Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-0996 State: PUBLISHED Published: 2016-03-12T15:00:00 Last Updated: 2024-08-05T22:38:41.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, an
E-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html - http://www.securitytracker.com/id/1035251 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html - https://security.gentoo.org/glsa/201603-07 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html - https://helpx.adobe.com/security/products/flash-player/apsb16-08.html - http://www.securityfocus.com/bid/84312 - http://www.zerodayinitiative.com/advisories/ZDI-16-193/ - http://
b16-08.html - http://www.securityfocus.com/bid/84312 - http://www.zerodayinitiative.com/advisories/ZDI-16-193/ - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
CVE ID: CVE-2016-0997 State: PUBLISHED Published: 2016-03-12T15:00:00 Last Updated: 2024-08-05T22:38:41.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. Additio
90, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html - https://www.exploit-db.com/exploits/39613/ - http://www.securitytracker.com/id/1035251 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html - https://security.gentoo.org/glsa/201603-07 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html - https://helpx.adobe.com/security/products/flash-player/apsb16-08.html - http://www.securityfocus.com/bid/84312 - http://lists.opensuse.org/opensuse-security-
ucts/flash-player/apsb16-08.html - http://www.securityfocus.com/bid/84312 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
CVE ID: CVE-2016-0998 State: PUBLISHED Published: 2016-03-12T15:00:00 Last Updated: 2024-08-05T22:38:41.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000. Additio
90, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html - http://www.securitytracker.com/id/1035251 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html - https://www.exploit-db.com/exploits/39631/ - https://security.gentoo.org/glsa/201603-07 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html - https://helpx.adobe.com/security/products/flash-player/apsb16-08.html - https://www.exploit-db.com/exploits/39612/ - http://www.securityfocus.com/bid/84312 -
ucts/flash-player/apsb16-08.html - https://www.exploit-db.com/exploits/39612/ - http://www.securityfocus.com/bid/84312 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
CVE ID: CVE-2016-0999 State: PUBLISHED Published: 2016-03-12T15:00:00 Last Updated: 2024-08-05T22:38:41.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000. Additio
90, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39611/ - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html - http://www.securitytracker.com/id/1035251 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html - https://security.gentoo.org/glsa/201603-07 - http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html - https://helpx.adobe.com/security/products/flash-player/apsb16-08.html - http://www.securityfocus.com/bid/84312 - http://lists.opensuse.org/opensuse-security-
CVE ID: CVE-2016-1000000 State: PUBLISHED Published: 2016-10-06T14:00:00 Last Updated: 2024-08-06T03:47:34.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94496 - https://www.tenable.com/security/research/tra-2016-15
CVE ID: CVE-2016-1000001 State: PUBLISHED Published: 2016-10-07T18:00:00 Last Updated: 2024-08-06T03:47:34.834Z Vendors: n/a Products: n/a Problem Types: n/a Description: flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puiterwijk/flask-oidc/blob/master/flask_oidc/__init__.py#L293
CVE ID: CVE-2016-1000002 State: PUBLISHED Published: 2019-11-05T13:08:36 Last Updated: 2024-08-06T03:47:34.868Z Vendors: n/a Products: n/a Problem Types: n/a Description: gdm3 3.14.2 and possibly later has an information leak before screen lock Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000002.json - https://security-tracker.debian.org/tracker/CVE-2016-1000002 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000002 - https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000002
CVE ID: CVE-2016-1000003 State: PUBLISHED Published: 2016-10-07T18:00:00 Last Updated: 2024-08-06T03:47:34.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fedora-infra/mirrormanager2/commit/eb9b542bc818071b9eee41c3583b7e6e172b3a53.patch - https://github.com/fedora-infra/mirrormanager2/commit/2e227f6023477cbdbefd577f15d0846aa40c8775.patch
CVE ID: CVE-2016-1000004 State: PUBLISHED Published: 2020-02-19T12:38:48 Last Updated: 2024-08-06T03:47:34.880Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/8e7266fef1f329b805b37f32c9ad0090215ab269 - https://www.facebook.com/security/advisories/cve-2016-1000004
CVE ID: CVE-2016-1000005 State: PUBLISHED Published: 2020-02-19T12:38:53 Last Updated: 2024-08-06T03:47:34.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/facebook/hhvm/commit/39e7e177473350b3a5c34e8824af3b98e25efa89 - https://www.facebook.com/security/advisories/cve-2016-1000005
