rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-3119 
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-26T01:00:00.000Z
CVE-2016-3120 
The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-01T01:00:00.000Z
CVE-2016-3124 
The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T17:00:00.000Z
CVE-2016-3125 
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-05T20:00:00.000Z
CVE-2016-3126 
Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-22T18:00:00.000Z
CVE-2016-3127 
An information disclosure vulnerability in the logging implementation of BlackBerry Good Control Server versions earlier than 2.3.53.62 allows remote attackers to gain and use logged encryption keys to access certain resources within a customer's Good deployment by gaining access to certain diagnostic log files through either a valid logon or an unrelated compromise of the server.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: BlackBerry Good Control Server versions earlier than 2.3.53.62
Published: 2017-03-03T18:00:00.000Z
CVE-2016-3128 
A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BES, gain access to device parameters for the BES, or send false information to the BES by gaining access to specific information about a device that was legitimately enrolled on the BES.
Problem types: description: spoofing
Affected products: vendor: n/a
product: BES12 versions through 12.5.2
Published: 2017-01-13T09:00:00.000Z
CVE-2016-3129 
A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell.
Problem types: description: remote shell execution
Affected products: vendor: n/a
product: BlackBerry GEMS versions 2.1.5.3 to 2.2.22.25
Published: 2016-12-16T09:02:00.000Z
CVE-2016-3130 
An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the two elements during a login attempt.
Problem types: description: information disclosure
Affected products: vendor: n/a
product: BES12 versions through 12.5.2
Published: 2017-01-13T09:00:00.000Z
CVE-2016-3131 
Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T13:57:45.000Z
CVE-2016-3132 
Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T10:00:00.000Z
CVE-2016-3134 
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-3135 
Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-3136 
The mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device without two interrupt-in endpoint descriptors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3137 
drivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3138 
The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3139 
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-3140 
The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2016-3141 
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-31T16:00:00.000Z
CVE-2016-3142 
The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-31T16:00:00.000Z
CVE-2016-3144 
Cross-site scripting (XSS) vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-15T15:00:00.000Z
CVE-2016-3145 
Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase Printer Memory and Erase Hard Disk actions, which allows physically proximate attackers to obtain sensitive information via direct read operations on non-volatile memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-22T00:00:00.000Z
CVE-2016-3147 
Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-3149 
Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T23:00:00.000Z
CVE-2016-3150 
Cross-site scripting (XSS) vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T23:00:00.000Z
CVE-2016-3151 
Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with firmware before 01.06.02, and CSE-200 devices with firmware before 01.03.02 allows remote attackers to read /etc/shadow via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T23:00:00.000Z
CVE-2016-3152 
Barco ClickShare CSC-1 devices with firmware before 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firmware image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T23:00:00.000Z
CVE-2016-3153 
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3154 
The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3155 
Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-03-18T14:00:00.000Z
CVE-2016-3156 
The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2016-3157 
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T16:00:00.000Z
CVE-2016-3158 
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T16:00:00.000Z
CVE-2016-3159 
The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-13T16:00:00.000Z
CVE-2016-3161 
For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-3161 ID is for the GameStream unquoted service path.
Problem types: description: Escalation of Privileges
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-3162 
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3163 
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3164 
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3165 
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3166 
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3167 
Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3168 
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3169 
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3170 
The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3171 
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T15:00:00.000Z
CVE-2016-3172 
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T16:00:00.000Z
CVE-2016-3173 
An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file (e.g. an image) which gets displayed at the portal application. Using script code at the file name leads to script execution. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Users actively need to add a file to the portal to enable this attack. In case of shared files however, a internal attacker may modify a previously embedded file to carry a malicious file name. Furthermore this vulnerability can be used to persistently execute code that got injected by a temporary script execution vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-3174 
An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end up at an unexpected service later on. This vulnerability can be used to prepare and enhance phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-3176 
Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T19:00:00.000Z
CVE-2016-3177 
Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-3178 
The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-3179 
The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (invalid free and daemon crash) via vectors related to error handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-24T15:00:00.000Z
CVE-2016-3180 
Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verification and execute arbitrary code via a Trojan horse tar file and a signature file with the valid tarball and signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T17:00:00.000Z
CVE-2016-3182 
The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T00:03:03.000Z
CVE-2016-3183 
The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T16:00:00.000Z
CVE-2016-3185 
The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (type confusion and application crash) via crafted serialized _cookies data, related to the SoapClient::__call method in ext/soap/soap.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-16T10:00:00.000Z
CVE-2016-3186 
Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a crafted GIF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-19T14:00:00.000Z
CVE-2016-3187 
The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3188 
The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have unspecified impact, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T14:00:00.000Z
CVE-2016-3189 
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T17:00:00.000Z