deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-0769
Published: 2017-01-23
Description: Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/02/02/3; http://www.securityfocus.com/bid/82347; http://www.vapid.dhs.org/advisory.php?v=160
CVE: CVE-2016-1281
Published: 2017-01-23
Description: Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application directory", as demonstrated with the USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll DLLs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://seclists.org/fulldisclosure/2016/Jan/22; http://www.openwall.com/lists/oss-security/2016/01/11/1; http://seclists.org/fulldisclosure/2016/Jan/22
CVE: CVE-2016-1417
Published: 2017-01-23
Description: Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tcapi.dll that is located in the same folder on a remote file share as a pcap file that is being processed.
CVSS Score: 8.8 (HIGH)
CWE: CWE-426
References: http://hyp3rlinx.altervista.org/advisories/SNORT-DLL-HIJACK.txt; http://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.html; http://www.securityfocus.com/archive/1/539579/100/0/threaded
CVE: CVE-2016-1925
Published: 2017-01-23
Description: Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or (2) level1 header in a lha archive, which triggers a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://www.openwall.com/lists/oss-security/2016/01/18/3; http://www.openwall.com/lists/oss-security/2016/01/18/8; https://security.gentoo.org/glsa/202007-42
CVE: CVE-2016-2242
Published: 2017-01-23
Description: Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/135721/Exponent-2.3.7-PHP-Code-Execution.html; http://www.exponentcms.org/news/patch-3-released-for-v2-3-7; http://www.exponentcms.org/news/show/title/security-notice-closing-an-exponent-security-vulnerability
CVE: CVE-2016-2783
Published: 2017-01-23
Description: Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I-SIS indexes, which allows remote attackers to obtain unauthorized access via crafted Ethernet frames.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.securityfocus.com/bid/92157; https://packetstormsecurity.com/files/138082/Avaya-VOSS-4.1.0.0-SPB-Traffic-Traversal.html; http://www.securityfocus.com/bid/92157
CVE: CVE-2016-3147
Published: 2017-01-23
Description: Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93565; https://www.securifera.com/advisories/cve-2016-3147/; http://www.securityfocus.com/bid/93565
CVE: CVE-2016-3177
Published: 2017-01-23
Description: Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415, CWE-416
References: http://www.openwall.com/lists/oss-security/2016/03/16/12; https://sourceforge.net/p/giflib/bugs/83/; http://www.openwall.com/lists/oss-security/2016/03/16/12
CVE: CVE-2016-4010
Published: 2017-01-23
Description: Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://netanelrub.in/2016/05/17/magento-unauthenticated-remote-code-execution/; https://magento.com/security/patches/magento-206-security-update; https://packetstormsecurity.com/files/137121/Magento-Unauthenticated-Arbitrary-File-Write.html
CVE: CVE-2016-4055
Published: 2017-01-23
Description: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2016/04/20/11; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html; http://www.securityfocus.com/bid/95849
CVE: CVE-2016-4056
Published: 2017-01-23
Description: Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2016/04/21/1; https://labs.integrity.pt/advisories/cve-pending-stored-cross-site-scripting-in-typo3-bookmarks/; https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-006/
CVE: CVE-2016-4338
Published: 2017-01-23
Description: The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/136898/Zabbix-Agent-3.0.1-mysql.size-Shell-Command-Injection.html; http://seclists.org/fulldisclosure/2016/May/9; http://www.securityfocus.com/archive/1/538258/100/0/threaded
CVE: CVE-2016-4340
Published: 2017-01-23
Description: The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to "log in" as any other user via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/138368/GitLab-Impersonate-Privilege-Escalation.html; https://about.gitlab.com/2016/05/02/cve-2016-4340-patches/; https://gitlab.com/gitlab-org/gitlab-ce/issues/15548
CVE: CVE-2016-4484
Published: 2017-01-23
Description: The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://hmarco.org/bugs/CVE-2016-4484/CVE-2016-4484_cryptsetup_initrd_shell.html; http://www.openwall.com/lists/oss-security/2016/11/14/13; http://www.openwall.com/lists/oss-security/2016/11/15/1
CVE: CVE-2016-4793
Published: 2017-01-23
Description: The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt; http://www.securityfocus.com/bid/95846; https://bakery.cakephp.org/2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
CVE: CVE-2016-5091
Published: 2017-01-23
Description: Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
