deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4119
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://blog.fortinet.com/2016/06/06/analysis-of-use-after-free-vulnerability-cve-2016-4119-in-adobe-acrobat-and-reader; https://helpx.adobe.com/security/products/acrobat/apsb16-14.html; https://blog.fortinet.com/2016/06/06/analysis-of-use-after-free-vulnerability-cve-2016-4119-in-adobe-acrobat-and-reader
CVE: CVE-2016-4265
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4266, CVE-2016-4267, CVE-2016-4268, CVE-2016-4269, and CVE-2016-4270.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92640; http://www.zerodayinitiative.com/advisories/ZDI-16-488; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4266
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4265, CVE-2016-4267, CVE-2016-4268, CVE-2016-4269, and CVE-2016-4270.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92636; http://www.zerodayinitiative.com/advisories/ZDI-16-489; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4267
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4265, CVE-2016-4266, CVE-2016-4268, CVE-2016-4269, and CVE-2016-4270.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92637; http://www.zerodayinitiative.com/advisories/ZDI-16-490; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4268
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4265, CVE-2016-4266, CVE-2016-4267, CVE-2016-4269, and CVE-2016-4270.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92643; http://www.zerodayinitiative.com/advisories/ZDI-16-492; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4269
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4265, CVE-2016-4266, CVE-2016-4267, CVE-2016-4268, and CVE-2016-4270.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92641; http://www.zerodayinitiative.com/advisories/ZDI-16-491; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4270
Published: 2016-08-26
Description: Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4191, CVE-2016-4192, CVE-2016-4193, CVE-2016-4194, CVE-2016-4195, CVE-2016-4196, CVE-2016-4197, CVE-2016-4198, CVE-2016-4199, CVE-2016-4200, CVE-2016-4201, CVE-2016-4202, CVE-2016-4203, CVE-2016-4204, CVE-2016-4205, CVE-2016-4206, CVE-2016-4207, CVE-2016-4208, CVE-2016-4211, CVE-2016-4212, CVE-2016-4213, CVE-2016-4214, CVE-2016-4250, CVE-2016-4251, CVE-2016-4252, CVE-2016-4254, CVE-2016-4265, CVE-2016-4266, CVE-2016-4267, CVE-2016-4268, and CVE-2016-4269.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92635; http://www.zerodayinitiative.com/advisories/ZDI-16-493; https://helpx.adobe.com/security/products/acrobat/apsb16-26.html
CVE: CVE-2016-4378
Published: 2016-08-26
Description: The (1) Device Manager, (2) Tiered Storage Manager, (3) Replication Manager, (4) Replication Monitor, and (5) Hitachi Automation Director (HAD) components in HPE XP P9000 Command View Advanced Edition Software before 8.4.1-00 and XP7 Command View Advanced Edition Suite before 8.4.1-00 allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92649; http://www.securitytracker.com/id/1036686; https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05241355
CVE: CVE-2016-5048
Published: 2016-08-26
Description: SQL injection vulnerability in chat/staff/default.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary SQL commands via the user name field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/294272; http://www.securityfocus.com/bid/92487; http://www.kb.cert.org/vuls/id/294272
CVE: CVE-2016-5049
Published: 2016-08-26
Description: Directory traversal vulnerability in chat/openattach.aspx in ReadyDesk 9.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the SESID parameter in conjunction with a filename in the FNAME parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/294272; http://www.securityfocus.com/bid/92487; http://www.kb.cert.org/vuls/id/294272
CVE: CVE-2016-5050
Published: 2016-08-26
Description: Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.kb.cert.org/vuls/id/294272; http://www.securityfocus.com/bid/92487; http://www.kb.cert.org/vuls/id/294272
CVE: CVE-2016-5662
Published: 2016-08-26
Description: Accellion Kiteworks appliances before kw2016.03.00 use setuid-root permissions for /opt/bin/cli, which allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/305607; http://www.securityfocus.com/bid/92662; http://www.kb.cert.org/vuls/id/305607
CVE: CVE-2016-5663
Published: 2016-08-26
Description: Multiple cross-site scripting (XSS) vulnerabilities in oauth_callback.php on Accellion Kiteworks appliances before kw2016.03.00 allow remote attackers to inject arbitrary web script or HTML via the (1) code, (2) error, or (3) error_description parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/305607; http://www.securityfocus.com/bid/92662; http://www.kb.cert.org/vuls/id/305607
CVE: CVE-2016-5664
Published: 2016-08-26
Description: Directory traversal vulnerability on Accellion Kiteworks appliances before kw2016.03.00 allows remote attackers to read files via a crafted URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/305607; http://www.securityfocus.com/bid/92662; http://www.kb.cert.org/vuls/id/305607
CVE: CVE-2016-5683
Published: 2016-08-26
Description: ReadyDesk 9.1 allows local users to determine cleartext SQL Server credentials by reading the SQL_Config.aspx file and decrypting data with a hardcoded key in the ReadyDesk.dll file.
