rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-0815 
The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0816 
mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to decoder/ih264d_parse_islice.c and decoder/ih264d_parse_pslice.c, aka internal bug 25928803.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0818 
The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0819 
The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 25364034.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0820 
The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 26267358.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0821 
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0822 
The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access, aka internal bug 25873324.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0823 
The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0824 
libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0825 
The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging kernel access, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 20860039.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0826 
libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dump method for a camera service dump, which allows attackers to gain privileges via a crafted application that directly dumps, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26265403.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0827 
Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, related to EffectBundle.cpp and EffectReverb.cpp, aka internal bug 26347509.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0828 
The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0829 
The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering a QUEUE_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338109.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0830 
btif_config.c in Bluetooth in Android 6.x before 2016-03-01 allows remote attackers to cause a denial of service (memory corruption and persistent daemon crash) by triggering a large number of configuration entries, and consequently exceeding the maximum size of a configuration file, aka internal bug 26071376.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0831 
The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25778215.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0832 
Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-12T21:00:00.000Z
CVE-2016-0833 
Android allows users to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T14:00:00.000Z
CVE-2016-0834 
An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26220548.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0835 
decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0836 
Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0837 
MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0838 
Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0839 
post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0840 
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26399350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0841 
media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0842 
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0843 
The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0844 
The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via a crafted application, aka internal bug 26324307.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0846 
libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0847 
The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0848 
Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26211054.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0849 
Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0850 
The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-0851 
Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0852 
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0853 
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0854 
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0855 
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0856 
Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0857 
Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0858 
Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0859 
Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0860 
Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-15T02:00:00.000Z
CVE-2016-0861 
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-05T11:00:00.000Z
CVE-2016-0862 
General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-05T11:00:00.000Z
CVE-2016-0863 
Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-13T02:00:00.000Z
CVE-2016-0864 
Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-13T02:00:00.000Z
CVE-2016-0865 
Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-13T02:00:00.000Z
CVE-2016-0866 
Cross-site scripting (XSS) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-13T02:00:00.000Z
CVE-2016-0867 
CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-30T15:00:00.000Z
CVE-2016-0868 
Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-28T21:00:00.000Z
CVE-2016-0869 
Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-26T19:00:00.000Z
CVE-2016-0870 
The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-19T01:00:00.000Z
CVE-2016-0871 
Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-06T23:00:00.000Z
CVE-2016-0872 
A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-07T21:00:00.000Z
CVE-2016-0875 
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-31T01:00:00.000Z
CVE-2016-0876 
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-31T01:00:00.000Z
CVE-2016-0877 
Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-31T01:00:00.000Z
CVE-2016-0878 
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-31T01:00:00.000Z
CVE-2016-0879 
Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-31T01:00:00.000Z
CVE-2016-0881 
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and obtain sensitive repository information by appending a query to a REST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-12T01:00:00.000Z
CVE-2016-0882 
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-12T01:00:00.000Z
CVE-2016-0883 
Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-18T01:00:00.000Z
CVE-2016-0886 
EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_member API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-09T23:00:00.000Z