CVSS Score: 8.1 (HIGH)
CWE: CWE-254
References: http://www.openwall.com/lists/oss-security/2016/05/25/4; http://www.openwall.com/lists/oss-security/2016/05/26/2; https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/
CVE: CVE-2016-5119
Published: 2017-01-23
Description: The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/; https://packetstormsecurity.com/files/137274/KeePass-2-Man-In-The-Middle.html; https://sourceforge.net/p/keepass/discussion/329220/thread/e430cc12/
CVE: CVE-2016-5237
Published: 2017-01-23
Description: Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-264
References: https://packetstormsecurity.com/files/137343/Valve-Steam-3.42.16.13-Local-Privilege-Escalation.html; https://www.exploit-db.com/exploits/39888/; https://packetstormsecurity.com/files/137343/Valve-Steam-3.42.16.13-Local-Privilege-Escalation.html
CVE: CVE-2016-5697
Published: 2017-01-23
Description: Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-91
References: http://www.openwall.com/lists/oss-security/2016/06/24/3; http://www.openwall.com/lists/oss-security/2016/06/24/3
CVE: CVE-2016-5720
Published: 2017-01-23
Description: Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) msi.dll, (2) dpapi.dll, or (3) cryptui.dll that is located in the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2016/Sep/65; http://www.securityfocus.com/bid/95859; http://seclists.org/fulldisclosure/2016/Sep/65
CVE: CVE-2016-5742
Published: 2017-01-23
Description: SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2.13 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.openwall.com/lists/oss-security/2016/06/22/3; http://www.openwall.com/lists/oss-security/2016/06/22/5; http://www.openwall.com/lists/oss-security/2016/06/22/6
CVE: CVE-2016-5873
Published: 2017-01-23
Description: Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/06/29/1; http://www.openwall.com/lists/oss-security/2016/06/29/4; http://www.securityfocus.com/bid/95863
CVE: CVE-2016-5876
Published: 2017-01-23
Description: ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/95861; https://owncloud.org/security/advisory/?id=oc-sa-2016-010; http://www.securityfocus.com/bid/95861
CVE: CVE-2016-6160
Published: 2017-01-23
Description: tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related issue to CVE-2017-14266.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.openwall.com/lists/oss-security/2016/07/05/3; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=829350; https://github.com/appneta/tcpreplay/issues/251
CVE: CVE-2016-6164
Published: 2017-01-23
Description: Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit%3Bh=8a3221cc67a516dfc1700bdae3566ec52c7ee823; http://www.securityfocus.com/bid/95862; https://www.ffmpeg.org/security.html
CVE: CVE-2016-6223
Published: 2017-01-23
Description: The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or possibly obtain sensitive information via a negative index in a file-content buffer.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-189
References: http://libtiff.maptools.org/v4.0.7.html; http://www.debian.org/security/2017/dsa-3762; http://www.openwall.com/lists/oss-security/2016/07/13/3
CVE: CVE-2016-6484
Published: 2017-01-23
Description: CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the contentType parameter in a login action to config/userAdmin/login.tdf.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: http://packetstormsecurity.com/files/138615/Infoblox-7.0.1-CRLF-Injection-HTTP-Response-Splitting.html; http://www.securityfocus.com/archive/1/539366/100/0/threaded; http://www.securityfocus.com/bid/92794
CVE: CVE-2016-6517
Published: 2017-01-23
Description: Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir parameter to barebone.jsp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2016/08/01/5; http://www.openwall.com/lists/oss-security/2016/08/02/1; http://www.securityfocus.com/bid/92215
CVE: CVE-2016-6521
Published: 2017-01-23
Description: Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote attackers to hijack the authentication of users for requests that execute arbitrary Groovy code via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2016/08/02/11; http://www.openwall.com/lists/oss-security/2016/08/02/2; http://www.openwall.com/lists/oss-security/2016/08/03/9
CVE: CVE-2016-6582
Published: 2017-01-23
Description: The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-254
References: http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html; http://seclists.org/fulldisclosure/2016/Aug/105; http://www.securityfocus.com/archive/1/539268/100/0/threaded
CVE: CVE-2016-6600
Published: 2017-01-23
Description: Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html; http://seclists.org/fulldisclosure/2016/Aug/54; http://www.securityfocus.com/archive/1/539159/100/0/threaded
CVE: CVE-2016-6601
Published: 2017-01-23
