deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5620
Published: 2016-10-25
Description: Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to INFRA, a different vulnerability than CVE-2016-5619.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93649; http://www.securitytracker.com/id/1037049
CVE: CVE-2016-5621
Published: 2016-10-25
Description: Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 and 12.0.3, 12.1.0, and 12.2.0 allows remote authenticated users to affect confidentiality via vectors related to INFRA, a different vulnerability than CVE-2016-5603.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93633; http://www.securitytracker.com/id/1037049
CVE: CVE-2016-5622
Published: 2016-10-25
Description: Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3, 12.1.0, and 12.2.0 allows remote attackers to affect confidentiality and integrity via vectors related to INFRA.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93666; http://www.securitytracker.com/id/1037049
CVE: CVE-2016-5624
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-2130.html; http://rhn.redhat.com/errata/RHSA-2016-2131.html; http://rhn.redhat.com/errata/RHSA-2016-2595.html
CVE: CVE-2016-5625
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Packaging.
CVSS Score: 7.0 (HIGH)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93617; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5626
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-2130.html; http://rhn.redhat.com/errata/RHSA-2016-2131.html; http://rhn.redhat.com/errata/RHSA-2016-2595.html
CVE: CVE-2016-5627
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB.
CVSS Score: 6.5 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-1601.html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93642
CVE: CVE-2016-5628
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93662; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5629
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated.
CVSS Score: 4.9 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-2130.html; http://rhn.redhat.com/errata/RHSA-2016-2131.html; http://rhn.redhat.com/errata/RHSA-2016-2595.html
CVE: CVE-2016-5630
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB.
CVSS Score: 4.9 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-1601.html; http://rhn.redhat.com/errata/RHSA-2016-2927.html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2016-5631
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93684; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5632
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93693; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5633
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93702; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5634
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93709; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-5635
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93715; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-8281
Published: 2016-10-25
Description: Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-5536.
CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93771; http://www.securitytracker.com/id/1037051
CVE: CVE-2016-8283
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.
CVSS Score: 4.3 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2016-2130.html; http://rhn.redhat.com/errata/RHSA-2016-2131.html; http://rhn.redhat.com/errata/RHSA-2016-2595.html
CVE: CVE-2016-8284
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.
CVSS Score: 1.8 (LOW)
References: http://rhn.redhat.com/errata/RHSA-2016-1601.html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93755
CVE: CVE-2016-8285
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality and integrity via vectors related to Candidate Gateway.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93723; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8286
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93745; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-8287
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.
CVSS Score: 4.5 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93727; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-8288
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.
CVSS Score: 3.1 (LOW)
CWE: CWE-284
References: http://rhn.redhat.com/errata/RHSA-2016-1601.html; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93740
CVE: CVE-2016-8289
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93720; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-8290
Published: 2016-10-25
Description: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633.
CVSS Score: 4.4 (MEDIUM)
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93733; http://www.securitytracker.com/id/1037050
CVE: CVE-2016-8291
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Application Platform.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93716; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8292
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition Manager.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93732; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8293
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5529 and CVE-2016-5530.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93726; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8294
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93695; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8295
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93712; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8296
Published: 2016-10-25
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to LDAP.
CVSS Score: 7.6 (HIGH)
CWE: CWE-284
References: http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/93691; http://www.securitytracker.com/id/1037046
CVE: CVE-2016-8338
Published: 2016-10-26
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-5314.  Reason: This candidate is a reservation duplicate of CVE-2016-5314.  Notes: All CVE users should reference CVE-2016-5314 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2016-8501
Published: 2016-10-26
Description: Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of special security mechanism is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/93920; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93920
CVE: CVE-2016-8502
Published: 2016-10-26
Description: Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
CVSS Score: 7.3 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/93923; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93923
CVE: CVE-2016-8503
Published: 2016-10-26
Description: Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from important web-resource with special JavaScript.
