rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1296 
The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1297 
The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1298 
The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1299 
Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1300 
The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1301 
Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T22:00:00.000Z
CVE-2015-1302 
The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-11T11:00:00.000Z
CVE-2015-1303 
bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-12T01:00:00.000Z
CVE-2015-1304 
object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-12T01:00:00.000Z
CVE-2015-1305 
McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted (1) 0x00224014 or (2) 0x0022c018 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T15:00:00.000Z
CVE-2015-1306 
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T15:00:00.000Z
CVE-2015-1307 
plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2015-1308 
kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2015-1309 
XML external entity vulnerability in the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATT_DISPLAY_XMLSTRING_REMOTE, aka SAP Note 2016638.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T16:00:00.000Z
CVE-2015-1310 
SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Note 2113333.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T16:00:00.000Z
CVE-2015-1311 
The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T16:00:00.000Z
CVE-2015-1312 
The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T16:00:00.000Z
CVE-2015-1313 
JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.
Problem types: description: CWE-20: Improper Input Validation
Affected products: vendor: JetBrains
product: TeamCity
Published: 2023-06-29T14:07:44.700Z
CVE-2015-1314 
The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-16T23:00:00.000Z
CVE-2015-1315 
Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-23T17:00:00.000Z
CVE-2015-1316 Juju Joyent provider uploads user's private ssh key by default
Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
Problem types: description: Unsafe default behaviour exposed private credentials.
Affected products: vendor: Ubuntu
product: Juju
Published: 2019-04-22T15:35:59.130Z
CVE-2015-1317 
Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T18:00:00.000Z
CVE-2015-1318 
The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-17T17:00:00.000Z
CVE-2015-1319 
The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-1320 Probe-and-enlist for SeaMicro chassis writes password to the log
The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2.
Problem types: description: Password logged in log file.
Affected products: vendor: Ubuntu
product: MAAS
Published: 2019-04-22T15:35:59.171Z
CVE-2015-1321 
Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-29T20:00:00.000Z
CVE-2015-1322 
Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-29T20:00:00.000Z
CVE-2015-1323 
The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-1324 
Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2015-1325 
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-25T18:00:00.000Z
CVE-2015-1326 python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmp
python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
Problem types: description: Untrusted compiled bytecode
Affected products: vendor: Ubuntu
product: python-dbusmock
Credits: lang: en
value: Simon McVittie
Published: 2019-04-22T15:35:59.213Z
CVE-2015-1327 Content-hub DBUS API doesn't prevent confined apps from passing paths to files without access
Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Problem types: description: Missing access control checks.
Affected products: vendor: Ubuntu
product: Content Hub
Published: 2019-04-22T15:35:59.250Z
CVE-2015-1328 
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-28T03:01:00.000Z
CVE-2015-1329 
Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T16:00:00.000Z
CVE-2015-1330 
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-01T14:00:00.000Z
CVE-2015-1331 
lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-1332 
The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-1333 
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2015-1334 
attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-1335 
lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T20:00:00.000Z
CVE-2015-1336 
The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-27T15:00:00.000Z
CVE-2015-1337 
Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-09T14:00:00.000Z
CVE-2015-1338 
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T20:00:00.000Z
CVE-2015-1339 
Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-27T17:00:00.000Z
CVE-2015-1340 chmod race in doUidshiftIntoContainer
LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Problem types: description: Race condition.
Affected products: vendor: Ubuntu
product: LXD
Published: 2019-04-22T15:35:59.288Z
CVE-2015-1341 Apport privilege escalation through Python module imports
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
Problem types: description: Parsing a Python module by executing the module.
Affected products: vendor: Ubuntu
product: Apport
Credits: lang: en
value: Gabriel Campana
Published: 2019-04-22T15:35:59.329Z
CVE-2015-1342 
LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-07T20:00:00.000Z
CVE-2015-1343 unity-scope-gdrive search feature logs search terms to syslog
All versions of unity-scope-gdrive logs search terms to syslog.
Problem types: description: Logging private data.
Affected products: vendor: Ubuntu
product: unity-scope-gdrive
Credits: lang: en
value: Lasse Hietala
Published: 2019-04-22T15:35:59.371Z
CVE-2015-1344 
The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-07T20:00:00.000Z
CVE-2015-1345 
The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-12T16:00:00.000Z
CVE-2015-1346 
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T22:00:00.000Z
CVE-2015-1347 
Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2015-1348 
Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-03T16:00:00.000Z
CVE-2015-1349 
named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T02:00:00.000Z
CVE-2015-1350 
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2015-1351 
Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2015-1352 
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T10:00:00.000Z
CVE-2015-1355 
Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-18T02:00:00.000Z
CVE-2015-1356 
Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-18T02:00:00.000Z
CVE-2015-1357 
Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-02T15:00:00.000Z
CVE-2015-1358 
The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-18T02:00:00.000Z