Description: Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html; http://seclists.org/fulldisclosure/2016/Aug/54; http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure
CVE: CVE-2016-6602
Published: 2017-01-23
Description: ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml.  NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html; http://seclists.org/fulldisclosure/2016/Aug/54; http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure
CVE: CVE-2016-6603
Published: 2017-01-23
Description: ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html; http://seclists.org/fulldisclosure/2016/Aug/54; http://www.securityfocus.com/archive/1/539159/100/0/threaded
CVE: CVE-2016-6668
Published: 2017-01-23
Description: The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.26.0 before 7.8.17; and HipChat for JIRA plugin 6.26.0 before 7.8.17 allows remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://packetstormsecurity.com/files/139004/Atlassian-HipChat-Secret-Key-Disclosure.html; http://www.securityfocus.com/archive/1/539530/100/0/threaded; http://www.securityfocus.com/bid/93159
CVE: CVE-2016-6920
Published: 2017-01-23
Description: Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (application crash) via vectors involving tile positions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit%3Bh=79f52a0dbd484aad111e4bf4a4f7047c7ceb6137; http://packetstormsecurity.com/files/138618/ffmpeg-3.1.2-Heap-Overflow.html; http://www.securityfocus.com/archive/1/539368/100/0/threaded
CVE: CVE-2016-7036
Published: 2017-01-23
Description: python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-361
References: http://www.securityfocus.com/bid/95845; https://github.com/mpdavis/python-jose/pull/35/commits/89b46353b9f611e9da38de3d2fedf52331167b93; https://github.com/mpdavis/python-jose/releases/tag/1.3.2
CVE: CVE-2016-7037
Published: 2017-01-23
Description: The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-361
References: http://www.securityfocus.com/bid/95847; https://github.com/emarref/jwt/pull/20; https://github.com/emarref/jwt/releases/tag/1.0.3
CVE: CVE-2016-7102
Published: 2017-01-23
Description: ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: drive.
CVSS Score: 8.4 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/92627; https://owncloud.org/security/advisory/?id=oc-sa-2016-016; http://www.securityfocus.com/bid/92627
CVE: CVE-2016-7410
Published: 2017-01-23
Description: The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) via a crafted file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2016/09/13/5; http://www.openwall.com/lists/oss-security/2016/09/15/3; http://www.securityfocus.com/bid/92971
CVE: CVE-2016-7567
Published: 2017-01-23
Description: Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2016/09/27/4; http://www.openwall.com/lists/oss-security/2016/09/28/1; http://www.securityfocus.com/bid/93186
CVE: CVE-2016-7792
Published: 2017-01-23
Description: Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/93270; https://packetstormsecurity.com/files/138928/Ubiquiti-UniFi-AP-AC-Lite-5.2.7-Improper-Access-Control.html; http://www.securityfocus.com/bid/93270
CVE: CVE-2016-9012
Published: 2017-01-23
Description: CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request to /web/system/console/bundle.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94635; https://www.arista.com/en/support/advisories-notices/security-advisories/2116-security-advisory-27; http://www.securityfocus.com/bid/94635
CVE: CVE-2016-9081
Published: 2017-01-23
Description: Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-255
References: http://www.securityfocus.com/bid/93969; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-account-modifications.html; http://www.securityfocus.com/bid/93969
CVE: CVE-2016-9379
Published: 2017-01-23
Description: The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.
CVSS Score: 7.9 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94473; http://www.securitytracker.com/id/1037347; http://xenbits.xen.org/xsa/advisory-198.html
CVE: CVE-2016-9380
Published: 2017-01-23
Description: The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94473; http://www.securitytracker.com/id/1037347; http://xenbits.xen.org/xsa/advisory-198.html
CVE: CVE-2016-9381
Published: 2017-01-23
Description: Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/94476; http://www.securitytracker.com/id/1037344; http://xenbits.xen.org/xsa/advisory-197.html
CVE: CVE-2016-9382
Published: 2017-01-23
Description: Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94470; http://www.securitytracker.com/id/1037341; http://xenbits.xen.org/xsa/advisory-192.html
CVE: CVE-2016-9383
Published: 2017-01-23
Description: Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94474; http://www.securitytracker.com/id/1037346; http://xenbits.xen.org/xsa/advisory-195.html