deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3304
Published: 2016-08-09
Description: The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Windows Graphics Component RCE Vulnerability," a different vulnerability than CVE-2016-3303.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/92302; http://www.securitytracker.com/id/1036564; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-097
CVE: CVE-2016-3308
Published: 2016-08-09
Description: The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3309, CVE-2016-3310, and CVE-2016-3311.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92295; http://www.securitytracker.com/id/1036572; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098
CVE: CVE-2016-3309
Published: 2016-08-09
Description: The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/92297; http://www.securitytracker.com/id/1036572; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098
CVE: CVE-2016-3310
Published: 2016-08-09
Description: The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3309, and CVE-2016-3311.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92298; http://www.securitytracker.com/id/1036572; https://blog.fortinet.com/2016/08/17/root-cause-analysis-of-windows-kernel-uaf-vulnerability-lead-to-cve-2016-3310
CVE: CVE-2016-3311
Published: 2016-08-09
Description: The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3309, and CVE-2016-3310.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/92299; http://www.securitytracker.com/id/1036572; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-098
CVE: CVE-2016-3312
Published: 2016-08-09
Description: ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging failure of Universal Outlook to obtain a secure connection, aka "Universal Outlook Information Disclosure Vulnerability."
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92307; http://www.securitytracker.com/id/1036577; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-103
CVE: CVE-2016-3313
Published: 2016-08-09
Description: Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92289; http://www.securitytracker.com/id/1036559; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-099
CVE: CVE-2016-3315
Published: 2016-08-09
Description: Microsoft OneNote 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to obtain sensitive information via a crafted OneNote file, aka "Microsoft OneNote Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92294; http://www.securitytracker.com/id/1036559; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-099
CVE: CVE-2016-3316
Published: 2016-08-09
Description: Microsoft Word 2013 SP1, 2013 RT SP1, 2016, and 2016 for Mac allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92300; http://www.securitytracker.com/id/1036559; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-099
CVE: CVE-2016-3317
Published: 2016-08-09
Description: Microsoft Office 2010 SP2, Word 2007 SP3, Word 2010 SP2, Word for Mac 2011, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92303; http://www.securitytracker.com/id/1036559; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-099
CVE: CVE-2016-3318
Published: 2016-08-09
Description: Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted file, aka "Graphics Component Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92308; http://www.securitytracker.com/id/1036559; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-099
CVE: CVE-2016-3319
Published: 2016-08-09
Description: The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allows remote attackers to execute arbitrary code via a crafted PDF file, aka "Microsoft PDF Remote Code Execution Vulnerability."
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/92293; http://www.securitytracker.com/id/1036561; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-096
CVE: CVE-2016-3320
Published: 2016-08-09
Description: Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow attackers to bypass the Secure Boot protection mechanism by leveraging (1) administrative or (2) physical access to install a crafted boot manager, aka "Secure Boot Security Feature Bypass."
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/92304; http://www.securitytracker.com/id/1036573; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-100
CVE: CVE-2016-3321
Published: 2016-08-09
Description: Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2016/Aug/44; http://www.securityfocus.com/archive/1/539174/100/0/threaded; http://www.securityfocus.com/bid/92291
CVE: CVE-2016-3322
Published: 2016-08-09
Description: Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3289.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/92282; http://www.securitytracker.com/id/1036562; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-095
CVE: CVE-2016-3326
Published: 2016-08-09
Description: Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3327.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92287; http://www.securitytracker.com/id/1036562; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-095
CVE: CVE-2016-3327
Published: 2016-08-09
Description: Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to obtain sensitive information via a crafted web page, aka "Microsoft Browser Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3326.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92284; http://www.securitytracker.com/id/1036562; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-095
CVE: CVE-2016-3329
Published: 2016-08-09
Description: Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to determine the existence of files via a crafted webpage, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/92286; http://www.securitytracker.com/id/1036562; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-095
CVE: CVE-2013-7458
Published: 2016-08-10
Description: linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00029.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00030.html; http://www.debian.org/security/2016/dsa-3634
CVE: CVE-2016-5408
Published: 2016-08-10
Description: Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1573.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2[PII_REDACTED].html; http://rhn.redhat.com/errata/RHSA-2016-1573.html
CVE: CVE-2016-5419
Published: 2016-08-10
Description: curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html; http://rhn.redhat.com/errata/RHSA-2016-2575.html
CVE: CVE-2016-5420
Published: 2016-08-10
Description: curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-285
References: http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html; http://rhn.redhat.com/errata/RHSA-2016-2575.html
CVE: CVE-2016-5421
Published: 2016-08-10
Description: Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html; http://www.debian.org/security/2016/dsa-3638
CVE: CVE-2016-6597
Published: 2016-08-10
