rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-7185 
Mozilla Firefox before 42.0 on Android does not ensure that the address bar is restored upon fullscreen-mode exit, which allows remote attackers to spoof the address bar via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7186 
Mozilla Firefox before 42.0 on Android allows user-assisted remote attackers to bypass the Same Origin Policy and trigger (1) a download or (2) cached profile-data reading via a file: URL in a saved HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7187 
The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via inline JavaScript code that is executed within a third-party extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7188 
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace characters to an IP address string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7189 
Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7190 
The Search feature in Mozilla Firefox before 42.0 on Android through 4.4 supports search-engine URL registration through an intent and can access this URL in a privileged context in conjunction with the crash reporter, which allows attackers to read log files and visit file: URLs of HTML documents via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7191 
Mozilla Firefox before 42.0 on Android improperly restricts URL strings in intents, which allows attackers to conduct cross-site scripting (XSS) attacks via vectors involving an intent: URL and fallback navigation, aka "Universal XSS (UXSS)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7192 
The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7193 
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, which allows remote attackers to bypass the Same Origin Policy by leveraging the lack of a preflight-request step.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7194 
Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7195 
The URL parsing implementation in Mozilla Firefox before 42.0 improperly recognizes escaped characters in hostnames within Location headers, which allows remote attackers to obtain sensitive information via vectors involving a redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7196 
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute arbitrary code via a crafted Java applet that deallocates an in-use JavaScript wrapper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7197 
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7198 
Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted texture data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7199 
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7200 
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-05T02:00:00.000Z
CVE-2015-7201 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7202 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7203 
Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7204 
Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary code via crafted JavaScript variable assignments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7205 
Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might allow remote attackers to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a crafted WebRTC RTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7207 
Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7208 
Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7210 
Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering attempted use of a data channel that has been closed by a WebRTC function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7211 
Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7212 
Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code by triggering a graphics operation that requires a large texture allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7213 
Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 on 64-bit platforms allows remote attackers to execute arbitrary code via a crafted MP4 video file that triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7214 
Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-source: URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7215 
The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same Origin Policy by triggering use of the no-cors mode in the fetch API to attempt resource access that throws an exception, leading to information disclosure after a rethrow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7216 
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7217 
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7218 
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a single-byte header frame that triggers incorrect memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7219 
The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion failure, and application exit) via a malformed PushPromise frame that triggers decompressed-buffer length miscalculation and incorrect memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7220 
Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7221 
Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7222 
Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7223 
The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or conduct cross-site scripting (XSS) attacks, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-16T11:00:00.000Z
CVE-2015-7224 
puppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by leveraging creation of a database account without a password when a 'mysql_user' user parameter contains a host with a netmask.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-21T15:00:00.000Z
CVE-2015-7225 
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-7226 
The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7227 
The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7228 
The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7229 
The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the (1) "post to twitter" permission or change the options for arbitrary attached accounts by leveraging the (2) "add twitter accounts" or (3) "add authenticated twitter accounts" permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7230 
The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7231 
The Commerce Commonwealth (CBA) module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7232 
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7233 
Cross-site request forgery (CSRF) vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7234 
The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7235 
Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-17T16:00:00.000Z
CVE-2015-7236 
Use-after-free vulnerability in xprt_set_caller in rpcb_svc_com.c in rpcbind 0.2.1 and earlier allows remote attackers to cause a denial of service (daemon crash) via crafted packets, involving a PMAP_CALLIT code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-01T20:00:00.000Z
CVE-2015-7237 
Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T14:00:00.000Z
CVE-2015-7238 
The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T14:00:00.000Z
CVE-2015-7239 
SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T14:00:00.000Z
CVE-2015-7241 
XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-7242 
Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-12T19:00:00.000Z
CVE-2015-7243 
Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted WAV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-18T16:00:00.000Z
CVE-2015-7244 
The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-04T02:00:00.000Z
CVE-2015-7245 
Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2015-7246 
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2015-7247 
D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T18:00:00.000Z
CVE-2015-7248 
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-30T02:00:00.000Z
CVE-2015-7249 
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-30T02:00:00.000Z
CVE-2015-7250 
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackers to read arbitrary files via a full pathname in the getpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-30T02:00:00.000Z
CVE-2015-7251 
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attackers to obtain administrative access via a TELNET session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-30T02:00:00.000Z