rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-10125 
D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking an HTTPS session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-09T17:00:00.000Z
CVE-2016-10126 
Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4 allows remote attackers to conduct HTTP request injection attacks and obtain sensitive REST API authentication-token information via unspecified vectors, aka SPL-128840.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-10T11:00:00.000Z
CVE-2016-10127 
PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T15:00:00.000Z
CVE-2016-10128 
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10129 
The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10130 
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10131 
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T06:06:00.000Z
CVE-2016-10132 
regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to regular expression compilation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10133 
Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified impact by leveraging an error when dropping extra arguments to lightweight functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10134 
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T18:00:00.000Z
CVE-2016-10135 
An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BLU R1 HD devices. The MTKLogger app with a package name of com.mediatek.mtklogger has application components that are accessible to any application that resides on the device. Namely, the com.mediatek.mtklogger.framework.LogReceiver and com.mediatek.mtklogger.framework.MTKLoggerService application components are exported since they contain an intent filter, are not protected by a custom permission, and do not explicitly set the android:exported attribute to false. Therefore, these components are exported by default and are thus accessible to any third party application by using android.content.Intent object for communication. These application components can be used to start and stop the logs using Intent objects with embedded data. The available logs are the GPS log, modem log, network log, and mobile log. The base directory that contains the directories for the 4 types of logs is /sdcard/mtklog which makes them accessible to apps that require the READ_EXTERNAL_STORAGE permission. The GPS log contains the GPS coordinates of the user as well as a timestamp for the coordinates. The modem log contains AT commands and their parameters which allow the user's outgoing and incoming calls and text messages to be obtained. The network log is a tcpdump network capture. The mobile log contains the Android log, which is not available to third-party apps as of Android 4.1. The LG ID is LVE-SMP-160019.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10136 
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete files owned by the system user. The third-party app can modify the /data/system/users/0/settings_secure.xml file to add an app as a notification listener to be able to receive the text of notifications as they are received on the device. This also allows the /data/system/users/0/accounts.db to be read which contains authentication tokens for various accounts on the device. The third-party app can obtain privileged information and also modify files to obtain more privileges on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10137 
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app with a package name of com.adups.fota.sysoper allows any app on the device to read, write, and delete files as the system user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. This allows a third-party app to read, write, and delete the user's sent and received text messages and call log. This allows a third-party app to obtain PII from the user without permission to do so.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10138 
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. The app has an exported broadcast receiver named com.adups.fota.sysoper.WriteCommandReceiver which any app on the device can interact with. Therefore, any app can send a command embedded in an intent which will be executed by the WriteCommandReceiver component which is executing as the system user. The third-party app, utilizing the WriteCommandReceiver, can perform the following actions: call a phone number, factory reset the device, take pictures of the screen, record the screen in a video, install applications, inject events, obtain the Android log, and others. In addition, the com.adups.fota.sysoper.TaskService component will make a request to a URL of http://rebootv5.adsunflower.com/ps/fetch.do where the commands in the String array with a key of sf in the JSON Object sent back by the server will be executed as the system user. Since the connection is made via HTTP, it is vulnerable to a MITM attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10139 
An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups.fota.sysoper. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute to a value of android.uid.system which makes it execute as the system user, which is a very privileged user on the device. Therefore, the app executing as the system user has been granted a number of powerful permissions even though they are not present in the com.adups.fota.sysoper app's AndroidManifest.xml file. This app provides the com.adups.fota app access to the user's call log, text messages, and various device identifiers through the com.adups.fota.sysoper.provider.InfoProvider component. The com.adups.fota app uses timestamps when it runs and is eligible to exfiltrate the user's PII every 72 hours. If 72 hours have passed since the value of the timestamp, then the exfiltration will be triggered by the user plugging in the device to charge or when they leave or enter a wireless network. The exfiltration occurs in the background without any user interaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10140 
