rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-4887 
Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: baserCMS Users Community
product: baserCMS plugin Uploader
Published: 2017-05-12T18:00:00.000Z
CVE-2016-4888 
Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-4889 
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-4890 
ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-4891 
Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an administrator to change settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4892 
Cross-site scripting vulnerability in SetsucoCMS all versions allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4893 
SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4894 
SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4895 
SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4896 
SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4897 
Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-4898 
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2016-4899 
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2016-4900 
Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Evernote
product: Evernote for Windows
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4901 
Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: National Tax Agency
product: The installer of e-Tax Software
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4902 
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: Untrusted search path vulnerability
Affected products: vendor: Japan Agency for Local Authority Information Systems
product: The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)"
vendor: Japan Agency for Local Authority Information Systems
product: The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)"
vendor: Japan Agency for Local Authority Information Systems
product: The Public Certification Service for Individuals "The JPKI user's software"
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4903 
Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: Cross-site scripting
Affected products: vendor: Olive Design
product: WP-OliveCart
vendor: Olive Design
product: WP-OliveCartPro
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4904 
Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to hijack the authentication of a user to perform unintended operations via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Olive Design
product: WP-OliveCart
vendor: Olive Design
product: WP-OliveCartPro
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4905 
SQL injection vulnerability in the WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows attackers with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: SQL Injection
Affected products: vendor: Olive Design
product: WP-OliveCart
vendor: Olive Design
product: WP-OliveCartPro
Published: 2017-05-22T16:00:00.000Z
CVE-2016-4906 
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai.
Problem types: description: Cross-site scripting
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4907 
Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
Problem types: description: Information Disclosure
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4908 
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4909 
Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors.
Problem types: description: Cross-site request forgery
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4910 
Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.
Problem types: description: Fails to restrict access
Affected products: vendor: Cybozu, Inc.
product: Cybozu Garoon
Published: 2017-06-09T16:00:00.000Z
CVE-2016-4911 
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T14:00:00.000Z
CVE-2016-4912 
The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2016-4913 
The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T10:00:00.000Z
CVE-2016-4921 Junos: IPv6 denial of service vulnerability due to resource exhaustion (CVE-2016-4921)
By flooding a Juniper Networks router running Junos OS with specially crafted IPv6 traffic, all available resources can be consumed, leading to the inability to store next hop information for legitimate traffic. In extreme cases, the crafted IPv6 traffic may result in a total resource exhaustion and kernel panic. The issue is triggered by traffic destined to the router. Transit traffic does not trigger the vulnerability. This issue only affects devices with IPv6 enabled and configured. Devices not configured to process IPv6 traffic are unaffected by this vulnerability. This issue was found during internal product security testing. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. Affected releases are Juniper Networks Junos OS 11.4 prior to 11.4R13-S3; 12.3 prior to 12.3R3-S4; 12.3X48 prior to 12.3X48-D30; 13.3 prior to 13.3R10, 13.3R4-S11; 14.1 prior to 14.1R2-S8, 14.1R4-S12, 14.1R8; 14.1X53 prior to 14.1X53-D28, 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R3-S10, 14.2R4-S7, 14.2R6; 15.1 prior to 15.1F2-S5, 15.1F5-S2, 15.1F6, 15.1R3; 15.1X49 prior to 15.1X49-D40; 15.1X53 prior to 15.1X53-D57, 15.1X53-D70.
Problem types: description: denial of service vulnerability
Affected products: vendor: Juniper Networks
product: Junos OS
Published: 2017-10-13T17:00:00.000Z
CVE-2016-4922 Junos: Privilege escalation vulnerabilities in Junos CLI
Certain combinations of Junos OS CLI commands and arguments have been found to be exploitable in a way that can allow unauthorized access to the operating system. This may allow any user with permissions to run these CLI commands the ability to achieve elevated privileges and gain complete control of the device. Affected releases are Juniper Networks Junos OS 11.4 prior to 11.4R13-S3; 12.1X46 prior to 12.1X46-D60; 12.1X47 prior to 12.1X47-D45; 12.3 prior to 12.3R12; 12.3X48 prior to 12.3X48-D35; 13.2 prior to 13.2R9; 13.3 prior to 13.3R4-S11, 13.3R9; 14.1 prior to 14.1R4-S12, 14.1R7; 14.1X53 prior to 14.1X53-D28, 14.1X53-D40; 14.1X55 prior to 14.1X55-D35; 14.2 prior to 14.2R3-S10, 14.2R4-S7, 14.2R5; 15.1 prior to 15.1F4, 15.1R3; 15.1X49 prior to 15.1X49-D60; 15.1X53 prior to 15.1X53-D57, 15.1X53-D70.
