Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-3977 State: PUBLISHED Published: 2016-04-21T14:00:00 Last Updated: 2024-08-06T00:10:31.969Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in util/gif2rgb.c in gif2rgb in giflib 5.1.2 allows remote attackers to cause a denial of service (application crash) via the background color index in a GIF file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/88103 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00084.html - https://sourceforge.net/p/giflib/bugs/87/ - https://sourceforge.net/p/giflib/code/ci/ea8dbc5786862a3e16a5acfa3d24e2c2f608cd88/ - http://lists.opensuse.org/opensuse-upda
s://sourceforge.net/p/giflib/code/ci/ea8dbc5786862a3e16a5acfa3d24e2c2f608cd88/ - http://lists.opensuse.org/opensuse-updates/2016-04/msg00079.html - http://bugs.fi/fuzzing/index.html - http://lists.opensuse.org/opensuse-updates/2016-05/msg00019.html - https://bugzilla.redhat.com/show_bug.cgi?id=1325771 - https://usn.ubuntu.com/4107-1/
CVE ID: CVE-2016-3978 State: PUBLISHED Published: 2016-04-08T14:00:00Z Last Updated: 2024-09-16T19:46:15.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login." Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Mar/68 - http://www.securitytracker.com/id/1035332 - http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability
CVE ID: CVE-2016-3979 State: PUBLISHED Published: 2016-04-08T14:00:00 Last Updated: 2024-08-06T00:10:31.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137589/SAP-NetWeaver-AS-JAVA-7.4-icman-Denial-Of-Service.html - https://erpscan.io/advisories/erpscan-16-017-sap-java-icman-dos/ - http://seclists.org/fu
icman-Denial-Of-Service.html - https://erpscan.io/advisories/erpscan-16-017-sap-java-icman-dos/ - http://seclists.org/fulldisclosure/2016/Jun/55
CVE ID: CVE-2016-3980 State: PUBLISHED Published: 2016-04-08T14:00:00 Last Updated: 2024-08-06T00:10:31.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/137591/SAP-NetWeaver-AS-JAVA-7.4-jstart-Denial-Of-Service.html - https://erpscan.io/advisories/erpscan-16-018-sap-java-jstart-dos/ - http://seclists.org/fulldisclosure/2016/Jun/56
CVE ID: CVE-2016-3981 State: PUBLISHED Published: 2016-04-13T16:00:00 Last Updated: 2024-08-06T00:10:31.954Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.fi/media/afl/optipng/1/ - https://sourceforge.net/p/optipng/bugs/56/ - http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html - http://www.debian.org/security/2016/dsa-3546 - http://www.ubu
ists.opensuse.org/opensuse-updates/2016-04/msg00065.html - http://www.debian.org/security/2016/dsa-3546 - http://www.ubuntu.com/usn/USN-2951-1 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html - https://security.gentoo.org/glsa/201608-01
CVE ID: CVE-2016-3982 State: PUBLISHED Published: 2016-04-13T16:00:00 Last Updated: 2024-08-06T00:10:31.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2016-04/msg00065.html - http://www.debian.org/security/2016/dsa-3546 - http://www.ubuntu.com/usn/USN-2951-1 - http://lists.opensuse.