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10141 
An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b2045. The attack requires a regular expression with nested repetition. A successful exploitation of this issue can lead to code execution or a denial of service (buffer overflow) condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T09:00:00.000Z
CVE-2016-10142 
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implementations from all vendors.) The security implications of IP fragmentation have been discussed at length in [RFC6274] and [RFC7739]. An attacker can leverage the generation of IPv6 atomic fragments to trigger the use of fragmentation in an arbitrary IPv6 flow (in scenarios in which actual fragmentation of packets is not needed) and can subsequently perform any type of fragmentation-based attack against legacy IPv6 nodes that do not implement [RFC6946]. That is, employing fragmentation where not actually needed allows for fragmentation-based attack vectors to be employed, unnecessarily. We note that, unfortunately, even nodes that already implement [RFC6946] can be subject to DoS attacks as a result of the generation of IPv6 atomic fragments. Let us assume that Host A is communicating with Host B and that, as a result of the widespread dropping of IPv6 packets that contain extension headers (including fragmentation) [RFC7872], some intermediate node filters fragments between Host B and Host A. If an attacker sends a forged ICMPv6 PTB error message to Host B, reporting an MTU smaller than 1280, this will trigger the generation of IPv6 atomic fragments from that moment on (as required by [RFC2460]). When Host B starts sending IPv6 atomic fragments (in response to the received ICMPv6 PTB error message), these packets will be dropped, since we previously noted that IPv6 packets with extension headers were being dropped between Host B and Host A. Thus, this situation will result in a DoS scenario. Another possible scenario is that in which two BGP peers are employing IPv6 transport and they implement Access Control Lists (ACLs) to drop IPv6 fragments (to avoid control-plane attacks). If the aforementioned BGP peers drop IPv6 fragments but still honor received ICMPv6 PTB error messages, an attacker could easily attack the corresponding peering session by simply sending an ICMPv6 PTB message with a reported MTU smaller than 1280 bytes. Once the attack packet has been sent, the aforementioned routers will themselves be the ones dropping their own traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-14T06:56:00.000Z
CVE-2016-10143 
A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-20T08:39:00.000Z
CVE-2016-10144 
coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10145 
Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10146 
Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-10147 
crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_ALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T21:00:00.000Z
CVE-2016-10148 
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T21:00:00.000Z
CVE-2016-10149 
XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T14:00:00.000Z
CVE-2016-10150 
Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2016-10151 
The hesiod_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment variables, which allows local users to gain privileges via the (1) HESIOD_CONFIG or (2) HES_DOMAIN environment variable and leveraging certain SUID/SGUID binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T20:00:00.000Z
CVE-2016-10152 
The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 falls back to the ".athena.mit.edu" default domain when opening the configuration file fails, which allows remote attackers to gain root privileges by poisoning the DNS cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-28T14:00:00.000Z
CVE-2016-10153 
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2016-10154 
The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2016-10155 
Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2016-10156 
A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root. This is fixed in v229.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T06:49:00.000Z
CVE-2016-10157 
Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T06:49:00.000Z
CVE-2016-10158 
The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T21:00:00.000Z
CVE-2016-10159 
Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T21:00:00.000Z
CVE-2016-10160 
Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T21:00:00.000Z
CVE-2016-10161 
The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T21:00:00.000Z
CVE-2016-10162 
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-24T21:00:00.000Z
CVE-2016-10163 
Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (host memory consumption) by repeatedly creating a decode context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2016-10164 
Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via (1) the number of extensions or (2) their concatenated length in a crafted XPM file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-01T15:00:00.000Z
CVE-2016-10165 
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T19:00:00.000Z
CVE-2016-10166 
Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors related to decrementing the u variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2016-10167 
The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2016-10168 
Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T15:00:00.000Z
CVE-2016-10169 
The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2016-10170 
The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2016-10171 
The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2016-10172 
The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-14T14:00:00.000Z
CVE-2016-10173 
Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via a .. (dot dot) in a TAR archive entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-01T15:00:00.000Z