rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-5356 
wiretap/cosine.c in the CoSine file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T16:00:00.000Z
CVE-2016-5357 
wiretap/netscreen.c in the NetScreen file parser in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles sscanf unsigned-integer processing, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T16:00:00.000Z
CVE-2016-5358 
epan/dissectors/packet-pktap.c in the Ethernet dissector in Wireshark 2.x before 2.0.4 mishandles the packet-header data type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T16:00:00.000Z
CVE-2016-5359 
epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T16:00:00.000Z
CVE-2016-5360 
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T17:00:00.000Z
CVE-2016-5361 
programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-16T14:00:00.000Z
CVE-2016-5362 
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-17T15:00:00.000Z
CVE-2016-5363 
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via (1) a crafted DHCP discovery message or (2) crafted non-IP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-17T15:00:00.000Z
CVE-2016-5364 
Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-5365 
Stack-based buffer overflow in Huawei Honor WS851 routers with software 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges via unspecified vectors, aka HWPSIRT-2016-05051.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-14T14:00:00.000Z
CVE-2016-5366 
Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vulnerability," aka HWPSIRT-2016-05052.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-14T14:00:00.000Z
CVE-2016-5367 
Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-05053.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-14T14:00:00.000Z
CVE-2016-5368 
Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted Multiprotocol Label Switching (MPLS) packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T16:00:00.000Z
CVE-2016-5372 
Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T17:00:00.000Z
CVE-2016-5374 
NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2016-5383 
The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-26T14:00:00.000Z
CVE-2016-5384 
fontconfig before 2.12.1 does not validate offsets, which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-12T16:00:00.000Z
CVE-2016-5385 
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-19T01:00:00.000Z
CVE-2016-5386 
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-19T01:00:00.000Z
CVE-2016-5387 
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.  NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-19T01:00:00.000Z
CVE-2016-5388 
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-19T01:00:00.000Z
CVE-2016-5390 
Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-19T21:00:00.000Z
CVE-2016-5391 
libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T17:00:00.000Z
CVE-2016-5392 
The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T15:00:00.000Z
CVE-2016-5393 
In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Problem types: description: arbitrary command execution
Affected products: vendor: n/a
product: Apache Hadoop
Published: 2016-11-29T06:00:00.000Z
CVE-2016-5394 
In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Problem types: description: n/a
Affected products: vendor: Apache Software Foundation
product: Apache Sling
Published: 2017-07-19T15:00:00.000Z
CVE-2016-5395 
Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T14:00:00.000Z
CVE-2016-5396 
Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack.
Problem types: description: DoS attack
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
Published: 2017-04-17T18:00:00.000Z
CVE-2016-5397 
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Problem types: description: Command Injection
Affected products: vendor: Apache Software Foundation
product: Apache Thrift
Published: 2018-02-12T17:00:00.000Z
CVE-2016-5398 
Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T18:00:00.000Z
CVE-2016-5399 
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T20:00:00.000Z
CVE-2016-5400 
Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-06T20:00:00.000Z
CVE-2016-5401 
Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T21:00:00.000Z
CVE-2016-5402 
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
Problem types: cwe_id: CWE-94
description: CWE-94
Affected products: vendor: [UNKNOWN]
product: cfme
Published: 2018-10-31T13:00:00.000Z
CVE-2016-5403 
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-02T16:00:00.000Z
CVE-2016-5404 
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T20:00:00.000Z
CVE-2016-5405 
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T19:00:00.000Z
CVE-2016-5406 
The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T14:00:00.000Z
CVE-2016-5407 
The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-5408 
Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-10T14:00:00.000Z
CVE-2016-5409 
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T17:00:00.000Z
CVE-2016-5410 
firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-19T14:00:00.000Z
CVE-2016-5411 
/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T16:00:00.000Z
CVE-2016-5412 
arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-06T20:00:00.000Z
CVE-2016-5414 
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2016-5416 
389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to read the default Access Control Instructions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T19:00:00.000Z
CVE-2016-5417 
Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.24 allows remote attackers to cause a denial of service (memory consumption) by leveraging partial initialization of internal resolver data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T18:00:00.000Z
CVE-2016-5418 
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-5419 
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-10T14:00:00.000Z
CVE-2016-5420 
curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-10T14:00:00.000Z
CVE-2016-5421 
Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-10T14:00:00.000Z
CVE-2016-5422 
The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-5423 
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T23:00:00.000Z
CVE-2016-5424 
PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T23:00:00.000Z
CVE-2016-5425 
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T14:00:00.000Z
CVE-2016-5426 
PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-5427 
PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of service (backend CPU consumption) via a crafted DNS query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-5429 
jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-03T20:00:00.000Z
CVE-2016-5430 
The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-03T20:00:00.000Z
CVE-2016-5431 
The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
Problem types: cwe_id: CWE-327
description: CWE-327
Affected products: vendor: n/a
product: jose-php
Published: 2019-08-07T15:13:47.000Z
CVE-2016-5432 
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T18:00:00.000Z
CVE-2016-5433 
Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-17T15:00:00.000Z
CVE-2016-5434 
libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z