rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-2555 
SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2016-2556 
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows improperly allows access to restricted functionality, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T14:00:00.000Z
CVE-2016-2557 
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information from kernel memory, cause a denial of service (crash), or possibly gain privileges via unspecified vectors, which trigger uninitialized or out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T14:00:00.000Z
CVE-2016-2558 
The Escape interface in the Kernel Mode Driver layer in the NVIDIA GPU graphics driver R340 before 341.95 and R352 before 354.74 on Windows allows local users to obtain sensitive information, cause a denial of service (crash), or gain privileges via unspecified vectors related to an untrusted pointer, which trigger uninitialized or out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T14:00:00.000Z
CVE-2016-2559 
Cross-site scripting (XSS) vulnerability in the format function in libraries/sql-parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-01T11:00:00.000Z
CVE-2016-2560 
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Host HTTP header, related to libraries/Config.class.php; (2) crafted JSON data, related to file_echo.php; (3) a crafted SQL query, related to js/functions.js; (4) the initial parameter to libraries/server_privileges.lib.php in the user accounts page; or (5) the it parameter to libraries/controllers/TableSearchController.class.php in the zoom search page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-01T11:00:00.000Z
CVE-2016-2561 
Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users to inject arbitrary web script or HTML via (1) normalization.php or (2) js/normalization.js in the database normalization page, (3) templates/database/structure/sortable_header.phtml in the database structure page, or (4) the pos parameter to db_central_columns.php in the central columns page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-01T11:00:00.000Z
CVE-2016-2562 
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-01T11:00:00.000Z
CVE-2016-2563 
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T23:00:00.000Z
CVE-2016-2564 
Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-23T15:00:00.000Z
CVE-2016-2565 
Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to read sent e-mail messages, aka SVE-2015-5081.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T16:00:00.000Z
CVE-2016-2566 
Samsung SecEmailSync on SM-G920F build G920FXXU2COH2 (Galaxy S6) devices has SQL injection, aka SVE-2015-5081.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T16:00:00.000Z
CVE-2016-2567 
secfilter in the Samsung kernel for Android on SM-N9005 build N9005XXUGBOB6 (Note 3) and SM-G920F build G920FXXU2COH2 (Galaxy S6) devices allows attackers to bypass URL filtering by inserting an "exceptional URL" in the query string, as demonstrated by the http://should-have-been-filtered.example.com/?http://google.com URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T16:00:00.000Z
CVE-2016-2568 
pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z
CVE-2016-2569 
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-27T02:00:00.000Z
CVE-2016-2570 
The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-27T02:00:00.000Z
CVE-2016-2571 
http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-27T02:00:00.000Z
CVE-2016-2572 
http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-27T02:00:00.000Z
CVE-2016-2774 
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-09T15:26:00.000Z
CVE-2016-2775 
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-19T22:00:00.000Z
CVE-2016-2776 
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-28T10:00:00.000Z
CVE-2016-2779 
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T15:00:00.000Z
CVE-2016-2780 
Untrusted search path vulnerability in Huawei UTPS before UTPS-V200R003B015D15SP00C983 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T14:00:00.000Z
CVE-2016-2781 
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T15:00:00.000Z
CVE-2016-2782 
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-2783 
Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I-SIS indexes, which allows remote attackers to obtain unauthorized access via crafted Ethernet frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-2784 
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-26T14:00:00.000Z
CVE-2016-2785 
Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-2786 
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-2787 
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z
CVE-2016-2788 
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z
CVE-2016-2789 
Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 before Rolling Patch 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T23:00:00.000Z
CVE-2016-2790 
The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2791 
The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2792 
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2793 
CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2794 
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2795 
The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2796 
Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2797 
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2798 
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2799 
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2800 
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2801 
The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2802 
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-13T18:00:00.000Z
CVE-2016-2803 
Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-2804 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2805 
Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2806 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2807 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2808 
The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code or cause a denial of service (generation-count overflow, out-of-bounds HashMap write access, and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2809 
The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging certain local file execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2810 
Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages content-provider permissions, as demonstrated by reading the browser history or a saved password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2811 
Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code via vectors related to the BeginReading method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2812 
Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2813 
Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site, a similar issue to CVE-2016-1780.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2814 
Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2815 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T10:00:00.000Z
CVE-2016-2816 
Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mixed-replace content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z
CVE-2016-2817 
The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance during chrome.tabs.create and chrome.tabs.update API calls, which allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted extension that accesses a (1) javascript: or (2) data: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-30T17:00:00.000Z