Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-9353 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.393Z Vendors: n/a Products: Advantech SUSIAccess Server 3.0 and prior Problem Types: Advantech SUSIAccess Server static key hard-coded Description: An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The admin password is stored in the system and is encrypted with a static key hard-coded in the program. Attackers could reverse the admin account password for use. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-04 - http://www.securityfocus.com/bid/94631
CVE ID: CVE-2016-9354 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.951Z Vendors: n/a Products: Moxa DACenter 1.4 and older Problem Types: Moxa DACenter Uncontrolled Resource Consumption Description: An issue was discovered in Moxa DACenter Versions 1.4 and older. A specially crafted project file may cause the program to crash because of Uncontrolled Resource Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-02 - http://www.securityfocus.com/bid/94891
CVE ID: CVE-2016-9355 State: PUBLISHED Published: 2017-02-13T22:00:00 Last Updated: 2024-08-06T02:50:38.130Z Vendors: n/a Products: BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities Problem Types: BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities Description: An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthorized user with physical access to an Alaris 8015 PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash me
edentials and other sensitive technical data by disassembling an Alaris 8015 PC unit and accessing the device's flash memory. Older software versions of the Alaris 8015 PC unit, Version 9.5 and prior versions, store wireless network authentication credentials and other sensitive technical data on the affected device's removable flash memory. Being able to remove the flash memory from the affected device reduces the risk of detection, allowing an attacker to extract stored data at the attacker's convenience. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96116 - https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02
CVE ID: CVE-2016-9356 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:38.151Z Vendors: n/a Products: Moxa DACenter 1.4 and older Problem Types: Moxa DACenter unquoted search path Description: An issue was discovered in Moxa DACenter Versions 1.4 and older. The application may suffer from an unquoted search path issue. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-348-02 - http://www.securityfocus.com/bid/94891
CVE ID: CVE-2016-9357 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.953Z Vendors: n/a Products: Eaton ePDU EoL devices Problem Types: Eaton ePDU Path Traversal Vulnerability Description: An issue was discovered in certain legacy Eaton ePDUs -- the affected products are past end-of-life (EoL) and no longer supported: EAMxxx prior to June 30, 2015, EMAxxx prior to January 31, 2014, EAMAxx prior to January 31, 2014, EMAAxx prior to January 31, 2014, and ESWAxx prior to January 31, 2014. An unauthenticated attacker may be able to access configuration files with a specially crafted URL (Path Traversal). Additional Analyst Notes: - CVE Program Container: Referen
guration files with a specially crafted URL (Path Traversal). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95817 - https://ics-cert.us-cert.gov/advisories/ICSA-17-026-01
CVE ID: CVE-2016-9358 State: PUBLISHED Published: 2017-06-30T02:35:00 Last Updated: 2024-08-06T02:50:37.794Z Vendors: n/a Products: Marel Food Processing Systems Problem Types: CWE-259 Description: A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A325, A371, A520 Master, A520 Slave, A530, A542, A571, Check Bin Grader, FlowlineQC T376, IPM3 Dual Cam v132, IPM3 Dual Cam v139, IPM3 Single Cam v132, P520, P574, SensorX13 QC flow line, SensorX23 QC Master, SensorX23 QC Slave, Speed Batcher, T374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above;
374, T377, V36, V36B, and V36C; M3210 terminal associated with the same systems as the M3000 terminal identified above; M3000 desktop software associated with the same systems as the M3000 terminal identified above; MAC4 controller associated with the same systems as the M3000 terminal identified above; SensorX23 X-ray machine; SensorX25 X-ray machine; and MWS2 weighing system. The end user does not have the ability to change system passwords. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97388 - https://ics-cert.us-cert.gov/advisories/ICSA-17-094-02
CVE ID: CVE-2016-9359 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9360 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.954Z Vendors: n/a Products: GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian Problem Types: GE Proficy HMI/SCADA iFIX, Proficy HMI/SCADA CIMPLICITY, and Proficy Historian retrieve user passwords Description: An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has access to an authenticated session. Additional Analyst Notes: -
may be able to retrieve user passwords if he or she has access to an authenticated session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037809 - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-05A - http://www.securityfocus.com/bid/95630
CVE ID: CVE-2016-9361 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.128Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device password retrieval Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT
r to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Administration passwords can be retried without authenticating. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9362 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.723Z Vendors: n/a Products: WAGO Ethernet cards Problem Types: WAGO Ethernet Web-based Management Authentication Bypass Vulnerability Description: An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95074 - https://ics-cert.us-cert
Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95074 - https://ics-cert.us-cert.gov/advisories/ICSA-16-357-02
CVE ID: CVE-2016-9363 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.048Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Buffer overflow Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series ver
NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Buffer overflow vulnerability may allow an unauthenticated attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9364 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.831Z Vendors: n/a Products: Fidelix FX-20 Series Controllers prior to 11.50.19 Problem Types: Fidelix FX-20 Series Controllers Path Traversal Vulnerability Description: An issue was discovered in Fidelix FX-20 series controllers, versions prior to 11.50.19. Arbitrary file reading via path traversal allows an attacker to access arbitrary files and directories on the server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95073 - https://ics-cert.us-cert.gov/advisories/ICSA-16-357-01
CVE ID: CVE-2016-9365 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.954Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device csrf Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series version