0065.html - http://www.debian.org/security/2016/dsa-3546 - http://www.ubuntu.com/usn/USN-2951-1 - http://lists.opensuse.org/opensuse-updates/2016-04/msg00061.html - https://security.gentoo.org/glsa/201608-01 - http://bugs.fi/media/afl/optipng/2/ - https://sourceforge.net/p/optipng/bugs/57/
CVE ID: CVE-2016-3983 State: PUBLISHED Published: 2016-04-08T15:00:00Z Last Updated: 2024-09-16T17:22:45.012Z Vendors: n/a Products: n/a Problem Types: n/a Description: McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent process. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10149
CVE ID: CVE-2016-3984 State: PUBLISHED Published: 2016-04-08T15:00:00 Last Updated: 2024-08-06T00:10:31.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows
vention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2016/Mar/13 - http://lab.mediaservice.net/advisory/2016-01-mcafee.txt - https://www.exploit-db.com/exploits/39531/ - http://www.securitytracker.com/id/1035130 - https://kc.mcafee.com/corporate/index?page=content&id=SB10151
CVE ID: CVE-2016-3985 State: PUBLISHED Published: 2016-04-08T16:00:00Z Last Updated: 2024-09-16T19:05:11.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenticated users to bypass intended access restrictions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035129 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40166
CVE ID: CVE-2016-3986 State: PUBLISHED Published: 2016-04-08T16:00:00Z Last Updated: 2024-09-17T01:46:34.421Z Vendors: n/a Products: n/a Problem Types: n/a Description: Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing. Additional Analyst Notes: - CVE Program Container: References: - https://code.google.com/p/google-security-research/issues/detail?id=668 - https://www.exploit-db.com/exploits/39530/ - http://packetstormsecurity.com/files/136090/Avast-Authenticode-Parsing-Memory-Corruption.html
CVE ID: CVE-2016-3987 State: PUBLISHED Published: 2016-04-08T16:00:00Z Last Updated: 2024-09-16T16:59:02.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39218/ - http://packetstormsecurity.com/files/135222/TrendMicro-Node.js-HTTP-Server-Command-Execution.html - http://www.securitytracker.com/id/1034662 - http://blog.trendmicro.com/information-on-reported-vulnerabilities-in-trend-micro-password-manage
acker.com/id/1034662 - http://blog.trendmicro.com/information-on-reported-vulnerabilities-in-trend-micro-password-manager/ - https://code.google.com/p/google-security-research/issues/detail?id=693
CVE ID: CVE-2016-3988 State: PUBLISHED Published: 2016-07-03T14:00:00 Last Updated: 2024-08-06T00:10:32.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/I
POST request. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03
CVE ID: CVE-2016-3989 State: PUBLISHED Published: 2016-07-03T14:00:00 Last Updated: 2024-08-06T00:10:32.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-d
ing access to the nobody account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/40120/ - https://ics-cert.us-cert.gov/advisories/ICSA-16-175-03
CVE ID: CVE-2016-3990 State: PUBLISHED Published: 2016-09-21T18:00:00 Last Updated: 2024-08-06T00:10:32.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.securityfocus.com/bid/86000 - http://rhn.redhat.com/errata/RHSA-2016-1547.html - http://bugzilla.maptools.org/show_bug.cgi?id=2544 - http
/bid/86000 - http://rhn.redhat.com/errata/RHSA-2016-1547.html - http://bugzilla.maptools.org/show_bug.cgi?id=2544 - http://www.openwall.com/lists/oss-security/2016/04/12/2 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://security.gentoo.org/glsa/201701-16 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html - http://rhn.redhat.com/errata/RHSA-2016-1546.html - http://www.debian.org/security/2017/dsa-3762 - https://bugzilla.redhat.com/show_bug.cgi?id=1326246
CVE ID: CVE-2016-3991 State: PUBLISHED Published: 2016-09-21T18:00:00 Last Updated: 2024-08-06T00:10:32.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.securityfocus.com/bid/85996 - http://rhn.redhat.com/errata/RHSA-2016-1547.html - http://www.oracle.com/technetwork/topics/secu
tyfocus.com/bid/85996 - http://rhn.redhat.com/errata/RHSA-2016-1547.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - https://security.gentoo.org/glsa/201701-16 - http://lists.opensuse.org/opensuse-updates/2016-09/msg00039.html - http://www.openwall.com/lists/oss-security/2016/04/12/3 - http://rhn.redhat.com/errata/RHSA-2016-1546.html - http://www.debian.org/security/2017/dsa-3762 - http://bugzilla.maptools.org/show_bug.cgi?id=2543 - https://bugzilla.redhat.com/show_bug.cgi?id=1326249
CVE ID: CVE-2016-3992 State: PUBLISHED Published: 2016-07-26T17:00:00 Last Updated: 2024-08-06T00:10:32.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/09/4 - http://www.openwall.com/lists/oss-security/2016/04/10/2 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=820331 - http://lists.opensuse.org/opensuse-updates/2016-07/msg00013.html
CVE ID: CVE-2016-3993 State: PUBLISHED Published: 2016-05-13T16:00:00 Last Updated: 2024-08-06T00:10:32.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates. Additional Analyst Notes: - CVE Program Container: References: - https://git.enlightenment.org/legacy/imlib2.git/commit/?id=ce94edca1ccfbe314cb7cd9453433fad404ec7ef - https://sourceforge.net/p/enlightenment/mailman/message/35055012/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819818 - http://www.debian.org/se
