rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-2354 
The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-22T00:00:00.000Z
CVE-2016-2355 
SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-19T22:00:00.000Z
CVE-2016-2356 
Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password.
Problem types: description: buffer overflow
Affected products: vendor: Milesight
product: IP security cameras
Published: 2019-10-25T12:46:38.000Z
CVE-2016-2357 
Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.
Problem types: description: hardcoded key
Affected products: vendor: Milesight
product: IP security cameras
Published: 2019-10-25T12:46:48.000Z
CVE-2016-2358 
Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts.
Problem types: description: default accounts
Affected products: vendor: Milesight
product: IP security cameras
Published: 2019-10-25T12:46:09.000Z
CVE-2016-2359 
Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.
Problem types: description: incorrect access control
Affected products: vendor: Milesight
product: IP security cameras
Published: 2019-10-25T12:46:27.000Z
CVE-2016-2360 
Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations.
Problem types: description: default password
Affected products: vendor: Milesight
product: IP security cameras
Published: 2019-10-25T12:45:38.000Z
CVE-2016-2362 
Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-20T01:00:00.000Z
CVE-2016-2363 
Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-20T01:00:00.000Z
CVE-2016-2364 
The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-20T01:00:00.000Z
CVE-2016-2365 
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
Problem types: description: null pointer dereference
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2366 
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2367 
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2368 
Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
Problem types: description: buffer overflow
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2369 
A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
Problem types: description: null pointer dereference
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2370 
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2371 
An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
Problem types: description: out-of-bounds write
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2372 
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2373 
A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2374 
An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.
Problem types: description: out-of-bounds write
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2375 
An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2376 
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.
Problem types: description: buffer overflow
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2377 
A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
Problem types: description: off-by-one write
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2378 
A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.
Problem types: description: buffer overflow
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2379 
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T20:00:00.000Z
CVE-2016-2380 
An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.
Problem types: description: out-of-bounds read
Affected products: vendor: Pidgin
product: Pidgin
Published: 2017-01-06T21:00:00.000Z
CVE-2016-2381 
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T15:00:00.000Z
CVE-2016-2383 
The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-2384 
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-2385 
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T15:00:00.000Z
CVE-2016-2386 
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-16T15:00:00.000Z
CVE-2016-2387 
Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-16T15:00:00.000Z
CVE-2016-2388 
The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-16T15:00:00.000Z
CVE-2016-2389 
Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-16T15:00:00.000Z
CVE-2016-2390 
The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-19T21:00:00.000Z
CVE-2016-2391 
The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-16T18:00:00.000Z
CVE-2016-2392 
The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-16T18:00:00.000Z
CVE-2016-2393 
Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local users to gain privileges by invalidating local checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T14:00:00.000Z
CVE-2016-2396 
The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.
Problem types: description: Other
Affected products: vendor: n/a
product: n/a
Published: 2016-02-17T15:00:00.000Z
CVE-2016-2397 
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-17T15:00:00.000Z
CVE-2016-2398 
Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-17T16:00:00.000Z
CVE-2016-2399 
Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-2402 
OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-2403 
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T17:00:00.000Z
CVE-2016-2404 
Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R006C00; S12700 with software V200R005C00SPC500, V200R006C00; ACU2 with software V200R005C00SPC500, V200R006C00 have a permission control vulnerability. If a switch enables Authentication, Authorization, and Accounting (AAA) for permission control and user permissions are not appropriate, AAA users may obtain the virtual type terminal (VTY) access permission, resulting in privilege escalation.
Problem types: description: Permission Control
Affected products: vendor: n/a
product: S5700, S6700, S7700, S9700,S12700,ACU2,, S5700, S6700, S7700, S9700 V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R006C00,,S12700 V200R005C00SPC500, V200R006C00,,ACU2 V200R005C00SPC500, V200R006C00,
Published: 2017-04-02T20:00:00.000Z
CVE-2016-2405 
Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T17:00:00.000Z
CVE-2016-2406 
The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2016-2408 
Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-02T16:00:00.000Z
CVE-2016-2409 
A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 25981545.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2410 
A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2411 
A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages root access, aka internal bug 26866053.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2412 
include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, mishandles certain crashes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26593930.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2413 
media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2414 
The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2415 
exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, aka internal bug 26488455.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2416 
libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2417 
media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2418 
media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z
CVE-2016-2419 
media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-18T00:00:00.000Z