rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1789 
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T00:00:00.000Z
CVE-2015-1790 
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T00:00:00.000Z
CVE-2015-1791 
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T00:00:00.000Z
CVE-2015-1792 
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-12T00:00:00.000Z
CVE-2015-1793 
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-09T19:00:00.000Z
CVE-2015-1794 
The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-06T00:00:00.000Z
CVE-2015-1795 
Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-1796 
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-08T15:00:00.000Z
CVE-2015-1798 
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T10:00:00.000Z
CVE-2015-1799 
The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-08T10:00:00.000Z
CVE-2015-1800 
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2015-1801 
The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2015-1802 
The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-20T14:00:00.000Z
CVE-2015-1803 
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-20T14:00:00.000Z
CVE-2015-1804 
The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-20T14:00:00.000Z
CVE-2015-1805 
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-08T10:00:00.000Z
CVE-2015-1806 
The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1807 
Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1808 
Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1809 
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via an XPath query.
Problem types: description: Other
Affected products: vendor: CloudBees
product: Jenkins
vendor: CloudBees
product: Jenkins LTS
Published: 2020-01-15T18:05:30.000Z
CVE-2015-1810 
The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1811 
XML external entity (XXE) vulnerability in CloudBees Jenkins before 1.600 and LTS before 1.596.1 allows remote attackers to read arbitrary XML files via a crafted XML document.
Problem types: description: Other
Affected products: vendor: CloudBees
product: Jenkins
vendor: CloudBees
product: Jenkins LTS
Published: 2020-01-15T18:05:34.000Z
CVE-2015-1812 
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1813 
Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1814 
The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-16T20:00:00.000Z
CVE-2015-1815 
The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-1816 
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T18:00:00.000Z
CVE-2015-1817 
Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T16:00:00.000Z
CVE-2015-1818 
XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-11T14:00:00.000Z
CVE-2015-1819 
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T18:00:00.000Z
CVE-2015-1820 
REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T18:00:00.000Z
CVE-2015-1821 
Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-16T14:00:00.000Z
CVE-2015-1822 
chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-16T14:00:00.000Z
CVE-2015-1827 
The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-30T14:00:00.000Z
CVE-2015-1828 
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T22:00:00.000Z
CVE-2015-1829 
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-21T21:00:00.000Z
CVE-2015-1830 
Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-19T15:00:00.000Z
CVE-2015-1831 
The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-16T14:00:00.000Z
CVE-2015-1832 
XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T21:00:00.000Z
CVE-2015-1833 
XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-29T15:00:00.000Z
CVE-2015-1834 
A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Problem types: description: Path Traversal
Affected products: vendor: Pivotal
product: Cloud Foundry
Published: 2017-05-25T17:00:00.000Z
CVE-2015-1835 
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-27T19:00:00.000Z
CVE-2015-1836 
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-1838 
modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2015-1839 
modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2015-1840 
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-26T22:00:00.000Z
CVE-2015-1841 
The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-08T15:00:00.000Z
CVE-2015-1842 
The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-10T14:00:00.000Z
CVE-2015-1843 
The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.  NOTE: this vulnerability exists because of a CVE-2014-5277 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-06T15:00:00.000Z
CVE-2015-1844 
Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T18:00:00.000Z
CVE-2015-1845 
Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-19T18:00:00.000Z
CVE-2015-1846 
unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-19T18:00:00.000Z
CVE-2015-1847 
Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-24T15:00:00.000Z
CVE-2015-1848 
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.  NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-14T14:00:00.000Z
CVE-2015-1849 
AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T17:00:00.000Z
CVE-2015-1851 
OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-25T16:00:00.000Z
CVE-2015-1852 
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-17T17:00:00.000Z
CVE-2015-1853 
chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers with knowledge of NTP peering to cause a denial of service (inability to synchronize) via random timestamps in crafted NTP data packets.
Problem types: description: Other
Affected products: vendor: chrony
product: chrony
Published: 2019-12-09T18:53:22.000Z
CVE-2015-1854 
389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-19T15:00:00.000Z
CVE-2015-1855 
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Problem types: description: Other
Affected products: vendor: Ruby
product: Ruby
Published: 2019-11-29T20:46:48.000Z
CVE-2015-1856 
OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-17T17:00:00.000Z
CVE-2015-1857 
The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-27T16:00:00.000Z