Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-8878 State: PUBLISHED Published: 2016-10-31T10:00:00 Last Updated: 2024-08-06T02:35:02.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93608 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2016-8879 State: PUBLISHED Published: 2016-10-31T10:00:00 Last Updated: 2024-08-06T02:35:01.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: The thumbnail shell extension plugin (FoxitThumbnailHndlr_x86.dll) in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted JPEG2000 image embedded in a PDF document, aka an "Exploitable - Heap Corruption" issue. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93608 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2016-8880 State: REJECTED Published: 2017-01-13T16:00:00 Last Updated: 2017-01-13T15:57:01 Description: No description available.
CVE ID: CVE-2016-8881 State: REJECTED Published: 2017-01-13T16:00:00 Last Updated: 2017-01-13T15:57:01 Description: No description available.
CVE ID: CVE-2016-8882 State: PUBLISHED Published: 2017-01-13T16:00:00 Last Updated: 2024-08-06T02:35:02.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95864 - https://github.com/mdadams/jasper/issues/30 - http://www.debian.org/security/2017/dsa-3785 - http://www.openwall.com/lists/oss-security/2016/10/17/1 - http://www.openwall.com/lists/oss-security/2016/10/23/8
CVE ID: CVE-2016-8883 State: PUBLISHED Published: 2017-01-13T16:00:00 Last Updated: 2024-08-06T02:35:01.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95865 - https://github.com/mdadams/jasper/issues/32 - https://access.redhat.com/errata/RHSA-2017:1208 - http://www.openwall.com/lists/oss-security/2016/10/17/1 - http://www.openwall.com/lists/oss-security/2016/10/23/8 - https://usn.ubuntu.com/3693-1/
CVE ID: CVE-2016-8884 State: PUBLISHED Published: 2017-03-28T14:00:00 Last Updated: 2024-08-06T02:35:02.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/ - https://github.com/mdadams/jasper/commit/5d6689
ce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/ - https://github.com/mdadams/jasper/commit/5d66894d2313e3f3469f19066e149e08ff076698 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGI2FZQLOTSZI3VA4ECJERI74SMNQDL4/ - https://access.redhat.com/errata/RHSA-2017:1208 - http://www.openwall.com/lists/oss-security/2016/10/23/1 - http://www.openwall.com/lists/oss-security/2016/10/23/9 - http://www.securityfocus.com/bid/93834 - https://blogs.gentoo.org/ago/2016/10/18/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c-incomplete-fix-for-cve-2016-8690/ - https://bugzilla.redhat.com/show_bug.cgi?id=1385499
CVE ID: CVE-2016-8885 State: PUBLISHED Published: 2017-03-23T18:00:00 Last Updated: 2024-08-06T02:35:02.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/ - https://blogs.gentoo.org/ago/2016/10/18/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c-incomplete-fix-for-
https://blogs.gentoo.org/ago/2016/10/18/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c-incomplete-fix-for-cve-2016-8690 - http://www.openwall.com/lists/oss-security/2016/10/23/5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGI2FZQLOTSZI3VA4ECJERI74SMNQDL4/ - https://access.redhat.com/errata/RHSA-2017:1208 - http://www.openwall.com/lists/oss-security/2016/10/23/1 - http://www.openwall.com/lists/oss-security/2016/10/23/9 - http://www.securityfocus.com/bid/93834 - https://bugzilla.redhat.com/show_bug.cgi?id=1385499
CVE ID: CVE-2016-8886 State: PUBLISHED Published: 2017-03-23T18:00:00 Last Updated: 2024-08-06T02:35:02.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/ - https://blogs.gentoo.org/ago/2016/10/18/jasper-memory-allocation-failure-in-jas_malloc-jas_malloc-c - http://www.securityfocus.com/bid/938
oo.org/ago/2016/10/18/jasper-memory-allocation-failure-in-jas_malloc-jas_malloc-c - http://www.securityfocus.com/bid/93839 - http://www.openwall.com/lists/oss-security/2016/10/25/11 - https://bugzilla.redhat.com/show_bug.cgi?id=1388880 - http://www.openwall.com/lists/oss-security/2016/10/23/2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGI2FZQLOTSZI3VA4ECJERI74SMNQDL4/
CVE ID: CVE-2016-8887 State: PUBLISHED Published: 2017-03-23T18:00:00 Last Updated: 2024-08-06T02:35:02.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference). Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/ - http://www.securityfocus.com/bid/93835 - https://blogs.gentoo.org/ago/2016/10/18/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c - https://lists.fedoraproje
logs.gentoo.org/ago/2016/10/18/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGI2FZQLOTSZI3VA4ECJERI74SMNQDL4/ - https://bugzilla.redhat.com/show_bug.cgi?id=1388828 - https://usn.ubuntu.com/3693-1/ - http://www.openwall.com/lists/oss-security/2016/10/23/3 - http://www.openwall.com/lists/oss-security/2016/10/23/6 - https://github.com/mdadams/jasper/commit/e24bdc716c3327b067c551bc6cfb97fd2370358d
CVE ID: CVE-2016-8889 State: PUBLISHED Published: 2016-10-28T15:00:00 Last Updated: 2024-08-06T02:35:02.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including private keys and the wallet passphrase in its persistent command history. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94235 - https://bitcointalk.org/index.php?topic=1618462.0 - https://github.com/bitcoinknots/bitcoin/blob/v0.13.1.knots20161027/doc/release-notes.md
CVE ID: CVE-2016-8897 State: PUBLISHED Published: 2019-05-23T18:21:31 Last Updated: 2024-08-06T02:35:02.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/30/5 - https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3db
CVE ID: CVE-2016-8898 State: PUBLISHED Published: 2019-05-24T16:20:41 Last Updated: 2024-08-06T02:35:02.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/30/5 - https://github.com/exponentcms/exponent-cms/commit/99636b2118cd9af4eb9920f6b6c228bd824593d2
CVE ID: CVE-2016-8899 State: PUBLISHED Published: 2019-05-23T18:18:53 Last Updated: 2024-08-06T02:35:02.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/30/5 - https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3db
