rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-8546 
An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-10T18:43:53.000Z
CVE-2015-8547 
The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-8548 
Multiple unspecified vulnerabilities in Google V8 before 4.7.80.23, as used in Google Chrome before 47.0.2526.80, allow attackers to cause a denial of service or possibly have other impact via unknown vectors, a different issue than CVE-2015-8478.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-14T11:00:00.000Z
CVE-2015-8549 
XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-15T14:48:19.000Z
CVE-2015-8550 
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T14:00:00.000Z
CVE-2015-8551 
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T15:00:00.000Z
CVE-2015-8552 
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T15:00:00.000Z
CVE-2015-8553 
Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T15:00:00.000Z
CVE-2015-8554 
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T14:00:00.000Z
CVE-2015-8555 
Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T15:00:00.000Z
CVE-2015-8556 
Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T14:00:00.000Z
CVE-2015-8557 
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T20:00:00.000Z
CVE-2015-8558 
The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T19:00:00.000Z
CVE-2015-8559 
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T14:00:00.000Z
CVE-2015-8560 
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.4.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via a ; (semicolon) character in a print job, a different vulnerability than CVE-2015-8327.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T14:00:00.000Z
CVE-2015-8561 
The F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted integer value to the (1) AttachToSS, (2) CopyAll, (3) CopyRange, (4) CopyRangeEx, or (5) SwapTable method, a different vulnerability than CVE-2015-7918.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T02:00:00.000Z
CVE-2015-8562 
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8563 
Cross-site request forgery (CSRF) vulnerability in the com_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8564 
Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal sequences in the XML install file in an extension package archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8565 
Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8566 
The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8567 
Memory leak in net/vmxnet3.c in QEMU allows remote attackers to cause a denial of service (memory consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2015-8568 
Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T19:00:00.000Z
CVE-2015-8569 
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-28T11:00:00.000Z
CVE-2015-8570 
The password reset functionality in Lepide Active Directory Self Service allows remote authenticated users to change arbitrary domain user passwords via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T21:00:00.000Z
CVE-2015-8571 
Integer overflow in Autodesk Design Review (ADR) before 2013 Hotfix 2 allows remote attackers to execute arbitrary code via a crafted biClrUsed value in a BMP file, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T21:00:00.000Z
CVE-2015-8572 
Multiple buffer overflows in Autodesk Design Review (ADR) before 2013 Hotfix 2 allow remote attackers to execute arbitrary code via crafted RLE data in a (1) BMP or (2) FLI file, (3) encoded scan lines in a PCX file, or (4) DataSubBlock or (5) GlobalColorTable in a GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T21:00:00.000Z
CVE-2015-8575 
The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-08T02:00:00.000Z
CVE-2015-8577 
The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T18:00:00.000Z
CVE-2015-8578 
AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T18:00:00.000Z
CVE-2015-8579 
Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode processes, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T18:00:00.000Z
CVE-2015-8580 
Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T21:00:00.000Z
CVE-2015-8592 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corruption.
Problem types: description: Untrusted Pointer Dereference in Diag
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-8593 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing.
Problem types: description: Buffer Copy without Checking Size of Input in 1x
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2017-08-18T18:00:00.000Z
CVE-2015-8594 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.
Problem types: description: Buffer Over-read in RFA
Affected products: vendor: Qualcomm, Inc.
product: Snapdragon Mobile, Snapdragon Wear
Published: 2017-08-18T18:00:00.000Z
CVE-2015-8595 
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM.
Problem types: description: Buffer Over-read in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-8596 
In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer lengths is missing in malware protection.
Problem types: description: Improper Input Validation in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2015-8597 
Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-8600 
The SysAdminWebTool servlets in SAP Mobile Platform allow remote attackers to bypass authentication and obtain sensitive information, gain privileges, or have unspecified other impact via unknown vectors, aka SAP Security Note 2227855.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8601 
The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8602 
The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered entity in the main node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-8603 
Cross-site scripting (XSS) vulnerability in Serendipity before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the serendipity[entry_id] parameter in an "edit" admin action to serendipity_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T19:00:00.000Z
CVE-2015-8604 
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T21:00:00.000Z
CVE-2015-8605 
ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-14T22:00:00.000Z
CVE-2015-8606 
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to admin/security/EditForm/field/Members/item/new/ItemEditForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T15:00:00.000Z
CVE-2015-8607 
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-13T15:00:00.000Z
CVE-2015-8608 
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T15:00:00.000Z
CVE-2015-8611 
BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T20:00:00.000Z
CVE-2015-8612 
The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-8613 
Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T19:00:00.000Z
CVE-2015-8614 
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail before 3.13.1 allow remote attackers to have unspecified impact via a crafted email, involving Japanese character set conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T21:00:00.000Z
CVE-2015-8615 
The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-8616 
Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-19T02:00:00.000Z
CVE-2015-8617 
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-19T02:00:00.000Z
CVE-2015-8618 
The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-27T20:00:00.000Z
CVE-2015-8619 
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service (out-of-bounds write and application crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T17:00:00.000Z
CVE-2015-8620 
Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free Antivirus before 11.1.2253 allows local users to gain privileges via a Unicode file path in an IOCTL request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T14:00:00.000Z
CVE-2015-8621 
t-coffee before 11.00.8cbe486-2 allows local users to write to ~/.t_coffee globally.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2015-8622 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-8623 
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-8624 
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-8625 
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-8626 
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z
CVE-2015-8627 
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T20:00:00.000Z