rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-6731 
Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6732 
Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the (1) wpSummary parameter to Special:FormEdit, the (2) "Template label (optional)" field in a form, or a (3) Field name in a template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6733 
GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6734 
Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6735 
The reset functionality in the TimedMediaHandler extension for MediaWiki does not create a new transcode, which allows remote attackers to cause a denial of service (transcode deletion) by resetting a transcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6736 
The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6737 
Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-01T14:00:00.000Z
CVE-2015-6742 
Basware Banking (Maksuliikenne) before 8.90.07.X uses a hardcoded password for the ANCO account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6743 
Basware Banking (Maksuliikenne) 8.90.07.X uses a hardcoded password for an unspecified account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability types and different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6744 
Basware Banking (Maksuliikenne) before 8.90.07.X relies on the client to enforce (1) login verification, (2) audit trail creation, and (3) account locking, which allows remote attackers to "disrupt security-critical functions" by "dropping network traffic." NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6745 
Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6746 
Basware Banking (Maksuliikenne) before 8.90.07.X stores private keys in plaintext in the SQL database, which allows remote attackers to spoof communications with banks via unspecified vectors.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6747 
Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors.  NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T14:08:00.000Z
CVE-2015-6748 
Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T17:00:00.000Z
CVE-2015-6749 
Buffer overflow in the aiff_open function in oggenc/audio.c in vorbis-tools 1.4.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted AIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-21T19:00:00.000Z
CVE-2015-6750 
Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T15:00:00.000Z
CVE-2015-6751 
Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) note added to a time entry or an (2) activity used to categorize time tracker entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2015-6752 
Cross-site scripting (XSS) vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the returned suggestions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T18:00:00.000Z
CVE-2015-6753 
Multiple cross-site scripting (XSS) vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an (1) entity title, related to in-place editing, or a (2) node title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T19:00:00.000Z
CVE-2015-6754 
Cross-site scripting (XSS) vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T19:00:00.000Z
CVE-2015-6755 
The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6756 
Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6757 
Use-after-free vulnerability in content/browser/service_worker/embedded_worker_instance.cc in the ServiceWorker implementation in Google Chrome before 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6758 
The CPDF_Document::GetPage function in fpdfapi/fpdf_parser/fpdf_parser_document.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, does not properly perform a cast of a dictionary object, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6759 
The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6760 
The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6761 
The update_dimensions function in libavcodec/vp8.c in FFmpeg through 2.8.1, as used in Google Chrome before 46.0.2490.71 and other products, relies on a coefficient-partition count during multi-threaded operation, which allows remote attackers to cause a denial of service (race condition and memory corruption) or possibly have unspecified other impact via a crafted WebM file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6762 
The CSSFontFaceSrcValue::fetch function in core/css/CSSFontFaceSrcValue.cpp in the Cascading Style Sheets (CSS) implementation in Blink, as used in Google Chrome before 46.0.2490.71, does not use the CORS cross-origin request algorithm when a font's URL appears to be a same-origin URL, which allows remote web servers to bypass the Same Origin Policy via a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6763 
Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-6764 
The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6765 
Use-after-free vulnerability in content/browser/appcache/appcache_update_job.cc in Google Chrome before 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by leveraging the mishandling of AppCache update jobs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6766 
Use-after-free vulnerability in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6767 
Use-after-free vulnerability in content/browser/appcache/appcache_dispatcher_host.cc in the AppCache implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect pointer maintenance associated with certain callbacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6768 
The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6769 
The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6770 
The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6768.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6771 
js/array.js in Google V8, as used in Google Chrome before 47.0.2526.73, improperly implements certain map and filter operations for arrays, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6772 
The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6773 
The convolution implementation in Skia, as used in Google Chrome before 47.0.2526.73, does not properly constrain row lengths, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted graphics data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6774 
Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6775 
fpdfsdk/src/jsapi/fxjs_v8.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, does not use signatures, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6776 
The opj_dwt_decode_1* functions in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 47.0.2526.73, allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during a discrete wavelet transform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6777 
Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6778 
The CJBig2_SymbolDict class in fxcodec/jbig2/JBig2_SymbolDict.cpp in PDFium, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a PDF document containing crafted data with JBIG2 compression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6779 
PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6780 
Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/website_settings/website_settings_popup_view.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6781 
Integer overflow in the FontData::Bound function in data/font_data.cc in Google sfntly, as used in Google Chrome before 47.0.2526.73, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted offset or length value within font data in an SFNT container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6782 
The Document::open function in WebKit/Source/core/dom/Document.cpp in Google Chrome before 47.0.2526.73 does not ensure that page-dismissal event handling is compatible with modal-dialog blocking, which makes it easier for remote attackers to spoof Omnibox content via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6783 
The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6784 
The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web (MOTW) comments for URLs containing a "--" sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6785 
The CSPSource::hostMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts an x.y hostname as a match for a *.x.y pattern, which might allow remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a policy that was intended to be specific to subdomains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6786 
The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6787 
Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T01:00:00.000Z
CVE-2015-6788 
The ObjectBackedNativeHandler class in extensions/renderer/object_backed_native_handler.cc in the extensions subsystem in Google Chrome before 47.0.2526.80 improperly implements handler functions, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-14T11:00:00.000Z
CVE-2015-6789 
Race condition in the MutationObserver implementation in Blink, as used in Google Chrome before 47.0.2526.80, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact by leveraging unanticipated object deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-14T11:00:00.000Z
CVE-2015-6790 
The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as demonstrated by a double-quote character inside a single-quoted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-14T11:00:00.000Z
CVE-2015-6791 
Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.80 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-14T11:00:00.000Z
CVE-2015-6792 
The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to midi_manager.cc, midi_manager_alsa.cc, and midi_manager_mac.cc, a different vulnerability than CVE-2015-8664.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-24T02:00:00.000Z