rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-3834 
Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption, leading to a heap-based buffer overflow, aka internal bug 20222489.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3835 
Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3836 
The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3837 
The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3839 
The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2015-3840 
The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-3842 
Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3843 
The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3844 
The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3845 
The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, aka internal bug 17312693.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3847 
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3849 
The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3854 
packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T21:00:00.000Z
CVE-2015-3858 
The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3860 
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3861 
Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug 21296336.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3862 
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3863 
Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3864 
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T00:00:00.000Z
CVE-2015-3865 
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3867 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3868 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3869 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3870 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3871 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3872 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3873 
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3874 
The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3875 
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3876 
libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-02T01:00:00.000Z
CVE-2015-3877 
Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3878 
Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal bug 23345192.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3879 
Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-06T17:00:00.000Z
CVE-2015-3880 
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T15:00:00.000Z
CVE-2015-3881 
Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2015-3882 
qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2015-3883 
Multiple cross-site scripting (XSS) vulnerabilities in qdPM 8.3 allow remote attackers to inject arbitrary web script or HTML via the (1) search[keywords] parameter to index.php/users page; the (2) "Name of application" on index.php/configuration; (3) a new project name on index.php/projects; (4) the task name on index.php/tasks; (5) ticket name on index.php/tickets; (6) discussion name on index.php/discussions; (7) report name on index.php/projectReports; or (8) event name on index.php/scheduler/personal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2015-3884 
Unrestricted file upload vulnerability in the (1) myAccount, (2) projects, (3) tasks, (4) tickets, (5) discussions, (6) reports, and (7) scheduler pages in qdPM 8.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/attachments/ or uploads/users/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-17T14:00:00.000Z
CVE-2015-3885 
Integer overflow in the ljpeg_start function in dcraw 7.00 and earlier allows remote attackers to cause a denial of service (crash) via a crafted image, which triggers a buffer overflow, related to the len variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-19T18:00:00.000Z
CVE-2015-3886 
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-3887 
Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the current working directory, which is referenced in the LD_PRELOAD path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T16:00:00.000Z
CVE-2015-3888 
Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T17:00:00.000Z
CVE-2015-3890 
Use-after-free vulnerability in Open Litespeed before 1.3.10.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T18:00:00.000Z
CVE-2015-3897 
Directory traversal vulnerability in Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the theme parameter and a file path in the location parameter to bonita/portal/themeResource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-18T18:00:00.000Z
CVE-2015-3898 
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-28T21:00:00.000Z
CVE-2015-3900 
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-24T14:00:00.000Z
CVE-2015-3902 
Multiple cross-site request forgery (CSRF) vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-26T15:00:00.000Z
CVE-2015-3903 
libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables X.509 certificate verification for GitHub API calls over SSL, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-26T15:00:00.000Z
CVE-2015-3904 
Multiple cross-site scripting (XSS) vulnerabilities in roomcloud.php in the Roomcloud plugin before 1.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) pin, (2) start_day, (3) start_month, (4) start_year, (5) end_day, (6) end_month, (7) end_year, (8) lang, (9) adults, or (10) children parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-29T14:00:00.000Z
CVE-2015-3905 
Buffer overflow in the set_cs_start function in t1disasm.c in t1utils before 1.39 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-08T14:00:00.000Z
CVE-2015-3906 
The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-26T15:00:00.000Z
CVE-2015-3907 
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-03T20:54:57.000Z
CVE-2015-3908 
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-3910 
Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T10:00:00.000Z
CVE-2015-3911 
Huawei E587 Mobile WiFi with firmware before 11.203.30.00.00 allows remote attackers to bypass authentication, change configurations, send messages, and cause a denial of service (device restart) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-21T19:00:00.000Z
CVE-2015-3912 
Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-21T19:00:00.000Z
CVE-2015-3913 
The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T21:00:00.000Z
CVE-2015-3921 
Cross-site scripting (XSS) vulnerability in contact.php in Coppermine Photo Gallery before 1.5.36 allows remote authenticated users to inject arbitrary web script or HTML via the referer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-27T18:00:00.000Z
CVE-2015-3922 
Open redirect vulnerability in mode.php in Coppermine Photo Gallery before 1.5.36 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-27T18:00:00.000Z
CVE-2015-3923 
Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-10T18:00:00.000Z
CVE-2015-3931 
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-3932 
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-3933 
Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-08T16:00:00.000Z
CVE-2015-3934 
Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-21T15:00:00.000Z
CVE-2015-3935 
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-10T14:00:00.000Z
CVE-2015-3938 
The HTTP application on Mitsubishi Electric MELSEC FX3G PLC devices before April 2015 allows remote attackers to cause a denial of service (device outage) via a long parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-03T10:00:00.000Z