/39708/ - http://www.rapid7.com/db/modules/exploit/multi/http/novell_servicedesk_rce - https://www.exploit-db.com/exploits/39687/ - http://packetstormsecurity.com/files/136717/Novell-ServiceDesk-Authenticated-File-Upload.html
CVE ID: CVE-2016-1594 State: PUBLISHED Published: 2016-04-22T10:00:00 Last Updated: 2024-08-05T23:02:11.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7017429 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityf
oC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityfocus.com/archive/1/538043/100/0/threaded - https://www.exploit-db.com/exploits/39687/
CVE ID: CVE-2016-1595 State: PUBLISHED Published: 2016-04-22T10:00:00 Last Updated: 2024-08-05T23:02:12.178Z Vendors: n/a Products: n/a Problem Types: n/a Description: LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language (HQL) injection attacks and obtain sensitive information via the entityName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7017430 - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - htt
tent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityfocus.com/archive/1/538043/100/0/threaded - https://www.exploit-db.com/exploits/39687/
CVE ID: CVE-2016-1596 State: PUBLISHED Published: 2016-04-22T10:00:00 Last Updated: 2024-08-05T23:02:12.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain (1) user name, (2) tf_aClientFirstName, (3) tf_aClientLastName, (4) ta_selectedTopicContent, (5) tf_orgUnitName, (6) tf_aManufacturerFullName, (7) tf_aManufacturerName, (8) tf_aManufacturerAddress, or (9) tf_aManufacturerCity parameter. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/pedrib/PoC/m
rameter. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt - https://packetstormsecurity.com/files/136646 - http://www.securityfocus.com/archive/1/538043/100/0/threaded - https://www.exploit-db.com/exploits/39687/ - https://www.novell.com/support/kb/doc.php?id=7017431
CVE ID: CVE-2016-1597 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-05T23:02:11.697Z Vendors: n/a Products: Access Governance Suite Problem Types: escalate privileges Description: A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.novell.com/support/kb/doc.php?id=7017302
CVE ID: CVE-2016-1598 State: PUBLISHED Published: 2016-10-27T20:00:00 Last Updated: 2024-08-05T23:02:11.722Z Vendors: n/a Products: NetIQ IDM 4.5 Identity Applications before 4.5.4 Problem Types: unspecified Description: XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93833 - https://download.novell.com/Download?buildid=xyswDCMsT7I~
CVE ID: CVE-2016-1599 State: PUBLISHED Published: 2016-03-24T01:00:00 Last Updated: 2024-08-05T23:02:11.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96837 - https://www.netiq.com/support/kb/doc.php?id=7017399 - https://bugzilla.netiq.com/show_bug.cgi?id=967461
CVE ID: CVE-2016-1600 State: PUBLISHED Published: 2019-05-09T20:33:45 Last Updated: 2024-08-05T23:02:11.758Z Vendors: NetIQ Products: Identity Manager Problem Types: Information disclosure Description: The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/documentation/identity-manager-46/releasenotes_idm46/data/releasenotes_idm46.html#t433o7au0niu
CVE ID: CVE-2016-1601 State: PUBLISHED Published: 2016-04-26T14:00:00 Last Updated: 2024-08-05T23:02:12.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=974220 - http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2
s.opensuse.org/opensuse-security-announce/2016-05/msg00007.html - http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00051.html - https://build.opensuse.org/request/show/388020
CVE ID: CVE-2016-1602 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-05T23:02:12.144Z Vendors: n/a Products: supportconfig Problem Types: code injection Description: A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root). Additional Analyst Notes: - CVE Program Container: References: - http://lists.suse.com/pipermail/sle-security-updates/2016-June/002096.html
CVE ID: CVE-2016-1603 State: PUBLISHED Published: 2017-03-23T06:36:00 Last Updated: 2024-08-05T23:02:12.327Z Vendors: n/a Products: NetIQ IDM ServiceNow Problem Types: expose cryptographic attributes Description: An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users. Additional Analyst Notes: - CVE Program Container: References: - https://download.novell.com/Download?buildid=oZ2bTUJ5Nxs~
CVE ID: CVE-2016-1605 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the ReportViewServlet servlet in the server in NetIQ Sentinel 7.4.x before 7.4.2 allows remote attackers to read arbitrary files via a PREVIEW value for the fileType field. Additional Analyst Notes: - CVE Program Container: References: - https://www.netiq.com/support/kb/doc.php?id=7017803 - http://www.zerodayinitiative.com/advisories/ZDI-16-406
CVE ID: CVE-2016-1606 State: PUBLISHED Published: 2016-07-03T01:00:00 Last Updated: 2024-08-05T23:02:12.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrary code via (1) the NetworkName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (2) the CPName property value to ObjectXSNAConfig.ObjectXSNAConfig in iconfig.dll, (3) the PrinterName property value to ProfileEditor.PrintPasteControl in ProfEdit.dll, (4) the Data argument to the WriteRecords function in FTXBIFFLib.AS400FtxBIFF in FtxBIFF.dll, (5) the Serialized property
4) the Data argument to the WriteRecords function in FTXBIFFLib.AS400FtxBIFF in FtxBIFF.dll, (5) the Serialized property value to NMSECCOMPARAMSLib.SSL3 in NMSecComParams.dll, (6) the UserName property value to NMSECCOMPARAMSLib.FirewallProxy in NMSecComParams.dll, (7) the LUName property value to ProfileEditor.MFSNAControl in ProfEdit.dll, (8) the newVal argument to the Load function in FTPSFTPLib.SFtpSession in FTPSFtp.dll, or (9) a long Host field in the FTP Client. Additional Analyst Notes: - CVE Program Container: References: - https://cxsecurity.com/issue/WLB-2016050136 - http://www.securityfocus.com/bid/91548 - http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/kno
36 - http://www.securityfocus.com/bid/91548 - http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28601.rumba-9-4-stack-buffer-overflow-vulnerabilities.aspx - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php
CVE ID: CVE-2016-1607 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2016/Jul/119 - https://download.novell.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://www.novell.com/support/kb/doc
l.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://www.novell.com/support/kb/doc.php?id=7017786 - http://www.securityfocus.com/bid/92113
