rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-8958 
coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2015-8959 
coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-20T18:00:00.000Z
CVE-2015-8960 
The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T01:00:00.000Z
CVE-2015-8961 
The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-16T04:49:00.000Z
CVE-2015-8962 
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-16T04:49:00.000Z
CVE-2015-8963 
Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-16T04:49:00.000Z
CVE-2015-8964 
The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by reading a tty data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-16T04:49:00.000Z
CVE-2015-8965 
Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such as test code or administration code. The issue exists because the ilog.views.faces.IlvFacesController servlet in jviews-framework-all.jar does not require explicit configuration of servlets that can be called.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-06T21:00:00.000Z
CVE-2015-8966 
arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-08T21:00:00.000Z
CVE-2015-8967 
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-08T21:00:00.000Z
CVE-2015-8968 
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: n/a
product: git-fastclone ruby gem All versions before 1.0.1
Published: 2016-11-03T10:00:00.000Z
CVE-2015-8969 
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: n/a
product: git-fastclone ruby gem All versions before 1.0.5
Published: 2016-11-03T10:00:00.000Z
CVE-2015-8970 
crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-28T03:01:00.000Z
CVE-2015-8971 
Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal, a similar issue to CVE-2003-0063.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2015-8972 
Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-dependent attackers to execute arbitrary code via a large input, as demonstrated when in UCI mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2015-8973 
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2015-8974 
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2015-8975 
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2015-8976 
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2015-8977 
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2015-8978 
In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing the XML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T17:00:00.000Z
CVE-2015-8979 
Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a long string sent to TCP port 4242.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T15:00:00.000Z
CVE-2015-8980 
The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.
Problem types: description: Other
Affected products: vendor: n/a
product: php-gettext
Published: 2019-11-04T20:27:33.000Z
CVE-2015-8981 
Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-16T15:00:00.000Z
CVE-2015-8982 
Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T19:00:00.000Z
CVE-2015-8983 
Integer overflow in the _IO_wstr_overflow function in libio/wstrops.c in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors related to computing a size in bytes, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2015-8984 
The fnmatch function in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash) via a malformed pattern, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2015-8985 
The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2015-8986 
Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.
Problem types: description: Sandbox detection evasion vulnerability
Affected products: vendor: Intel
product: Advanced Threat Defense (MATD)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8987 
Man-in-the-middle (MitM) attack vulnerability in non-Mac OS agents in McAfee (now Intel Security) Agent (MA) 4.8.0 patch 2 and earlier allows attackers to make a McAfee Agent talk with another, possibly rogue, ePO server via McAfee Agent migration to another ePO server.
Problem types: description: Man-in-the-middle (MitM) attack vulnerability
Affected products: vendor: Intel
product: Agent (MA)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8988 
Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
Problem types: description: Unquoted executable path vulnerability
Affected products: vendor: Intel
product: ePO Deep Command (eDC)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8989 
Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
Problem types: description: Unsalted password vulnerability
Affected products: vendor: Intel
product: McAfee Vulnerability Manager (MVM)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8990 
Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
Problem types: description: Detection bypass vulnerability
Affected products: vendor: Intel
product: Advanced Threat Defense (ATD)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8991 
Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
Problem types: description: Malicious file execution vulnerability
Affected products: vendor: Intel
product: McAfee Security Scan+ (MSS+)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8992 
Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
Problem types: description: Malicious file execution vulnerability
Affected products: vendor: Intel
product: WebAdvisor
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8993 
Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation.
Problem types: description: Malicious file execution vulnerability
Affected products: vendor: Intel
product: CloudAV (Beta)
Published: 2017-03-14T22:00:00.000Z
CVE-2015-8994 
An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T06:00:00.000Z
CVE-2015-8995 
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Problem types: description: Integer Overflow Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-8996 
In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel.
Problem types: description: Time-of-check Time-of-use Race Condition in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-8997 
In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel.
Problem types: description: Time-of-check Time-of-use Race Condition in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-8998 
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Problem types: description: Integer Overflow Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-8999 
In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file.
Problem types: description: Buffer Overflow Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-9000 
In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
Problem types: description: Untrusted Pointer Dereference in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-9001 
In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Problem types: description: Information Exposure Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-9002 
In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel.
Problem types: description: Use of Out-of-range Pointer Offset in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-9003 
In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.
Problem types: description: Cryptographic Issues in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm Products
Published: 2017-05-16T14:00:00.000Z
CVE-2015-9004 
kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-02T21:00:00.000Z
CVE-2015-9005 
In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist.
Problem types: description: Integer Overflow to Buffer Overflow Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-06T14:00:00.000Z
CVE-2015-9006 
In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist.
Problem types: description: Improper Access Control Vulnerability in Resource Power Manager
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-06T14:00:00.000Z
CVE-2015-9007 
In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist.
Problem types: description: Double Free Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-06T14:00:00.000Z
CVE-2015-9008 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9009 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393600.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9010 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9011 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9012 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9013 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9014 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9015 
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-04T18:00:00.000Z
CVE-2015-9016 
In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2018-04-05T18:00:00.000Z
CVE-2015-9019 
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-05T21:00:00.000Z
CVE-2015-9020 
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory.
Problem types: description: Untrusted Pointer Dereference Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z
CVE-2015-9021 
In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled.
Problem types: description: Improper Access Control Vulnerability in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-06-13T20:00:00.000Z