CVSS Score: 7.3 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/93921; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93921
CVE: CVE-2016-8504
Published: 2016-10-26
Description: CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/93924; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93924
CVE: CVE-2016-8505
Published: 2016-10-26
Description: XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93925; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93925
CVE: CVE-2016-8506
Published: 2016-10-26
Description: XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93927; https://browser.yandex.com/security/changelogs/; http://www.securityfocus.com/bid/93927
CVE: CVE-2015-0787
Published: 2016-10-27
Description: XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93972; https://download.novell.com/Download?buildid=QgHXVOxv310~; http://www.securityfocus.com/bid/93972
CVE: CVE-2016-1592
Published: 2016-10-27
Description: XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93973; https://download.novell.com/Download?buildid=QgHXVOxv310~; http://www.securityfocus.com/bid/93973
CVE: CVE-2016-1598
Published: 2016-10-27
Description: XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93833; https://download.novell.com/Download?buildid=xyswDCMsT7I~; http://www.securityfocus.com/bid/93833
CVE: CVE-2016-5764
Published: 2016-10-27
Description: Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668). This can only occur if a client connects to a malicious server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28731.rumba-ftp-4-x-security-update.aspx; http://www.securityfocus.com/bid/93974; https://www.exploit-db.com/exploits/40651/
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-27
Description: SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog; http://www.securityfocus.com/bid/92185; http://www.vapidlabs.com/advisory.php?v=167
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-27
Description: XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://extensions.joomla.org/extensions/extension/photos-a-images/slider; http://www.securityfocus.com/bid/92160; http://www.vapidlabs.com/advisory.php?v=168
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-27
Description: XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://extensions.joomla.org/extensions/extension/photos-a-images/slider; http://www.securityfocus.com/bid/92160; http://www.vapidlabs.com/advisory.php?v=168
CVE: CVE-2016-6431
Published: 2016-10-27
Description: A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before 9.6(1.5) could allow an unauthenticated, remote attacker to cause a reload of the affected system. The vulnerability is due to improper handling of crafted packets during the enrollment operation. An attacker could exploit this vulnerability by sending a crafted enrollment request to the affected system. An exploit could allow the attacker to cause the reload of the affected system. Note: Only HTTPS packets directed to the Cisco ASA interface, where the local CA is allowing user enrollment, can be used to trigger this vulnerability. This vulnerability affects systems configured in routed firewall mode and in single or multiple context mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-ca; http://www.securityfocus.com/bid/93786; http://www.securitytracker.com/id/1037060
CVE: CVE-2016-6432
Published: 2016-10-27
Description: A vulnerability in the Identity Firewall feature of Cisco ASA Software before 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to a buffer overflow in the affected code area. An attacker could exploit this vulnerability by sending a crafted NetBIOS packet in response to a NetBIOS probe sent by the ASA software. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the affected system. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed and transparent firewall mode and in single or multiple context mode. This vulnerability can be triggered by IPv4 traffic.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93784; http://www.securitytracker.com/id/1037059; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-asa-idfw
CVE: CVE-2016-6437
Published: 2016-10-27
Description: A vulnerability in the SSL session cache management of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high consumption of disk space. The user would see a performance degradation. More Information: CSCva03095. Known Affected Releases: 5.3(5), 6.1(1), 6.2(1). Known Fixed Releases: 5.3(5g)1, 6.2(2.32).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://www.securityfocus.com/bid/93524; http://www.securitytracker.com/id/1037002; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-waas
CVE: CVE-2016-6438
Published: 2016-10-27
Description: A vulnerability in Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause a configuration integrity change to the vty line configuration on an affected device. This vulnerability affects the following releases of Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers: All 3.16S releases, All 3.17S releases, Release 3.18.0S, Release 3.18.1S, Release 3.18.0SP. More Information: CSCuz62815. Known Affected Releases: 15.5(3)S2.9, 15.6(2)SP. Known Fixed Releases: 15.6(1.7)SP1, 16.4(0.183), 16.5(0.1).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/93518; http://www.securitytracker.com/id/1037003; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-cbr-8
CVE: CVE-2016-6439
Published: 2016-10-27
Description: A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software before 6.0.1 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper handling of an HTTP packet stream. An attacker could exploit this vulnerability by sending a crafted HTTP packet stream to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/93787; http://www.securitytracker.com/id/1037061; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161019-fpsnort