t 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Requests are not verified to be intentionally submitted by the proper user (CROSS-SITE REQUEST FORGERY). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9366 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.976Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device brute force Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series
2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. An attacker can freely use brute force to determine parameters needed to bypass authentication. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9367 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:38.184Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device DoS Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions
5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. The amount of resources requested by a malicious actor is not restricted, leading to a denial-of-service caused by resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9368 State: PUBLISHED Published: 2017-03-14T09:02:00 Last Updated: 2024-08-06T02:50:37.641Z Vendors: n/a Products: Eaton xComfort Ethernet Communication Interface Problem Types: CWE-284 Description: An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access files without authenticating. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-17-061-01
CVE ID: CVE-2016-9369 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:36.981Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device firmware spoof Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Seri
1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Firmware can be updated over the network without authentication, which may allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9370 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-9371 State: PUBLISHED Published: 2017-02-13T21:00:00 Last Updated: 2024-08-06T02:50:37.054Z Vendors: n/a Products: Moxa NPort Problem Types: Moxa NPort Device XSS Description: An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions
5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. User-controlled input is not neutralized before being output to web page (CROSS-SITE SCRIPTING). Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02 - http://www.securityfocus.com/bid/85965
CVE ID: CVE-2016-9372 State: PUBLISHED Published: 2016-11-17T05:48:00 Last Updated: 2024-08-06T02:50:37.517Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.1, the Profinet I/O dissector could loop excessively, triggered by network traffic or a capture file. This was addressed in plugins/profinet/packet-pn-rtc-one.c by rejecting input with too many I/O objects. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037313 - https://www.wireshark.org/security/wnpa-sec-2016-58.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4127e3930ef663114567002001f44e01eba8a250 - http://www.secur
e.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=4127e3930ef663114567002001f44e01eba8a250 - http://www.securityfocus.com/bid/94368 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12851
CVE ID: CVE-2016-9373 State: PUBLISHED Published: 2016-11-17T05:48:00 Last Updated: 2024-08-06T02:50:37.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DCERPC dissector could crash with a use-after-free, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dcerpc-nt.c and epan/dissectors/packet-dcerpc-spoolss.c by using the wmem file scope for private strings. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037313 - https://www.wireshark.org/security/wnpa-sec-2016-61.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=
https://www.wireshark.org/security/wnpa-sec-2016-61.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=cc8e37f0f53c4401bb1644a34eddea345940a8df - http://www.debian.org/security/2016/dsa-3719 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13072 - http://www.securityfocus.com/bid/94369
CVE ID: CVE-2016-9374 State: PUBLISHED Published: 2016-11-17T05:48:00 Last Updated: 2024-08-06T02:50:37.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the AllJoyn dissector could crash with a buffer over-read, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-alljoyn.c by ensuring that a length variable properly tracked the state of a signature variable. Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2016-59.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a5770b6559b6e6765c4ef800e85ae42781ea490
9.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=a5770b6559b6e6765c4ef800e85ae42781ea4900 - http://www.securitytracker.com/id/1037313 - http://www.debian.org/security/2016/dsa-3719 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12953 - http://www.securityfocus.com/bid/94369
CVE ID: CVE-2016-9375 State: PUBLISHED Published: 2016-11-17T05:48:00 Last Updated: 2024-08-06T02:50:37.795Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=be6a10afc59f8182b9884d02f9857d547539fe8a - http://www.securitytracker.com/id/1037313 - https://www.wireshark.org/security/wnpa-sec-2016-62.html -
857d547539fe8a - http://www.securitytracker.com/id/1037313 - https://www.wireshark.org/security/wnpa-sec-2016-62.html - http://www.debian.org/security/2016/dsa-3719 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13097 - http://www.securityfocus.com/bid/94369
CVE ID: CVE-2016-9376 State: PUBLISHED Published: 2016-11-17T05:48:00 Last Updated: 2024-08-06T02:50:37.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c by ensuring that certain length values were sufficiently large. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1037313 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13071 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f2a7af8d3928e
g/bugzilla/show_bug.cgi?id=13071 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=f2a7af8d3928e18ef15778e63b9b6c78f8bd1bef - https://www.wireshark.org/security/wnpa-sec-2016-60.html - http://www.debian.org/security/2016/dsa-3719 - http://www.securityfocus.com/bid/94369
CVE ID: CVE-2016-9377 State: PUBLISHED Published: 2017-02-22T16:00:00 Last Updated: 2024-08-06T02:50:37.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201612-56 - http://www.securityfocus.com/bid/94475 - http://xenbits.xen.org/xsa/advisory-196.html - http://www.securitytracker.com/id/1037345
CVE ID: CVE-2016-9378 State: PUBLISHED Published: 2017-02-22T16:00:00 Last Updated: 2024-08-06T02:50:37.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201612-56 - http://www.securityfocus.com/bid/94475 - http://xenbits.xen.org/xsa/advisory-196.html - http://www.securitytracker.com/id/1037345
CVE ID: CVE-2016-9379 State: PUBLISHED Published: 2017-01-23T21:00:00 Last Updated: 2024-08-06T02:50:37.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/xsa198.patch - http://www.securityfocus.com/bid/94473 - https://security.gentoo.org/glsa/201612-56 - http://xenbits.xen.org/xsa/advisory-198.html - http://www.securitytracker.com/id/10
security.gentoo.org/glsa/201612-56 - http://xenbits.xen.org/xsa/advisory-198.html - http://www.securitytracker.com/id/1037347 - https://support.citrix.com/article/CTX218775