Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-1561 State: PUBLISHED Published: 2017-04-21T20:00:00 Last Updated: 2024-08-05T23:02:12.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/136634/ExaGrid-Known-SSH-Key-Default-Password.html - https://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credenti
tps://community.rapid7.com/community/infosec/blog/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials - http://www.rapid7.com/db/modules/exploit/linux/ssh/exagrid_known_privkey
CVE ID: CVE-2016-1562 State: PUBLISHED Published: 2016-03-12T02:00:00 Last Updated: 2024-08-05T23:02:11.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: The REST API in the DTE Energy Insight application before 1.7.8 for Android allows remote authenticated users to obtain unspecified customer information via a SQL expression in the filter parameter. Additional Analyst Notes: - CVE Program Container: References: - http://jeffq.com/blog/dteenergy-insight/ - http://www.kb.cert.org/vuls/id/713312
CVE ID: CVE-2016-1563 State: PUBLISHED Published: 2016-04-07T10:00:00 Last Updated: 2024-08-05T23:02:11.984Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/index?page=content&id=9010064 - https://security.netapp.com/advisory/ntap-20160310-0002/
CVE ID: CVE-2016-1564 State: PUBLISHED Published: 2016-05-22T01:00:00 Last Updated: 2024-08-05T23:02:11.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1034622 - https://codex.wordpress.org/Version_4.4.1 - http://www.debian.org/security/2016/dsa-3444 - http://www.openwall.com/lists/oss-security/2016/01/08/4 - http://twitter.com/brutelo
debian.org/security/2016/dsa-3444 - http://www.openwall.com/lists/oss-security/2016/01/08/4 - http://twitter.com/brutelogic/statuses/685105483397619713 - https://wpvulndb.com/vulnerabilities/8358 - https://wordpress.org/news/2016/01/wordpress-4-4-1-security-and-maintenance-release/ - https://core.trac.wordpress.org/changeset/36185
CVE ID: CVE-2016-1565 State: PUBLISHED Published: 2016-01-08T21:00:00Z Last Updated: 2024-09-16T23:25:24.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2644832 - https://www.drupal.org/node/2645350
CVE ID: CVE-2016-1566 State: PUBLISHED Published: 2017-02-02T15:00:00 Last Updated: 2024-08-05T23:02:12.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users, allows remote authenticated users to inject arbitrary web script or HTML via a crafted filename. NOTE: this vulnerability was fixed in guacamole.war on 2016-01-13, but the version number was not changed. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/guacamole/news/2016/02/security-advisory---stored-xss-cve-2016-1566--guac-14
er: References: - https://sourceforge.net/p/guacamole/news/2016/02/security-advisory---stored-xss-cve-2016-1566--guac-1465/
CVE ID: CVE-2016-1567 State: PUBLISHED Published: 2016-01-26T19:00:00 Last Updated: 2024-08-05T23:02:11.769Z Vendors: n/a Products: n/a Problem Types: n/a Description: chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." Additional Analyst Notes: - CVE Program Container: References: - http://www.talosintel.com/reports/TALOS-2016-0071/ - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176559.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html - ht
unce/2016-February/176559.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175969.html - http://chrony.tuxfamily.org/news.html#_20_jan_2016_chrony_2_2_1_and_chrony_1_31_2_released
CVE ID: CVE-2016-1568 State: PUBLISHED Published: 2016-04-08T16:00:00 Last Updated: 2024-08-05T23:02:11.728Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2016-0086.html - http://www.openwall.com/lists/oss-security/2016/01/09/2 - http://www.securityfocus.com/bid/80191 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab035
s-security/2016/01/09/2 - http://www.securityfocus.com/bid/80191 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=4ab0359a8ae182a7ac5c99609667273167703fab - http://www.securitytracker.com/id/1034859 - http://www.debian.org/security/2016/dsa-3469 - http://www.debian.org/security/2016/dsa-3470 - http://rhn.redhat.com/errata/RHSA-2016-0087.html - http://rhn.redhat.com/errata/RHSA-2016-0084.html - http://www.debian.org/security/2016/dsa-3471 - https://security.gentoo.org/glsa/201602-01 - http://rhn.redhat.com/errata/RHSA-2016-0088.html - http://www.openwall.com/lists/oss-security/2016/01/09/1
CVE ID: CVE-2016-1569 State: PUBLISHED Published: 2016-01-13T15:00:00 Last Updated: 2024-08-05T23:02:11.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/01/10/2 - http://www.openwall.com/lists/oss-security/2016/01/10/3 - http://tracker.firebirdsql.org/browse/CORE-5068 - http://sourceforge.net/p/firebird/code/62783/ - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.ht
urceforge.net/p/firebird/code/62783/ - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.html
CVE ID: CVE-2016-1570 State: PUBLISHED Published: 2016-01-22T15:00:00 Last Updated: 2024-08-05T23:02:11.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - htt
tes. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - http://www.securitytracker.com/id/1034744 - http://xenbits.xen.org/xsa/advisory-167.html
CVE ID: CVE-2016-1571 State: PUBLISHED Published: 2016-01-22T15:00:00 Last Updated: 2024-08-05T23:02:11.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3519 - http://www.securitytracker.com/id/1034745 - http://support.citrix.com/article/CTX205496 - http://xe