Description: Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-254
References: http://packetstormsecurity.com/files/138210/Sophos-Mobile-Control-3.5.0.3-Open-Reverse-Proxy.html; http://www.securityfocus.com/archive/1/539126/100/0/threaded; http://www.securityfocus.com/bid/92351
CVE: CVE-2016-6132
Published: 2016-08-12
Description: The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://www.debian.org/security/2016/dsa-3619
CVE: CVE-2016-6161
Published: 2016-08-12
Description: The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://www.debian.org/security/2016/dsa-3619
CVE: CVE-2016-6207
Published: 2016-08-12
Description: Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://packetstormsecurity.com/files/138174/LibGD-2.2.2-Integer-Overflow-Denial-Of-Service.html
CVE: CVE-2016-6214
Published: 2016-08-12
Description: gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2016-08/msg00086.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00078.html; http://www.debian.org/security/2016/dsa-3619
CVE: CVE-2016-5384
Published: 2016-08-13
Description: fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: http://rhn.redhat.com/errata/RHSA-2016-2601.html; http://www.debian.org/security/2016/dsa-3644; http://www.securityfocus.com/bid/92339
CVE: CVE-2016-5845
Published: 2016-08-13
Description: SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file, aka SAP Security Note 2312905.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/138284/SAP-CAR-Archive-Tool-Denial-Of-Service-Security-Bypass.html; http://seclists.org/fulldisclosure/2016/Aug/46; http://www.securityfocus.com/archive/1/539180/100/0/threaded
CVE: CVE-2016-5847
Published: 2016-08-13
Description: SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted from an archive, possibly related to SAP Security Note 2327384.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://packetstormsecurity.com/files/138284/SAP-CAR-Archive-Tool-Denial-Of-Service-Security-Bypass.html; http://seclists.org/fulldisclosure/2016/Aug/46; http://www.securityfocus.com/archive/1/539180/100/0/threaded
CVE: CVE-2016-6366
Published: 2016-08-18
Description: Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: http://blogs.cisco.com/security/shadow-brokers; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp; http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
CVE: CVE-2016-6367
Published: 2016-08-18
Description: Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://blogs.cisco.com/security/shadow-brokers; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli; http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516
CVE: CVE-2016-1365
Published: 2016-08-18
Description: The Grapevine update process in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0 allows remote authenticated users to execute arbitrary commands as root via a crafted upgrade parameter, aka Bug ID CSCux15507.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-apic; http://www.securityfocus.com/bid/92507; http://www.securitytracker.com/id/1036634
CVE: CVE-2016-1457
Published: 2016-08-18
Description: The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.1.2 and 5.4.x before 5.4.0.1 allows remote authenticated users to execute arbitrary commands as root via crafted HTTP requests, aka Bug ID CSCur25513.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-fmc; http://www.securityfocus.com/bid/92509; http://www.securitytracker.com/id/1036642
CVE: CVE-2016-1458
Published: 2016-08-18
Description: The web-based GUI in Cisco Firepower Management Center 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 and Cisco Adaptive Security Appliance (ASA) Software on 5500-X devices with FirePOWER Services 4.x and 5.x before 5.3.0.3, 5.3.1.x before 5.3.1.2, and 5.4.x before 5.4.0.1 allows remote authenticated users to increase user-account privileges via crafted HTTP requests, aka Bug ID CSCur25483.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepower; http://www.securityfocus.com/bid/92512; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-firepower
CVE: CVE-2016-4654
Published: 2016-08-18
Description: IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-264
References: http://www.securityfocus.com/bid/92338; http://www.securitytracker.com/id/1036546; https://support.apple.com/HT207026
CVE: CVE-2014-9906
Published: 2016-08-19
Description: Use-after-free vulnerability in DBD::mysql before 4.029 allows attackers to cause a denial of service (program crash) or possibly execute arbitrary code via vectors related to a lost server connection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://cpansearch.perl.org/src/CAPTTOFU/DBD-mysql-4.029/ChangeLog; http://www.debian.org/security/2016/dsa-3635; http://www.openwall.com/lists/oss-security/2016/07/27/5
CVE: CVE-2015-8022
Published: 2016-08-19
Description: The Configuration utility in F5 BIG-IP LTM, Analytics, APM, ASM, GTM, and Link Controller 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AAM 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP AFM and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.1; BIG-IP Edge Gateway, WebAccelerator, and WOM 11.x before 11.2.1 HF16 and 11.3.0; and BIG-IP PSM 11.x before 11.2.1 HF16, 11.3.x, and 11.4.x before 11.4.1 HF10 allows remote authenticated users with certain permissions to gain privileges by leveraging an Access Policy Manager customization configuration section that allows file uploads.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036627; https://support.f5.com/kb/en-us/solutions/public/k/12/sol12401251.html; http://www.securitytracker.com/id/1036627
CVE: CVE-2015-8949
Published: 2016-08-19
Description: Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.debian.org/security/2016/dsa-3635; http://www.openwall.com/lists/oss-security/2016/07/25/13; http://www.openwall.com/lists/oss-security/2016/07/27/1
CVE: CVE-2016-0760
Published: 2016-08-19
Description: Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://mail-archives.apache.org/mod_mbox/sentry-dev/201608.mbox/%3CCACMN7ixDqDyOZGLEvsMUVHBiJ6crq8zdy%2B2mNfRooNhnk7CJ1g%40mail.gmail.com%3E; http://www.securityfocus.com/bid/92328; http://mail-archives.apache.org/mod_mbox/sentry-dev/201608.mbox/%3CCACMN7ixDqDyOZGLEvsMUVHBiJ6crq8zdy%2B2mNfRooNhnk7CJ1g%40mail.gmail.com%3E
CVE: CVE-2016-3089
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://openmeetings.apache.org/security.html; http://packetstormsecurity.com/files/138313/Apache-OpenMeetings-3.1.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/539192/100/0/threaded
CVE: CVE-2016-3193
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1; http://www.securityfocus.com/bid/92458; http://www.securitytracker.com/id/1036550
CVE: CVE-2016-3194
Published: 2016-08-19
Description: Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability; http://www.securityfocus.com/bid/92456; http://www.securitytracker.com/id/1036550