rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-7822 
Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the (2) CMSBodyClass cookie variable to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-21T15:00:00.000Z
CVE-2015-7823 
Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-21T15:00:00.000Z
CVE-2015-7824 
botan 1.11.x before 1.11.22 makes it easier for remote attackers to decrypt TLS ciphertext data via a padding-oracle attack against TLS CBC ciphersuites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2015-7825 
botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2015-7826 
botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2015-7827 
Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T14:00:00.000Z
CVE-2015-7828 
SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the (1) fcopydir, (2) fmkdir, (3) frmdir, (4) getenv, (5) dumpenv, (6) fcopy, (7) fput, (8) fdel, (9) fmove, (10) fget, (11) fappend, (12) fdir, (13) getTraces, (14) kill, (15) pexec, (16) stop, or (17) pythonexec method, aka SAP Security Note 2165583.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-10T16:00:00.000Z
CVE-2015-7829 
Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-14T23:00:00.000Z
CVE-2015-7830 
The pcapng_read_if_descr_block function in wiretap/pcapng.c in the pcapng parser in Wireshark 1.12.x before 1.12.8 uses too many levels of pointer indirection, which allows remote attackers to cause a denial of service (incorrect free and application crash) via a crafted packet that triggers interface-filter copying.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-15T02:00:00.000Z
CVE-2015-7831 
In Cloudera Hue, there is privilege escalation by a read-only user when CDH 5.x brefore 5.4.9 is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T13:58:47.000Z
CVE-2015-7833 
The usbvision driver in the Linux kernel package 3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red Hat Enterprise Linux (RHEL) 7.1 allows physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T10:00:00.000Z
CVE-2015-7834 
Multiple unspecified vulnerabilities in Google V8 before 4.6.85.23, as used in Google Chrome before 46.0.2490.71, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T10:00:00.000Z
CVE-2015-7835 
The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-30T15:00:00.000Z
CVE-2015-7836 
Siemens RUGGEDCOM ROS before 4.2.1 allows remote attackers to obtain sensitive information by sniffing the network for VLAN data within the padding section of an Ethernet frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7837 
The Linux kernel, as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended securelevel/secureboot restrictions by leveraging improper handling of secure_boot flag across kexec reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T16:00:00.000Z
CVE-2015-7838 
ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and execute arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T20:00:00.000Z
CVE-2015-7839 
SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonsecurestreamingamf involving the traceroute functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T20:00:00.000Z
CVE-2015-7840 
The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows remote attackers to execute arbitrary code via unspecified vectors involving the ping feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-15T20:00:00.000Z
CVE-2015-7841 
The login page of the server on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allows remote attackers to bypass access restrictions and enter commands via unspecified parameters, as demonstrated by a "user creation command."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T18:00:00.000Z
CVE-2015-7842 
Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-09T14:00:00.000Z
CVE-2015-7843 
The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 does not limit the number of query attempts, which allows remote authenticated users to obtain credentials of higher-level users via a brute force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T18:00:00.000Z
CVE-2015-7844 
Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud desktop to be displaying an error and not usable.
Problem types: description: Insufficient Input Verification
Affected products: vendor: n/a
product: FusionAccess V100R005C10,V100R005C20
Published: 2017-04-02T20:00:00.000Z
CVE-2015-7845 
The exception handling mechanism in the CLI Module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V100R001C20SPH605 allows remote attackers to cause a denial of service (CLI outage) via crafted SSH packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-19T20:00:00.000Z
CVE-2015-7846 
Huawei S7700, S9700, S9300 before V200R07C00SPC500, and AR200, AR1200, AR2200, AR3200 before V200R005C20SPC200 allows attackers with physical access to the CF card to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-7847 
Huawei MBB (Mobile Broadband) product E3272s with software versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00 has a Denial of Service (DoS) vulnerability. An attacker could send a malicious packet to the Common Gateway Interface (CGI) of a target device and make it fail while setting the port attribute, which causes a DoS attack.
Problem types: description: DOS
Affected products: vendor: n/a
product: E3272s Versions earlier than E3272s-153TCPU-V200R002B491D09SP00C00
Published: 2017-04-02T20:00:00.000Z
CVE-2015-7848 
An integer overflow can occur in NTP-dev.4.3.70 leading to an out-of-bounds memory copy operation when processing a specially crafted private mode packet. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-06T21:00:00.000Z
CVE-2015-7849 
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7850 
ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7851 
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T16:35:21.000Z
CVE-2015-7852 
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7853 
The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7854 
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7855 
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7856 
OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-7857 
SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-29T20:00:00.000Z
CVE-2015-7858 
SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7297.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-29T20:00:00.000Z
CVE-2015-7859 
The com_contenthistory component in Joomla! 3.2 before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-29T20:00:00.000Z
CVE-2015-7860 
Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T18:00:00.000Z
CVE-2015-7861 
Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending unspecified commands in an environment that lacks relationship-based firewalling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T18:00:00.000Z
CVE-2015-7862 
Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 improperly implements the Role Based Access Control feature, which might allow remote attackers to modify an account's role assignments via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T18:00:00.000Z
CVE-2015-7863 
The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T18:00:00.000Z
CVE-2015-7865 
nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows does not properly restrict access to the stereosvrpipe named pipe, which allows local users to gain privileges via a commandline in a number 2 command, which is stored in the HKEY_LOCAL_MACHINE explorer Run registry key, a different vulnerability than CVE-2011-4784.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-7866 
Unquoted Windows search path vulnerability in the Smart Maximize Helper (nvSmartMaxApp.exe) in the Control Panel in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows allows local users to gain privileges via a Trojan horse application, as demonstrated by C:\Program.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-7869 
Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access.  NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-7871 
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-7872 
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-16T11:00:00.000Z
CVE-2015-7873 
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7874 
Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-15T15:02:07.000Z
CVE-2015-7875 
ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2015-7876 
The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-21T14:00:00.000Z
CVE-2015-7877 
Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T17:00:00.000Z
CVE-2015-7878 
Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-06T17:00:00.000Z
CVE-2015-7879 
Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-11T17:00:00.000Z
CVE-2015-7880 
The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T16:00:00.000Z
CVE-2015-7881 
The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-26T14:00:00.000Z
CVE-2015-7882 Authentication bypass when using LDAP authentication in MongoDB Enterprise Server
Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-19T15:44:44.000Z
CVE-2015-7884 
The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-28T11:00:00.000Z
CVE-2015-7885 
The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-28T11:00:00.000Z
CVE-2015-7886 
NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-18T02:00:00.000Z
CVE-2015-7887 
NetApp SnapCenter Server 1.0 allows remote authenticated users to list and delete backups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2015-7888 
Directory traversal vulnerability in the WifiHs20UtilityService on the Samsung S6 Edge LRX22G.G925VVRU1AOE2 allows remote attackers to overwrite or create arbitrary files as the system-level user via a .. (dot dot) in the name of a file, compressed into a zipped file named cred.zip, and downloaded to /sdcard/Download.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T14:00:00.000Z