Problem types: description: Privilege escalation
Affected products: vendor: Juniper Networks
product: Junos OS
Published: 2017-10-13T17:00:00.000Z
CVE-2016-4923 Junos J-Web: Cross Site Scripting Vulnerability
Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web script or HTML and steal sensitive data and credentials from a J-Web session and to perform administrative actions on the Junos device. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. Affected releases are Juniper Networks Junos OS 11.4 prior to 11.4R13-S3; 12.1X44 prior to 12.1X44-D60; 12.1X46 prior to 12.1X46-D40; 12.1X47 prior to 12.1X47-D30; 12.3 prior to 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2X51 prior to 13.2X51-D39, 13.2X51-D40; 13.3 prior to 13.3R9; 14.1 prior to 14.1R6; 14.2 prior to 14.2R6; 15.1 prior to 15.1R3; 15.1X49 prior to 15.1X49-D20; 15.1X53 prior to 15.1X53-D57.
Problem types: description: Insufficient cross site scripting protection
Affected products: vendor: Juniper Networks
product: Junos OS
Published: 2017-10-13T17:00:00.000Z
CVE-2016-4924 vMX: Information leak vulnerability
An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE images and obtain sensitive information contained in them such as private cryptographic keys. This issue was found during internal product security testing. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 15.1 prior to 15.1F5; 14.1 prior to 14.1R8
Problem types: description: Information leak vulnerability
Affected products: vendor: Juniper Networks
product: Junos OS
Published: 2017-10-13T17:00:00.000Z
CVE-2016-4925 JUNOSe: Line Card Reset: processor exception 0x68616c74 (halt) task: scheduler, upon receipt of crafted IPv6 packet
Receipt of a specifically malformed IPv6 packet processed by the router may trigger a line card reset: processor exception 0x68616c74 (halt) in task: scheduler. The line card will reboot and recover without user interaction. However, additional specifically malformed packets may cause follow-on line card resets and lead to an extended service outage. This issue only affects E Series routers with IPv6 licensed and enabled. Routers not configured to process IPv6 traffic are unaffected by this vulnerability. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. No other Juniper Networks products or platforms are affected by this issue.
Problem types: description: denial of service
Affected products: vendor: Juniper Networks
product: JunosE
Published: 2017-10-13T17:00:00.000Z
CVE-2016-4926 
Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4927 
Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4928 
Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4929 
Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4930 
Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4931 
XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T20:00:00.000Z
CVE-2016-4945 
Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to inject arbitrary web script or HTML via the NSC_TMAC cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T22:00:00.000Z
CVE-2016-4946 
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-4947 
Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-4948 
Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos Encryption Types, (5) Advanced Configuration Snippet (Safety Valve) for [libdefaults] section of krb5.conf, (6) Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf, (7) Advanced Configuration Snippet (Safety Valve) for remaining krb5.conf, or (8) Active Directory Account Prefix fields in the Kerberos wizard; or (9) classicWizard parameter to cmf/cloudera-director/redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-4949 
Cloudera Manager 5.5 and earlier allows remote attackers to obtain sensitive information via a (1) stderr.log or (2) stdout.log value in the filename parameter to /cmf/process/<process_id>/logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-4950 
Cloudera Manager 5.5 and earlier allows remote attackers to enumerate user sessions via a request to /api/v11/users/sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-4951 
The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T10:00:00.000Z
CVE-2016-4952 
QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds array access) via vectors related to the (1) PVSCSI_CMD_SETUP_RINGS or (2) PVSCSI_CMD_SETUP_MSG_RING SCSI command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T14:00:00.000Z
CVE-2016-4953 
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-05T01:00:00.000Z
CVE-2016-4954 
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-05T01:00:00.000Z
CVE-2016-4955 
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-05T01:00:00.000Z
CVE-2016-4956 
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-05T01:00:00.000Z
CVE-2016-4957 
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-05T01:00:00.000Z
CVE-2016-4959 
For the NVIDIA Quadro, NVS, and GeForce products, there is a Remote Desktop denial of service. A successful exploit of a vulnerable system will result in a kernel null pointer dereference, causing a blue screen crash.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-4960 
For the NVIDIA Quadro, NVS, and GeForce products, the NVIDIA NVStreamKMS.sys service component is improperly validating user-supplied data through its API entry points causing an elevation of privilege.
Problem types: description: Escalation of Privileges
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-4961 
For the NVIDIA Quadro, NVS, and GeForce products, improper sanitization of parameters in the NVStreamKMS.sys API layer caused a denial of service vulnerability (blue screen crash) within the NVIDIA Windows graphics drivers.
Problem types: description: Denial of Service
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-4962 
The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2016-4963 
The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2016-4964 
The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-10T00:00:00.000Z
CVE-2016-4965 
Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z