CVE ID: CVE-2016-1000006 State: PUBLISHED Published: 2019-11-19T14:51:15 Last Updated: 2024-08-06T03:47:34.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2016-1000006 - https://www.mail-archive.com/debian-devel-changes%40lists.debian.org/msg506329.html - https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1000006.html
CVE ID: CVE-2016-1000007 State: PUBLISHED Published: 2016-10-07T18:00:00 Last Updated: 2024-08-06T03:47:34.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pagure 2.2.1 XSS in raw file endpoint Additional Analyst Notes: - CVE Program Container: References: - https://pagure.io/pagure/c/070d63983fe5daef92005ea33d3b8c693c224c77.patch
CVE ID: CVE-2016-1000009 State: PUBLISHED Published: 2016-10-06T14:00:00 Last Updated: 2024-08-06T03:47:34.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices. Additional Analyst Notes: - CVE Program Container: References: - https://pbs.twimg.com/media/CmnQ3F0WIAAs_X0.jpg - https://pbs.twimg.com/media/CmnQGI0WAAIbPHA.jpg - http://seclists.org/bugtraq/2016/Jul/3
CVE ID: CVE-2016-1000013 State: REJECTED Published: 2018-06-17T20:00:00 Last Updated: 2018-06-17T19:57:01 Description: No description available.
CVE ID: CVE-2016-1000014 State: REJECTED Published: 2016-10-06T14:00:00 Last Updated: 2016-10-06T13:57:01 Description: No description available.
CVE ID: CVE-2016-1000021 State: REJECTED Published: 2019-12-03T21:56:20 Last Updated: 2019-12-30T17:31:07 Description: No description available.
CVE ID: CVE-2016-1000022 State: REJECTED Published: 2019-12-20T12:54:20 Last Updated: 2020-01-15T20:37:33 Description: No description available.
CVE ID: CVE-2016-1000023 State: REJECTED Published: 2018-06-17T20:00:00 Last Updated: 2018-06-17T19:57:01 Description: No description available.
CVE ID: CVE-2016-1000025 State: REJECTED Published: 2018-06-17T20:00:00 Last Updated: 2018-06-17T19:57:01 Description: No description available.
CVE ID: CVE-2016-1000027 State: PUBLISHED Published: 2020-01-02T00:00:00 Last Updated: 2024-08-06T03:47:34.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data. Additional Analyst Notes: - CVE Program Container: References: - htt
some users rely on deserialization of trusted data. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2016-20 - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json - https://security-tracker.debian.org/tracker/CVE-2016-1000027 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027 - https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626 - https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417 - https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now - https://github.com/sprin
82313417 - https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now - https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525 - https://security.netapp.com/advisory/ntap-20230420-0009/
CVE ID: CVE-2016-1000028 State: PUBLISHED Published: 2019-12-27T14:19:43 Last Updated: 2024-08-06T03:47:34.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198). Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2016-11 - http://www.securityfocus.com/bid/92134 - http://www.securitytracker.com/id/1036414
CVE ID: CVE-2016-1000029 State: PUBLISHED Published: 2019-12-27T14:24:40 Last Updated: 2024-08-06T03:47:35.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92134 - http://www.securitytracker.com/id/1036414 - https://www.tenable.com/security/tns-2016-11
CVE ID: CVE-2016-1000030 State: PUBLISHED Published: 2018-09-05T17:00:00 Last Updated: 2024-08-06T03:47:35.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/ - https://pidgin.im/news/security/?id=91
tainer: References: - https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/ - https://pidgin.im/news/security/?id=91 - https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe - https://access.redhat.com/security/cve/cve-2016-1000030 - https://security.gentoo.org/glsa/201701-38
CVE ID: CVE-2016-1000031 State: PUBLISHED Published: 2016-10-25T14:00:00 Last Updated: 2024-08-06T03:47:34.863Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93604 - https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html
a39451%40%3Csolr-user.lucene.apache.org%3E - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://secur
twork/security-advisory/cpuoct2019-5072832.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20190212-0001/ - https://issues.apache.org/jira/browse/WW-4812 - http://www.zerodayinitiative.com/advisories/ZDI-16-570/ - https://www.tenable.com/security/research/tra-2016-30 - https://www.tenable.com/security/research/tra-2016-12 - https://issues.apache.org/jira/browse/FILEUPLOAD-279 - https://www.tenable.com/security/research/tra-2016-23 - https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.