CVE ID: CVE-2016-8900 State: PUBLISHED Published: 2019-05-24T16:11:37 Last Updated: 2024-08-06T02:35:02.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/30/5 - https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3db
CVE ID: CVE-2016-8901 State: PUBLISHED Published: 2019-05-23T17:56:13 Last Updated: 2024-08-06T02:35:02.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/30/3 - https://github.com/b2evolution/b2evolution/commit/25c21cf9cc4261324001f9039509710b37ee2c4d - https://github.com/b2evolution/b2evolution/commit/999b5ad1d59760d7e450ceb541f55432fc74cd27
CVE ID: CVE-2016-8902 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8903 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-dis
m/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8904 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.743Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-di
om/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8905 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8906 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclos
tCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8907 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disc
/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8908 State: PUBLISHED Published: 2016-11-14T23:00:00 Last Updated: 2024-08-06T02:35:02.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dotCMS/core/pull/8460/ - http://www.securityfocus.com/bid/94311 - http://seclists.org/fulldisclosure/2016/Nov/0 - https://github.com/dotCMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosu
CMS/core/pull/8468/ - https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html
CVE ID: CVE-2016-8909 State: PUBLISHED Published: 2016-11-04T21:00:00 Last Updated: 2024-08-06T02:35:02.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/10/24/4 - https://security.gentoo.org/glsa/201611-11 - http://www.openwall.com/lists/oss-security/2016/10/24/1 - https://access.redhat.com/errata/RHSA-2017:2392 -
201611-11 - http://www.openwall.com/lists/oss-security/2016/10/24/1 - https://access.redhat.com/errata/RHSA-2017:2392 - http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html - https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg04682.html - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://access.redhat.com/errata/RHSA-2017:2408 - http://www.securityfocus.com/bid/93842
CVE ID: CVE-2016-8910 State: PUBLISHED Published: 2016-11-04T21:00:00 Last Updated: 2024-08-06T02:35:02.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201611-11 - http://www.openwall.com/lists/oss-security/2016/10/24/5 - https://access.redhat.com/errata/RHSA-2017:2392 - http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html - ht
https://access.redhat.com/errata/RHSA-2017:2392 - http://lists.opensuse.org/opensuse-updates/2016-12/msg00140.html - http://www.securityfocus.com/bid/93844 - https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg05495.html - http://www.openwall.com/lists/oss-security/2016/10/24/2 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://access.redhat.com/errata/RHSA-2017:2408
CVE ID: CVE-2016-8911 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.839Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Gain Access Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94325 - http://www.ibm.com/support/docview.wss?uid=swg21993982
CVE ID: CVE-2016-8912 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.268Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Obtain Information Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94324
CVE ID: CVE-2016-8913 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.294Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Obtain Information Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21993982 - http://www.securityfocus.com/bid/94304
CVE ID: CVE-2016-8915 State: PUBLISHED Published: 2017-02-22T19:00:00 Last Updated: 2024-08-06T02:35:02.297Z Vendors: IBM Corporation Products: WebSphere MQ Problem Types: Denial of Service Description: IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same process. IBM Reference #: 1998649. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21998649 - http://www.securityfocus.com/bid/96403
CVE ID: CVE-2016-8916 State: PUBLISHED Published: 2017-05-05T19:00:00 Last Updated: 2024-08-06T02:35:02.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21998166 - http://www.securityfocus.com/bid/98335
CVE ID: CVE-2016-8917 State: PUBLISHED Published: 2017-03-31T18:00:00 Last Updated: 2024-08-06T02:35:02.277Z Vendors: IBM Corporation Products: Sterling Order Management Problem Types: Gain Access Description: IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000943. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg22000943 - http://www.securityfocus.com/bid/97150
CVE ID: CVE-2016-8918 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.297Z Vendors: IBM Corporation Products: Integration Bus Problem Types: Bypass Security Description: IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.ibm.com/support/docview.wss?uid=swg21995079 - http://www.securityfocus.com/bid/94644
CVE ID: CVE-2016-8919 State: PUBLISHED Published: 2017-02-01T22:00:00 Last Updated: 2024-08-06T02:35:02.271Z Vendors: IBM Corporation Products: WebSphere Application Server Problem Types: Denial of Service Description: IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95650 - http://www.securitytracker.com/id/1037710 - http://www.ibm.com/support/docview.wss?uid=swg21993797
CVE ID: CVE-2016-8920 State: PUBLISHED Published: 2017-02-01T20:00:00 Last Updated: 2024-08-06T02:35:02.285Z Vendors: IBM Corporation Products: Kenexa LMS on Cloud Problem Types: Cross-Site Scripting Description: IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94303 - http://www.ibm.com/support/docview.wss?uid=swg21993982