CVE ID: CVE-2016-1608 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2016/Jul/119 - https://download.novell.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://download.novell.com/Download?buildid=BOTiHcBFfv0~ - https://www.novell.com/support/kb/doc.php?id=701778
40161/ - https://download.novell.com/Download?buildid=BOTiHcBFfv0~ - https://www.novell.com/support/kb/doc.php?id=7017789 - http://www.securityfocus.com/bid/92113
CVE ID: CVE-2016-1609 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of a user profile. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2016/Jul/119 - https://download.novell.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - http
/Jul/119 - https://download.novell.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://download.novell.com/Download?buildid=BOTiHcBFfv0~ - https://www.novell.com/support/kb/doc.php?id=7017787 - http://www.securityfocus.com/bid/92113
CVE ID: CVE-2016-1610 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2016/Jul/119 - https://download.novell.com/Download?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://www.novell.com/support/kb/doc.php?id=701778
?buildid=3V-3ArYN85I~ - https://www.exploit-db.com/exploits/40161/ - https://www.novell.com/support/kb/doc.php?id=7017788 - https://download.novell.com/Download?buildid=BOTiHcBFfv0~ - http://www.securityfocus.com/bid/92113
CVE ID: CVE-2016-1611 State: PUBLISHED Published: 2016-08-01T01:00:00 Last Updated: 2024-08-05T23:02:12.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain privileges by replacing this file's content with arbitrary shell commands. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/bugtraq/2016/Jul/119 - https://www.novell.com/support/kb/doc.php?id=7017689 - https://www.exploit-db.com/exploits/40161/ - http://www.securityfocus.com/bid/92113
CVE ID: CVE-2016-1612 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before performing a cast of an unspecified variable, which allows remote attackers to cause a denial of service or possibly have unknown other impact via crafted JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-0072.html - http://www.ubuntu.com/usn/USN-2877-1 - http://googlechromereleases.blogspot.com/2016/01/stab
rrata/RHSA-2016-0072.html - http://www.ubuntu.com/usn/USN-2877-1 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - https://codereview.chromium.org/1531583005 - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://code.google.com/p/chromium/issues/detail?id=497632 - https://security.gentoo.org/glsa/201603-09 - https://chromium.googlesource.com/v8/v8/+/cfbd16172fa165cc33ce0e2e72f74e5561168a61 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://www.securityfocus.com/bid/81431 - http://lists.opensuse.org/open
- http://www.debian.org/security/2016/dsa-3456 - http://www.securityfocus.com/bid/81431 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE ID: CVE-2016-1613 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to improper tracking of the destruction of (1) IPWL_FocusHandler and (2) IPWL_Provider objects. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - http://rhn.redhat.com/errata/RHSA-2016-0072.html - https://pdfium.goog
ences: - http://www.securityfocus.com/bid/81430 - http://rhn.redhat.com/errata/RHSA-2016-0072.html - https://pdfium.googlesource.com/pdfium/+/dcac57bc8b64fdc870d79d11a498ae7021cf8ae7 - https://code.google.com/p/chromium/issues/detail?id=572871 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://codereview.chromium.org/1564773003 - https://security.gentoo.org/glsa/201603-09 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-sec
y-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE ID: CVE-2016-1614 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0.2564.82, mishandles the initialization mode, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - https://codereview.chromium.org/1407393002/ - http://rhn.redhat.com/errata/RHSA-2016-0072.html - http://www.ubuntu.
30 - https://codereview.chromium.org/1407393002/ - http://rhn.redhat.com/errata/RHSA-2016-0072.html - http://www.ubuntu.com/usn/USN-2877-1 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - https://code.google.com/p/chromium/issues/detail?id=544691 - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://security.gentoo.org/glsa/201603-09 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE ID: CVE-2016-1615 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof a document's origin via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - http://rhn.redhat.com/errata/RHSA-2016-0072.html - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://code.google.com/p/chrom
d/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://code.google.com/p/chromium/issues/detail?id=468179 - https://security.gentoo.org/glsa/201603-09 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE ID: CVE-2016-1616 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.440Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoof URLs via vectors involving an unfocused custom button. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - http://rhn.redhat.com/errata/RHSA-2016-0072.html - https://codereview.chromium.org/1437523005 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - https://code.google.com/p/chromiu
005 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - https://code.google.com/p/chromium/issues/detail?id=541415 - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://security.gentoo.org/glsa/201603-09 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html
CVE ID: CVE-2016-1617 State: PUBLISHED Published: 2016-01-25T11:00:00 Last Updated: 2024-08-05T23:02:12.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - http://rhn.redha
ditional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/81430 - http://rhn.redhat.com/errata/RHSA-2016-0072.html - https://codereview.chromium.org/1455973003 - http://www.ubuntu.com/usn/USN-2877-1 - http://googlechromereleases.blogspot.com/2016/01/stable-channel-update_20.html - http://www.securitytracker.com/id/1034801 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00035.html - https://security.gentoo.org/glsa/201603-09 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00046.html - http://www.debian.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html - https://code.
.org/security/2016/dsa-3456 - http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00036.html - https://code.google.com/p/chromium/issues/detail?id=544765