htenment/mailman/message/35055012/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819818 - http://www.debian.org/security/2016/dsa-3555 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html
CVE ID: CVE-2016-3994 State: PUBLISHED Published: 2016-05-13T16:00:00 Last Updated: 2024-08-06T00:17:29.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read. Additional Analyst Notes: - CVE Program Container: References: - https://git.enlightenment.org/legacy/imlib2.git/commit/?id=37a96801663b7b4cd3fbe56cc0eb8b6a17e766a8 - https://sourceforge.net/p/enlightenment/mailman/message/35055012/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=785369 - http://www.debian.org/security/2016/
lman/message/35055012/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=785369 - http://www.debian.org/security/2016/dsa-3555 - http://lists.opensuse.org/opensuse-updates/2016-05/msg00076.html
CVE ID: CVE-2016-3995 State: PUBLISHED Published: 2017-02-13T18:00:00 Last Updated: 2024-08-06T00:17:29.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/04/11/2 - https://github.com/weidai11/cryptopp/issues/146 - http://www.securityfocus.com/bid/85975
CVE ID: CVE-2016-3996 State: PUBLISHED Published: 2017-01-27T20:00:00 Last Updated: 2024-08-06T00:17:29.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/136710/KNOX-2.3-Clipboard-Data-Disclosure.html - http://www.securityfocus.com/archive/1/538113/100/0/threaded
CVE ID: CVE-2016-3997 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-06T00:17:29.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=ssg1S1006063 - https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products
CVE ID: CVE-2016-3998 State: PUBLISHED Published: 2017-07-03T16:00:00 Last Updated: 2024-08-06T00:17:30.572Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol. Additional Analyst Notes: - CVE Program Container: References: - https://kb.netapp.com/support/s/article/ka51A0000008SXzQAM/smb-vulnerabilities-in-multiple-netapp-products
CVE ID: CVE-2016-3999 State: PUBLISHED Published: 2017-01-18T22:00:00 Last Updated: 2024-08-06T00:17:30.061Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.0 - http://www.securityfocus.com/bid/95921 - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE ID: CVE-2016-4000 State: PUBLISHED Published: 2017-07-06T16:00:00 Last Updated: 2024-08-06T00:17:29.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3893 - https://security.gentoo.org/glsa/201710-28 - http://www.securityfocus.com/bid/105647 - https://lists.apache.org/thread.html/0919ec1db20b1022f22b8e78f355667df74d6142b463ff17d03ad533%40%3Cdevnull.infra.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/sec
ull.infra.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security-tracker.debian.org/tracker/CVE-2016-4000 - https://hg.python.org/jython/rev/d06e29d100c0 - https://snyk.io/vuln/SNYK-JAVA-ORGPYTHON-31451 - http://bugs.jython.org/issue245
hg.python.org/jython/rev/d06e29d100c0 - https://snyk.io/vuln/SNYK-JAVA-ORGPYTHON-31451 - http://bugs.jython.org/issue2454 - https://hg.python.org/jython/file/v2.7.1rc1/NEWS - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864859
CVE ID: CVE-2016-4001 State: PUBLISHED Published: 2016-05-23T19:00:00 Last Updated: 2024-08-06T00:17:29.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet. Additional Analyst Notes: - CVE Program Container: References: - https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01334.html - http://www.openwall.com/lists/oss-security/2016/04/11/4 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html - htt
m/lists/oss-security/2016/04/11/4 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html - http://www.openwall.com/lists/oss-security/2016/04/12/6 - http://www.securityfocus.com/bid/85976 - https://security.gentoo.org/glsa/201609-01 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3a15cc0e1ee7168db0782133d2607a6bfa422d66 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html - http://www.ubuntu.com/usn/USN-2974-1 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
CVE ID: CVE-2016-4002 State: PUBLISHED Published: 2016-04-26T14:00:00 Last Updated: 2024-08-06T00:17:30.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1326082 - http://www.securityfocus.com/bid/85992 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.htm
- http://www.securityfocus.com/bid/85992 - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184209.html - https://security.gentoo.org/glsa/201609-01 - http://www.openwall.com/lists/oss-security/2016/04/11/6 - http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183275.html - http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183350.html - http://www.ubuntu.com/usn/USN-2974-1 - http://www.openwall.com/lists/oss-security/2016/04/12/7 - https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html - https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01131.html
CVE ID: CVE-2016-4003 State: PUBLISHED Published: 2016-04-12T16:00:00 Last Updated: 2024-08-06T00:17:29.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter. Additional Analyst Notes: - CVE Program Container: References: - http://struts.apache.org/docs/s2-028.html - http://www.securityfocus.com/bid/86311 - http://www.securitytracker.com/id/1035268 - https://issues.apache.org/jira/browse/WW-4507
CVE ID: CVE-2016-4004 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-06T00:17:30.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ (dot dot backslash) in the file parameter to ViewFile. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035564 - https://www.exploit-db.com/exploits/39486/