rity/2016/dsa-3519 - http://www.securitytracker.com/id/1034745 - http://support.citrix.com/article/CTX205496 - http://xenbits.xen.org/xsa/advisory-168.html
CVE ID: CVE-2016-1572 State: PUBLISHED Published: 2016-01-22T15:00:00 Last Updated: 2024-08-05T23:02:11.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a nonstandard filesystem, as demonstrated by /proc/$pid. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-01/msg00091.html - http://www.securitytracker.com/id/1034791 - http://lists.opensuse.org/opensuse-updates/2016-01/msg00118.html - https://bugs.launchpad.net/ecryptfs/+bug/1530566 - http://www.openwall.com
.org/opensuse-updates/2016-01/msg00118.html - https://bugs.launchpad.net/ecryptfs/+bug/1530566 - http://www.openwall.com/lists/oss-security/2016/01/20/6 - http://lists.opensuse.org/opensuse-updates/2016-02/msg00004.html - http://www.ubuntu.com/usn/USN-2876-1 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177396.html - http://www.debian.org/security/2016/dsa-3450 - https://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/870 - http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177359.html
CVE ID: CVE-2016-1573 State: PUBLISHED Published: 2019-04-22T15:35:59.410710Z Last Updated: 2024-09-16T18:13:42.140Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Ubuntu Products: Unity8 Problem Types: Executing data as code. Description: Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a scope. Additional Analyst Notes: - CVE Program Container: References: - https://bazaar.launchpad.net/~unity-team/unity8/stable/revision/2138
CVE ID: CVE-2016-1574 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-1575 State: PUBLISHED Published: 2016-05-02T10:00:00 Last Updated: 2024-08-05T23:02:12.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360 - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1575.html - https://launchpad.net/bugs/1534961 - http://www.halfdog.net/Security/2
om/~ubuntu-security/cve/2016/CVE-2016-1575.html - https://launchpad.net/bugs/1534961 - http://www.halfdog.net/Security/2016/UserNamespaceOverlayfsXattrSetgidPrivilegeEscalation/ - http://www.openwall.com/lists/oss-security/2016/02/24/7 - http://www.openwall.com/lists/oss-security/2021/10/18/1
CVE ID: CVE-2016-1576 State: PUBLISHED Published: 2016-05-02T10:00:00 Last Updated: 2024-08-05T23:02:11.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by mounting an overlayfs filesystem on top of a FUSE filesystem, and then executing a crafted setuid program. Additional Analyst Notes: - CVE Program Container: References: - https://launchpadlibrarian.net/235300093/0005-overlayfs-Be-more-careful-about-copying-up-sxid-file.patch - https://launchpadlibrarian.net/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-m
ing-up-sxid-file.patch - https://launchpadlibrarian.net/235300225/0006-overlayfs-Propogate-nosuid-from-lower-and-upper-moun.patch - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9f57ebcba563e0cd532926cab83c92bb4d79360 - https://bugs.launchpad.net/bugs/1535150 - http://www.openwall.com/lists/oss-security/2016/02/24/8 - http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1576.html - http://www.halfdog.net/Security/2016/OverlayfsOverFusePrivilegeEscalation/ - http://www.openwall.com/lists/oss-security/2021/10/18/1
CVE ID: CVE-2016-1577 State: PUBLISHED Published: 2016-04-13T14:00:00 Last Updated: 2024-08-05T23:02:11.739Z Vendors: n/a Products: n/a Problem Types: n/a Description: Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2016/dsa-3508 - http://www.openwall.com/lists/oss-security/2016/03/03/12 - https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865 - h
://www.openwall.com/lists/oss-security/2016/03/03/12 - https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865 - http://www.ubuntu.com/usn/USN-2919-1 - https://access.redhat.com/errata/RHSA-2017:1208 - http://www.securityfocus.com/bid/84133
CVE ID: CVE-2016-1578 State: PUBLISHED Published: 2016-05-13T14:00:00 Last Updated: 2024-08-05T23:02:11.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to responding synchronously to permission requests. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2955-1
CVE ID: CVE-2016-1579 State: PUBLISHED Published: 2019-04-22T15:35:59.488395Z Last Updated: 2024-09-16T16:27:40.350Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Ubuntu Products: Ubuntu Download Manager Problem Types: Missing access control checks. Description: UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UDM C++ API to run arbitrary commands in an unconfined environment as the phablet user. Additional Analyst
ke use of the UDM C++ API to run arbitrary commands in an unconfined environment as the phablet user. Additional Analyst Notes: - CVE Program Container: References: - https://bazaar.launchpad.net/~phablet-team/ubuntu-download-manager/trunk/revision/359
CVE ID: CVE-2016-1580 State: PUBLISHED Published: 2016-05-13T14:00:00 Last Updated: 2024-08-05T23:02:11.675Z Vendors: n/a Products: n/a Problem Types: n/a Description: The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core." Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/ubuntu/+source/ubuntu-core-launcher/+bug/1576699 - http://www.ubuntu.com/usn/USN-2956-1