//www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2016-1000032 State: PUBLISHED Published: 2016-10-25T14:00:00 Last Updated: 2024-08-06T03:47:34.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1316083 - https://patrick.uiterwijk.org/2016/03/09/fedora-spam-dwf-2016-89000/
CVE ID: CVE-2016-1000033 State: PUBLISHED Published: 2016-10-25T14:00:00 Last Updated: 2024-08-06T03:47:34.848Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.gnome.org/show_bug.cgi?id=754488
CVE ID: CVE-2016-1000037 State: PUBLISHED Published: 2019-11-06T18:27:55 Last Updated: 2024-08-06T03:47:34.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pagure: XSS possible in file attachment endpoint Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000037.json - https://security-tracker.debian.org/tracker/CVE-2016-1000037 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000037 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7EHB2WQ46M737B2STHQTOPTBSSQJDSS/
CVE ID: CVE-2016-1000100 State: REJECTED Published: 2016-10-06T14:00:00 Last Updated: 2016-10-06T13:57:01 Description: No description available.
CVE ID: CVE-2016-1000101 State: REJECTED Published: 2016-10-06T14:00:00 Last Updated: 2016-10-06T13:57:01 Description: No description available.
CVE ID: CVE-2016-1000102 State: REJECTED Published: 2016-10-06T14:00:00 Last Updated: 2016-10-06T13:57:01 Description: No description available.
CVE ID: CVE-2016-1000103 State: REJECTED Published: 2020-02-03T17:40:09 Last Updated: 2020-02-04T16:33:47 Description: No description available.
CVE ID: CVE-2016-1000104 State: PUBLISHED Published: 2019-12-03T21:12:15 Last Updated: 2024-08-06T03:55:26.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/07/18/6 - http://lists.opensuse.org/opensuse-updates/2016-08/msg00084.html - http://www.securityfocus.com/bid/91822 - https://www.tenable.com/security/tns-2017-04
CVE ID: CVE-2016-1000105 State: REJECTED Published: 2020-01-31T21:38:27 Last Updated: 2020-01-31T21:38:27 Description: No description available.
CVE ID: CVE-2016-1000106 State: REJECTED Published: 2016-10-06T14:00:00 Last Updated: 2016-10-06T13:57:01 Description: No description available.
CVE ID: CVE-2016-1000107 State: PUBLISHED Published: 2019-12-10T17:32:33 Last Updated: 2024-08-06T03:55:26.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Additional Analyst Notes: - CVE Program Container: References: - https://httpoxy.org/ - https://security-tracker.debian.org/tracker/CVE-2016-1
es: - CVE Program Container: References: - https://httpoxy.org/ - https://security-tracker.debian.org/tracker/CVE-2016-1000107 - http://www.openwall.com/lists/oss-security/2016/07/18/6 - https://bugs.erlang.org/browse/ERL-198
CVE ID: CVE-2016-1000108 State: PUBLISHED Published: 2019-12-10T14:58:52 Last Updated: 2024-08-06T03:55:26.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessf
Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000108.json - http://www.openwall.com/lists/oss-security/2016/07/18/6 - https://security-tracker.debian.org/tracker/CVE-2016-1000108 - https://github.com/klacke/yaws/commit/9d8fb070e782c95821c90d0ca7372fc6d7316c78#diff-54053c47eb173a90c26ed19bd9d106c1
CVE ID: CVE-2016-1000109 State: PUBLISHED Published: 2020-02-19T12:38:56 Last Updated: 2024-08-06T03:55:26.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0
ffects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive). Additional Analyst Notes: - CVE Program Container: References: - https://httpoxy.org/ - https://github.com/facebook/hhvm/commit/423b4b719afd5ef4e6e19d8447fbf7b6bc0d0a25 - https://www.facebook.com/security/advisories/cve-2016-1000109