rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-3931 
drivers/misc/qseecom.c in the Qualcomm QSEE Communicator driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29157595 and Qualcomm internal bug CR 1036418.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3932 
mediaserver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 29161895 and MediaTek internal bug ALPS02770870.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3933 
mediaserver in Android before 2016-10-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 29421408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3934 
drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka Android internal bug 30102557 and Qualcomm internal bug CR 789704.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3935 
Multiple integer overflows in drivers/crypto/msm/qcedev.c in the Qualcomm cryptographic engine driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29999665 and Qualcomm internal bug CR 1046507.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3936 
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019037 and MediaTek internal bug ALPS02829568.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3937 
The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30030994 and MediaTek internal bug ALPS02834874.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3938 
drivers/video/msm/mdss/mdss_mdp_overlay.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30019716 and Qualcomm internal bug CR 1049232.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3939 
drivers/video/msm/mdss/mdss_debug.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30874196 and Qualcomm internal bug CR 1001224.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3940 
The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 6P and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 30141991.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-10T10:00:00.000Z
CVE-2016-3941 
Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of service (crash) via a crafted wav file, related to "seek across EOF."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T15:00:00.000Z
CVE-2016-3943 
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T15:00:00.000Z
CVE-2016-3944 
UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-03T14:00:00.000Z
CVE-2016-3945 
Multiple integer overflows in the (1) cvt_by_strip and (2) cvt_by_tile functions in the tiff2rgba tool in LibTIFF 4.0.6 and earlier, when -b mode is enabled, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image, which triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T18:00:00.000Z
CVE-2016-3946 
SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T14:00:00.000Z
CVE-2016-3947 
Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log files via an ICMPv6 packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T18:00:00.000Z
CVE-2016-3948 
Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T18:00:00.000Z
CVE-2016-3949 
Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and SIMATIC S7-300 Profinet-disabled CPU devices with firmware before 3.3.12 allow remote attackers to cause a denial of service (defect-mode transition) via crafted (1) ISO-TSAP or (2) Profibus packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-3950 
Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T14:00:00.000Z
CVE-2016-3951 
Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3952 
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.  NOTE: this issue can be leveraged by remote attackers to gain administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T18:00:00.000Z
CVE-2016-3953 
The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T18:00:00.000Z
CVE-2016-3954 
web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.  NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T18:00:00.000Z
CVE-2016-3955 
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T21:00:00.000Z
CVE-2016-3956 
The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive information by reading Authorization headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-02T14:00:00.000Z
CVE-2016-3957 
The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-06T18:00:00.000Z
CVE-2016-3958 
Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T19:00:00.000Z
CVE-2016-3959 
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T19:00:00.000Z
CVE-2016-3960 
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-19T14:00:00.000Z
CVE-2016-3961 
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-15T14:00:00.000Z
CVE-2016-3962 
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T14:00:00.000Z
CVE-2016-3963 
Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 443.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T15:00:00.000Z
CVE-2016-3968 
Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject arbitrary web script or HTML via the (1) ipFamily parameter to corporate/webpages/trafficdiscovery/LiveConnections.jsp; the (2) ipFamily, (3) applicationname, or (4) username parameter to corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp; or the (5) X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-06T18:00:00.000Z
CVE-2016-3969 
Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-06T18:00:00.000Z
CVE-2016-3971 
Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to c/portal/layout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T15:00:00.000Z
CVE-2016-3972 
Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T15:00:00.000Z
CVE-2016-3973 
The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive user information by visiting webdynpro/resources/sap.com/tc~rtc~coll.appl.rtc~wd_chat/Chat#, pressing "Add users", and doing a search, aka SAP Security Note 2255990.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T19:00:00.000Z
CVE-2016-3974 
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to _tc~monitoring~webservice~web/ServerNodesWSService, aka SAP Security Note 2235994.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T19:00:00.000Z
CVE-2016-3975 
Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the navigationTarget parameter to irj/servlet/prt/portal/prteventname/XXX/prtroot/com.sapportals.navigation.testComponent.NavigationURLTester, aka SAP Security Note 2238375.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T19:00:00.000Z
CVE-2016-3976 
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-07T23:00:00.000Z
CVE-2016-3977 
Heap-based buffer overflow in util/gif2rgb.c in gif2rgb in giflib 5.1.2 allows remote attackers to cause a denial of service (application crash) via the background color index in a GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-21T14:00:00.000Z
CVE-2016-3978 
The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3979 
Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3980 
The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3981 
Heap-based buffer overflow in the bmp_read_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T16:00:00.000Z
CVE-2016-3982 
Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and crash) or possibly execute arbitrary code via a crafted image file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T16:00:00.000Z
CVE-2016-3983 
McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T15:00:00.000Z
CVE-2016-3984 
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T15:00:00.000Z
CVE-2016-3985 
The Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature in Pulse Connect Secure (aka PCS) 8.1R7 and 8.2R1 allow remote authenticated users to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T16:00:00.000Z
CVE-2016-3986 
Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T16:00:00.000Z
CVE-2016-3987 
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T16:00:00.000Z
CVE-2016-3988 
Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T14:00:00.000Z
CVE-2016-3989 
The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T14:00:00.000Z
CVE-2016-3990 
Heap-based buffer overflow in the horizontalDifference8 function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted TIFF image to tiffcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T18:00:00.000Z
CVE-2016-3991 
Heap-based buffer overflow in the loadImage function in the tiffcrop tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted TIFF image with zero tiles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T18:00:00.000Z
CVE-2016-3992 
cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-26T17:00:00.000Z
CVE-2016-3993 
Off-by-one error in the __imlib_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted coordinates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T16:00:00.000Z
CVE-2016-3994 
The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive information via a crafted image, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T16:00:00.000Z
CVE-2016-3995 
The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z
CVE-2016-3996 
ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T20:00:00.000Z
CVE-2016-3997 
NetApp Clustered Data ONTAP allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service by leveraging failure to enable SMB signing enforcement in its default state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-03T16:00:00.000Z
CVE-2016-3998 
NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-03T16:00:00.000Z
CVE-2016-3999 
Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T22:00:00.000Z
CVE-2016-4000 
Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-06T16:00:00.000Z