CVSS Score: 7.8 (HIGH)
References: http://www.kb.cert.org/vuls/id/294272; http://www.securityfocus.com/bid/92487; http://www.kb.cert.org/vuls/id/294272
CVE: CVE-2015-5399
Published: 2016-08-26
Description: Cross-site scripting (XSS) vulnerability in PHPVibe before 4.21 allows remote authenticated users to inject arbitrary web script or HTML via a comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/132715/phpVibe-Stored-Cross-Site-Scripting.html; https://www.exploit-db.com/exploits/37659; https://packetstormsecurity.com/files/132715/phpVibe-Stored-Cross-Site-Scripting.html
CVE: CVE-2016-5721
Published: 2016-08-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/92682; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories; http://www.securityfocus.com/bid/92682
CVE: CVE-2016-6339
Published: 2016-08-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-4993.  Reason: This candidate is a reservation duplicate of CVE-2016-4993.  Notes: All CVE users should reference CVE-2016-4993 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-0292
Published: 2016-08-30
Description: WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a report.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985907; http://www-01.ibm.com/support/docview.wss?uid=swg21985907
CVE: CVE-2016-0397
Published: 2016-08-30
Description: WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985907; http://www.securityfocus.com/bid/92467; http://www-01.ibm.com/support/docview.wss?uid=swg21985907
CVE: CVE-2016-5342
Published: 2016-08-30
Description: Heap-based buffer overflow in the wcnss_wlan_write function in drivers/net/wireless/wcnss/wcnss_wlan.c in the wcnss_wlan device driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service or possibly have unspecified other impact by writing to /dev/wcnss_wlan with an unexpected amount of data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/92693; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=579e796cb089324c55e0e689a180575ba81b23d9
CVE: CVE-2016-5344
Published: 2016-08-30
Description: Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/92695; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
CVE: CVE-2016-7115
Published: 2016-08-30
Description: Buffer overflow in the handle_packet function in mactelnet.c in the client in MAC-Telnet 0.4.3 and earlier allows remote TELNET servers to execute arbitrary code via a long string in an MT_CPTYPE_PASSSALT control packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92699; https://github.com/haakonnessjoen/MAC-Telnet/commit/b69d11727d4f0f8cf719c79e3fb700f55ca03e9a; https://github.com/haakonnessjoen/MAC-Telnet/pull/20
CVE: CVE-2016-6195
Published: 2016-08-30
Description: SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/92687; http://www.vbulletin.org/forum/showthread.php?t=322848; https://enumerated.wordpress.com/2016/07/11/1/
CVE: CVE-2016-5332
Published: 2016-08-31
Description: Directory traversal vulnerability in VMware vRealize Log Insight 2.x and 3.x before 3.6.0 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/92448; http://www.securitytracker.com/id/1036619; http://www.vmware.com/security/advisories/VMSA-2016-0011.html
CVE: CVE-2016-5333
Published: 2016-08-31
Description: VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/92474; http://www.securitytracker.com/id/1036628; http://www.theregister.co.uk/2016/08/16/vmware_shipped_public_key_with_its_photon_osforcontainers/
CVE: CVE-2016-5335
Published: 2016-08-31
Description: VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/92608; http://www.securitytracker.com/id/1036685; http://www.vmware.com/security/advisories/VMSA-2016-0013.html
CVE: CVE-2016-5336
Published: 2016-08-31
Description: VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://www.securityfocus.com/bid/92607; http://www.securitytracker.com/id/1036685; http://www.vmware.com/security/advisories/VMSA-2016-0013.html
CVE: CVE-2016-6895
Published: 2016-08-31
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-5333.  Reason: This candidate is a reservation duplicate of CVE-2016-5333.  Notes: All CVE users should reference CVE-2016-5333 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-7118
Published: 2016-08-31
Description: fs/fcntl.c in the "aufs 3.2.x+setfl-debian" patch in the linux-image package 3.2.0-4 (kernel 3.2.81-1) in Debian wheezy mishandles F_SETFL fcntl calls on directories, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via standard filesystem operations, as demonstrated by scp from an AUFS filesystem.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://seclists.org/oss-sec/2016/q3/395; http://www.openwall.com/lists/oss-security/2016/08/31/3; http://www.securityfocus.com/bid/92697
CVE: CVE-2016-7119
Published: 2016-08-31
Description: Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN) before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.dnnsoftware.com/community/security/security-center; http://www.securityfocus.com/bid/92719; http://www.dnnsoftware.com/community/security/security-center
CVE: CVE-2016-5674
Published: 2016-08-31
Description: __debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5675
Published: 2016-08-31
Description: handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5676
Published: 2016-08-31
Description: cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5677
Published: 2016-08-31
Description: NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an __nvr_status___.php request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5678
Published: 2016-08-31
Description: NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5679
Published: 2016-08-31
Description: cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-5680
Published: 2016-08-31
Description: Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.kb.cert.org/vuls/id/856152; http://www.securityfocus.com/bid/92318; https://www.exploit-db.com/exploits/40200/
CVE: CVE-2016-2183
Published: 2016-09-01
Description: The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759; http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html
CVE: CVE-2016-0293
Published: 2016-09-01
Description: Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985743; http://www.securityfocus.com/bid/92593; http://www-01.ibm.com/support/docview.wss?uid=swg21985743
CVE: CVE-2016-0370
Published: 2016-09-01
Description: Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
CVSS Score: 2.7 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO88449; http://www-01.ibm.com/support/docview.wss?uid=swg1LO88451; http://www-01.ibm.com/support/docview.wss?uid=swg21988726
CVE: CVE-2016-3064
Published: 2016-09-01
Description: NetApp Clustered Data ONTAP before 8.2.4P4 and 8.3.x before 8.3.2P2 allows remote authenticated users to obtain sensitive cluster and tenant information via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://kb.netapp.com/support/index?page=content&id=9010099; http://www.securityfocus.com/bid/92686; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/