rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-3644 
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3645 
Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to have an unspecified impact via crafted TNEF data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3646 
The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3647 
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3648 
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3649 
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3650 
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3651 
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3652 
Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3653 
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T23:00:00.000Z
CVE-2016-3654 
The device management command line interface (CLI) in Palo Alto Networks PAN-OS before 5.0.18, 5.1.x before 5.1.11, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote authenticated administrators to execute arbitrary OS commands via an SSH command parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T17:00:00.000Z
CVE-2016-3655 
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T17:00:00.000Z
CVE-2016-3656 
The GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5H2 allows remote attackers to cause a denial of service (service crash) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T17:00:00.000Z
CVE-2016-3657 
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T17:00:00.000Z
CVE-2016-3658 
The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T16:00:00.000Z
CVE-2016-3659 
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2016-3664 
Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-23T19:00:00.000Z
CVE-2016-3670 
Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T14:00:00.000Z
CVE-2016-3672 
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-3674 
Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-17T14:00:00.000Z
CVE-2016-3675 
SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to system databases.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2016-3676 
Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept, spoof, or modify network traffic via unspecified vectors related to a fake network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2016-3677 
The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T14:00:00.000Z
CVE-2016-3678 
Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers to cause a denial of service (switch restart) via crafted traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2016-3679 
Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-29T10:00:00.000Z
CVE-2016-3680 
Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03020.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-26T16:00:00.000Z
CVE-2016-3681 
Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03021.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-26T16:00:00.000Z
CVE-2016-3684 
SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-14T22:00:00.000Z
CVE-2016-3685 
SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of a hardcoded key in the program code and a computer BIOS serial number, aka SAP Security Note 2282338.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-14T22:00:00.000Z
CVE-2016-3686 
The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote attackers to obtain sensitive SessionId information by leveraging access to the Location HTTP header in a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T16:00:00.000Z
CVE-2016-3687 
Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-on (SSO), allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in the SSO_ORIG_URI parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-16T18:00:00.000Z
CVE-2016-3688 
SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-19T14:00:00.000Z
CVE-2016-3689 
The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3690 
The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T18:00:00.000Z
CVE-2016-3691 
Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2016-3693 
The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-20T14:00:00.000Z
CVE-2016-3694 
Multiple SQL injection vulnerabilities in modified eCommerce Shopsoftware 2.0.0.0 revision 9678, when the easybill-module is not installed, allow remote attackers to execute arbitrary SQL commands via the (1) orders_status or (2) customers_status parameter to api/easybill/easybillcsv.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T19:00:00.000Z
CVE-2016-3695 
The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-29T15:00:00.000Z
CVE-2016-3696 
The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T16:00:00.000Z
CVE-2016-3697 
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T20:00:00.000Z
CVE-2016-3698 
libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T19:00:00.000Z
CVE-2016-3699 
The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-07T14:00:00.000Z
CVE-2016-3702 
Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T20:00:00.000Z
CVE-2016-3703 
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-08T17:00:00.000Z
CVE-2016-3704 
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-13T17:00:00.000Z
CVE-2016-3705 
The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-17T14:00:00.000Z
CVE-2016-3706 
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-3707 
The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Real Time 7 and other products, allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a cookie, or an attack that occurs after reading the local icmp_echo_sysrq file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-3708 
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-08T17:00:00.000Z
CVE-2016-3709 
Possible cross-site scripting vulnerability in libxml after commit 960f0e2.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: libxml2
Published: 2022-07-28T16:52:17.000Z
CVE-2016-3710 
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-11T21:00:00.000Z
CVE-2016-3711 
HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-08T17:00:00.000Z
CVE-2016-3712 
Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-11T21:00:00.000Z
CVE-2016-3713 
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-3714 
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-05T18:00:00.000Z
CVE-2016-3715 
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-05T18:00:00.000Z
CVE-2016-3716 
The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-05T18:00:00.000Z
CVE-2016-3717 
The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-05T18:00:00.000Z