rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-5213 
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a long DOC file, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-10T16:00:00.000Z
CVE-2015-5214 
LibreOffice before 4.4.6 and 5.x before 5.0.1 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via an index to a non-existent bookmark in a DOC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-10T16:00:00.000Z
CVE-2015-5215 
The default configuration of the Jinja templating engine used in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not enable auto-escaping, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via template variables. NOTE: This may be a duplicate of CVE-2015-5216. Moreover, the Jinja development team does not enable auto-escape by default for performance issues as explained in https://jinja.palletsprojects.com/en/master/faq/#why-is-autoescaping-not-the-default.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: Ipsilon
Published: 2020-02-17T00:00:00.000Z
CVE-2015-5216 
The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: Ipsilon
Published: 2020-02-17T18:16:41.000Z
CVE-2015-5217 
providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-17T15:00:00.000Z
CVE-2015-5218 
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-09T16:00:00.000Z
CVE-2015-5219 
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-5220 
The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-27T16:00:00.000Z
CVE-2015-5221 
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-5222 
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-24T14:00:00.000Z
CVE-2015-5223 
OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-26T17:00:00.000Z
CVE-2015-5224 
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-23T15:00:00.000Z
CVE-2015-5225 
Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a denial of service (heap memory corruption and process crash) or possibly execute arbitrary code on the host via unspecified vectors, related to refreshing the server display surface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-06T21:00:00.000Z
CVE-2015-5227 
The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T20:00:00.000Z
CVE-2015-5228 
The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of existing files via unspecified vectors related to a directory path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2015-5229 
The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T15:00:00.000Z
CVE-2015-5230 
The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Problem types: description: Other
Affected products: vendor: PowerDNS
product: PowerDNS Authoritative Server
Published: 2020-01-15T16:32:47.000Z
CVE-2015-5231 
The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2015-5232 
Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T20:00:00.000Z
CVE-2015-5233 
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-11T21:00:00.000Z
CVE-2015-5234 
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-09T14:00:00.000Z
CVE-2015-5235 
IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-09T14:00:00.000Z
CVE-2015-5236 
It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
Problem types: cwe_id: CWE-345
description: CWE-345
Affected products: vendor: n/a
product: Icedtea-web
Published: 2022-07-07T15:54:03.000Z
CVE-2015-5237 
protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T17:00:00.000Z
CVE-2015-5239 
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
Problem types: description: Integer Overflow
Affected products: vendor: QEMU
product: QEMU
Published: 2020-01-23T19:52:32.000Z
CVE-2015-5240 
Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-27T16:00:00.000Z
CVE-2015-5241 
After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.
Problem types: description: Open Redirect
Affected products: vendor: Apache Software Foundation
product: Apache jUDDI
Published: 2017-05-19T19:00:00.000Z
CVE-2015-5242 
OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-25T20:00:00.000Z
CVE-2015-5243 
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T21:00:00.000Z
CVE-2015-5244 
The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2015-5245 
CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-03T20:00:00.000Z
CVE-2015-5246 
The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T15:00:00.000Z
CVE-2015-5247 
The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-14T15:00:00.000Z
CVE-2015-5248 
Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T16:00:00.000Z
CVE-2015-5250 
The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-08T15:00:00.000Z
CVE-2015-5251 
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-26T17:00:00.000Z
CVE-2015-5252 
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-29T22:00:00.000Z
CVE-2015-5253 
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-18T16:00:00.000Z
CVE-2015-5254 
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-5255 
Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-18T21:00:00.000Z
CVE-2015-5256 
Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which allows attackers to bypass intended access restrictions via a crafted URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-23T11:00:00.000Z
CVE-2015-5257 
drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted USB device.  NOTE: this ID was incorrectly used for an Apache Cordova issue that has the correct ID of CVE-2015-8320.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-16T11:00:00.000Z
CVE-2015-5258 
Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-22T18:00:00.000Z
CVE-2015-5259 
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-08T19:00:00.000Z
CVE-2015-5260 
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2015-5261 
Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2015-5262 
http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-27T16:00:00.000Z
CVE-2015-5263 
pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5264 
The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5265 
The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5266 
The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5267 
lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5268 
The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5269 
Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5271 
The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-15T17:00:00.000Z
CVE-2015-5272 
The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-22T02:00:00.000Z
CVE-2015-5273 
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-07T18:00:00.000Z
CVE-2015-5274 
rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T14:00:00.000Z
CVE-2015-5276 
The std::random_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from blocking sources, which makes it easier for context-dependent attackers to predict the random values via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-17T15:00:00.000Z
CVE-2015-5277 
The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-5278 
The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (infinite loop and instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Problem types: description: Other
Affected products: vendor: QEMU
product: QEMU
Published: 2020-01-23T19:40:18.000Z
CVE-2015-5279 
Heap-based buffer overflow in the ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via vectors related to receiving packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T16:00:00.000Z
CVE-2015-5281 
The grub2 package before 2.02-0.29 in Red Hat Enterprise Linux (RHEL) 7, when used on UEFI systems, allows local users to bypass intended Secure Boot restrictions and execute non-verified code via a crafted (1) multiboot or (2) multiboot2 module in the configuration file or physically proximate attackers to bypass intended Secure Boot restrictions and execute non-verified code via the (3) boot menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-24T20:00:00.000Z
CVE-2015-5282 
Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T17:00:00.000Z
CVE-2015-5283 
The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T10:00:00.000Z
CVE-2015-5284 
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T14:00:00.000Z