rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-5117 
OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T19:00:00.000Z
CVE-2016-5118 
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-5119 
The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response and supplying a crafted update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-5124 
An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially crafted website and add it to HTML editor areas of OX App Suite, for example E-Mail Compose or OX Text. This specific attack circumvents typical XSS filters and detection mechanisms since the code is not loaded from an external service but injected locally. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). To exploit this vulnerability, a attacker needs to convince a user to follow specific steps (social-engineering).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-5126 
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T22:00:00.000Z
CVE-2016-5127 
Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5128 
objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5129 
Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5130 
content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5131 
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5132 
The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5133 
Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5134 
net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5135 
WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5136 
Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5137 
The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.  NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-23T19:00:00.000Z
CVE-2016-5138 
Integer overflow in the kbasep_vinstr_attach_client function in midgard/mali_kbase_vinstr.c in Google Chrome before 52.0.2743.85 allows remote attackers to cause a denial of service (heap-based buffer overflow and use-after-free) by leveraging an unrestricted multiplication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-01T01:00:00.000Z
CVE-2016-5139 
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5140 
Heap-based buffer overflow in the opj_j2k_read_SQcd_SQcc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5141 
Blink, as used in Google Chrome before 52.0.2743.116, allows remote attackers to spoof the address bar via vectors involving a provisional URL for an initially empty document, related to FrameLoader.cpp and ScopedPageLoadDeferrer.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5142 
The Web Cryptography API (aka WebCrypto) implementation in Blink, as used in Google Chrome before 52.0.2743.116, does not properly copy data buffers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code, related to NormalizeAlgorithm.cpp and SubtleCrypto.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5143 
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5144.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5144 
The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter, which allows remote attackers to bypass intended access restrictions via a crafted URL, a different vulnerability than CVE-2016-5143.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5145 
Blink, as used in Google Chrome before 52.0.2743.116, does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5146 
Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.116 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T19:00:00.000Z
CVE-2016-5147 
Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5148 
Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML via vectors related to widget updates, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5149 
The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension, which allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5150 
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, has an Indexed Database (aka IndexedDB) API implementation that does not properly restrict key-path evaluation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code that leverages certain side effects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5151 
PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted PDF document, related to fpdfsdk/javascript/JS_Object.cpp and fpdfsdk/javascript/app.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5152 
Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5153 
The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relies on list iteration, which allows remote attackers to cause a denial of service (use-after-destruction) or possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5154 
Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JBig2 image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5155 
Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5156 
extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5157 
Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5158 
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5159 
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5160 
The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks, and trick users into changing extension settings, via a crafted web site, a different vulnerability than CVE-2016-5162.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5161 
The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site that leverages "type confusion" in the StylePropertySerializer class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5162 
The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json web_accessible_resources field for restrictions on IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks, and trick users into changing extension settings, via a crafted web site, a different vulnerability than CVE-2016-5160.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5163 
The bidirectional-text implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not ensure left-to-right (LTR) rendering of URLs, which allows remote attackers to spoof the address bar via crafted right-to-left (RTL) Unicode text, related to omnibox/SuggestionView.java and omnibox/UrlBar.java in Chrome for Android.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5164 
Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to inject arbitrary web script or HTML into the Developer Tools (aka DevTools) subsystem via a crafted web site, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5165 
Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allows remote attackers to inject arbitrary web script or HTML via the settings parameter in a chrome-devtools-frontend.appspot.com URL's query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5166 
The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5167 
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-11T10:00:00.000Z
CVE-2016-5168 
Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-21T20:00:00.000Z
CVE-2016-5169 
Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5170 
WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effects during array key conversion, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted Indexed Database (aka IndexedDB) API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5171 
WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5172 
The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5173 
The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load unintended resources, and consequently trigger unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5174 
browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers to cause a denial of service (unsuppressed popup) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5175 
Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-25T20:00:00.000Z
CVE-2016-5176 
Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-29T10:00:00.000Z