CVE ID: CVE-2016-1581 State: PUBLISHED Published: 2016-06-09T16:00:00 Last Updated: 2024-08-05T23:02:11.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://linuxcontainers.org/lxd/news/ - http://www.ubuntu.com/usn/USN-2988-1
CVE ID: CVE-2016-1582 State: PUBLISHED Published: 2016-06-09T16:00:00 Last Updated: 2024-08-05T23:02:11.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users to access arbitrary world readable paths in the container directory via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://linuxcontainers.org/lxd/news/ - http://www.ubuntu.com/usn/USN-2988-1
CVE ID: CVE-2016-1583 State: PUBLISHED Published: 2016-06-27T10:00:00 Last Updated: 2024-08-05T23:02:11.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-3006-1 - http://www.ubuntu.com/usn/USN-3004-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.html - https://github.com/
tu.com/usn/USN-3004-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.html - https://github.com/torvalds/linux/commit/f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6d - http://rhn.redhat.com/errata/RHSA-2016-2766.html - http://www.ubuntu.com/usn/USN-3001-1 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6d - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html - https://www.exploit-db.com/exploits/39992/ - http://lists.opensuse.org/opensuse-security-an
unce/2016-08/msg00008.html - https://www.exploit-db.com/exploits/39992/ - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html - http://www.ubuntu.com/usn/USN-3005-1 - https://bugs.chromium.org/p/project-zero/issues/detail?id=836 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html - http://www.securityfocus.com/bid/91157 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html - http://www.ubuntu.com/usn/USN-2999-1 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.html - http://www.openwal
b95afacd8eba1f9f046b87 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.html - http://www.openwall.com/lists/oss-security/2016/06/10/8 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html - http://www.ubuntu.com/usn/USN-2997-1 - http://www.ubuntu.com/usn/USN-3000-1 - https://github.com/torvalds/linux/commit/f0fe970df3838c202ef6c07a4c2b36838ef0a88b - http://www.debian.org/security/2016/dsa-3607 - http://www.securitytracker.com/id/1036763 - https://github.com/torvalds/linux/commit/2f36db71009304b3f0b95afacd8eba1f9f046b87 - http://www.ubuntu.com/usn/USN-3002-1 - http://www
b.com/torvalds/linux/commit/2f36db71009304b3f0b95afacd8eba1f9f046b87 - http://www.ubuntu.com/usn/USN-3002-1 - http://www.ubuntu.com/usn/USN-2996-1 - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00027.html - https://access.redhat.com/errata/RHSA-2017:2760 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.html - http://www.ubuntu.com/usn/USN-3007-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.html -
l - http://www.ubuntu.com/usn/USN-3007-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.html - http://rhn.redhat.com/errata/RHSA-2016-2124.html - http://www.ubuntu.com/usn/USN-3003-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html - http://www.openwall.com/lists/oss-security/2016/06/22/1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.html - https://bugzilla.redhat.com/show_bug.cgi?id=1344721 - http://www.ubuntu.com/usn/USN-2998-1 - http://packetstormsecurity.com/files/137560/Linux-ecryptfs-Stack-Overflow.html - http://www.ubuntu.com/usn/U
SN-2998-1 - http://packetstormsecurity.com/files/137560/Linux-ecryptfs-Stack-Overflow.html - http://www.ubuntu.com/usn/USN-3008-1 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
CVE ID: CVE-2016-1584 State: PUBLISHED Published: 2019-04-22T15:35:59.533413Z Last Updated: 2024-09-17T03:22:49.160Z Severity: LOW (CVSS 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Ubuntu Products: Unity8 Problem Types: Lack of access controls. Description: In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input. Additional Analyst Notes: - CVE Program Container: References: - https://bazaar.launchpad.net/~mir-team/qtmir/trunk/revision/521
CVE ID: CVE-2016-1585 State: PUBLISHED Published: 2019-04-22T15:35:59.573205Z Last Updated: 2024-09-16T23:36:50.974Z Severity: LOW (CVSS 3.9 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: AppArmor Products: apparmor Problem Types: Improper translation of access control rules to policy. Description: In all versions of AppArmor mount rules are accidentally widened when compiled. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/apparmor/+bug/1597017 - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE ID: CVE-2016-1586 State: PUBLISHED Published: 2019-04-22T15:35:59.609844Z Last Updated: 2024-09-16T22:20:17.526Z Severity: LOW (CVSS 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Ubuntu Products: Oxide Problem Types: Imprecise garbage collection. Description: A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3. Additional Analyst Notes: - CVE Program Container: References: - https://git.launchpad.net/oxide/commit/?id=29014da83e5fc358d6bff0f574e9ed45e61a35ac
CVE ID: CVE-2016-1587 State: PUBLISHED Published: 2019-04-22T15:35:59.648562Z Last Updated: 2024-09-16T23:46:24.656Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Ubuntu Products: snapweb Problem Types: Missing access controls. Description: The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system. Additional Analyst Notes: - CV