rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-9022 
In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Problem types: description: Time-of-check Time-of-use (TOCTOU) Race Conditions in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9023 
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API.
Problem types: description: Buffer Copy without Checking Size of Input in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9024 
In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications.
Problem types: description: Improper Access Control Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9025 
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application.
Problem types: description: Buffer Copy without Checking Size of Input in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9026 
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.
Problem types: description: Untrusted Pointer Dereference Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9027 
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM.
Problem types: description: Untrusted Pointer Dereference Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9028 
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine.
Problem types: description: Buffer Copy without Checking Size of Input in MPSS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9029 
In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory.
Problem types: description: Improper Access Control Vulnerability in Core
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9030 
In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication.
Problem types: description: Improper Authentication Vulnerability in Hypervisor
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9031 
In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP.
Problem types: description: Information Exposure Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9032 
In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications.
Problem types: description: Improper Access Control Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9033 
In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer.
Problem types: description: Untrusted Pointer Dereference Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9034 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Problem types: description: Buffer Copy without Checking Size of Input in IMS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9035 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resulting in memory exhaustion.
Problem types: description: Uncontrolled Resource Consumption Vulnerability in IMS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9036 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.
Problem types: description: Buffer Copy without Checking Size of Input in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9037 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlink 3G NAS message.
Problem types: description: Buffer Over-read Vulnerability in NAS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9038 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end.
Problem types: description: NULL Pointer Dereference Vulnerability in RFA
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9039 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Problem types: description: Reachable Assertion Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9040 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API.
Problem types: description: Buffer Copy without Checking Size of Input in GERAN
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9041 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when performing WCDMA radio tuning.
Problem types: description: Buffer Copy without Checking Size of Input in RFA
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9042 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists when processing a QMI message.
Problem types: description: Buffer Copy without Checking Size of Input in QMI
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9043 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced upon the expiry of a timer.
Problem types: description: NULL Pointer Dereference Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9044 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Problem types: description: Reachable Assertion Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9045 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GERAN where a buffer can be overflown while taking power measurements.
Problem types: description: Buffer Copy without Checking Size of Input in GERAN
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9046 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.
Problem types: description: Reachable Assertion Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9047 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup.
Problem types: description: Buffer Copy without Checking Size of Input in GNSS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9048 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packets.
Problem types: description: Improper Validation of Array Index Vulnerability in RTP
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9049 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Problem types: description: Buffer Copy without Checking Size of Input in UIM
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9050 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists where an array out of bounds access can occur during a CA call.
Problem types: description: Improper Validation of Array Index Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9051 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Problem types: description: Reachable Assertion Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9052 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.
Problem types: description: Reachable Assertion Vulnerability in LTE
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9053 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the processing of certain responses from the USIM.
Problem types: description: Buffer Copy without Checking Size of Input in UIM
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9054 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer can be dereferenced during GAL decoding.
Problem types: description: NULL Pointer Dereference Vulnerability in GNSS
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9055 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a memory management routine.
Problem types: description: Reachable Assertion in Core
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9056 
Kibana versions prior to 4.1.3 and 4.2.1 are vulnerable to a XSS attack.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: Elastic
product: Kibana
Published: 2017-06-16T21:00:00.000Z
CVE-2015-9057 
Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters, related to /users/index.htm, /quarantine/spam/manage.htm, /quarantine/spam/whitelist.htm, /queues/mail/index/, /system/ssh.htm, /queues/mail/?domain=, and /quarantine/virus/manage.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-03T10:00:00.000Z
CVE-2015-9058 
Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-03T10:00:00.000Z
CVE-2015-9059 
picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-28T00:00:00.000Z
CVE-2015-9060 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call.
Problem types: description: Untrusted Pointer Dereference in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9061 
In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Problem types: description: Buffer Over-read in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9062 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ELF file.
Problem types: description: Integer Overflow to Buffer Overflow in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9063 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a procedure involving a remote UIM client.
Problem types: description: Buffer Copy without Checking Size of Input in UIM
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9064 
In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS security has been activated.
Problem types: description: Information Exposure in LTE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9065 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a UE can respond to a UEInformationRequest before Access Stratum security is established.
Problem types: description: Information Exposure in LTE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9066 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.
Problem types: description: Buffer Copy without Checking Size of Input in GERAN
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9067 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Problem types: description: Information Exposure in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9068 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Problem types: description: Improper Input Validation in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9069 
In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.
Problem types: description: Detection of Error Condition Without Action in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9070 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.
Problem types: description: Buffer Over-read in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9071 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in a TrustZone syscall.
Problem types: description: Buffer Over-read in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9072 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Problem types: description: Untrusted Pointer Dereference in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9073 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Problem types: description: Untrusted Pointer Dereference in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-9096 
Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T20:00:00.000Z
CVE-2015-9097 
The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-12T20:00:00.000Z
CVE-2015-9098 
In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-22T19:00:00.000Z
CVE-2015-9099 
The lame_init_params function in lame.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file with a negative sample rate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-25T19:00:00.000Z
CVE-2015-9100 
The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.99.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-25T19:00:00.000Z
CVE-2015-9101 
The fill_buffer_resample function in util.c in libmp3lame.a in LAME 3.98.4, 3.98.2, 3.98, 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4 and 3.99.5 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-25T19:00:00.000Z
CVE-2015-9102 
Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting (CWE-79)
Affected products: vendor: Synology
product: Photo Station
Published: 2017-06-30T13:00:00.000Z
CVE-2015-9103 
Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting (CWE-79)
Affected products: vendor: Synology
product: Note Station
Published: 2017-06-30T13:00:00.000Z
CVE-2015-9104 
Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting (CWE-79)
Affected products: vendor: Synology
product: Audio Station
Published: 2017-06-30T13:00:00.000Z
CVE-2015-9105 
Multiple cross-site scripting (XSS) vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) file name or (2) collection name of videos.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting (CWE-79)
Affected products: vendor: Synology
product: Video Station
Published: 2017-06-30T13:00:00.000Z
CVE-2015-9107 
Zoho ManageEngine OpManager 11 through 12.2 uses a custom encryption algorithm to protect the credential used to access the monitored devices. The implemented algorithm doesn't use a per-system key or even a salt; therefore, it's possible to create a universal decryptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-04T00:00:00.000Z
CVE-2015-9108 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation performed on calls to a QSEE syscall may lead to arbitrary read/write or NULL Pointer exception when calling a downstream function.
Problem types: description: Untrusted pointer dereference in QSEE syscall
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2015-9109 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation inqsee_fuse_write could lead to untrusted pointer dereference.
Problem types: description: Potential Untrusted pointer dereference in QTEE
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z
CVE-2015-9110 
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation is performed on calls to the qsee_get_secure_state syscall.
Problem types: description: Untrusted pointer dereference in qsee_get_secure_state syscall
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Automobile, Snapdragon Mobile
Published: 2018-04-18T14:00:00.000Z