rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-5130 
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T01:00:00.000Z
CVE-2015-5131 
Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T01:00:00.000Z
CVE-2015-5132 
Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5133.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T01:00:00.000Z
CVE-2015-5133 
Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T01:00:00.000Z
CVE-2015-5134 
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-14T01:00:00.000Z
CVE-2015-5143 
The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-14T17:00:00.000Z
CVE-2015-5144 
Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-14T17:00:00.000Z
CVE-2015-5145 
validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-14T17:00:00.000Z
CVE-2015-5146 
ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with knowledge of the configuration password and access to a computer entrusted to perform remote configuration to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2015-5147 
Stack-based buffer overflow in the header_anchor function in the HTML renderer in Redcarpet before 3.3.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-07-14T16:00:00.000Z
CVE-2015-5148 
SQL injection vulnerability in LivelyCart 1.2.0 allows remote attackers to execute arbitrary SQL commands via the search_query parameter to product/search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2015-5149 
Directory traversal vulnerability in Zoho ManageEngine SupportCenter Plus 7.90 allows remote authenticated users to write to arbitrary files via a .. (dot dot) in the component parameter in the Request component to workorder/Attachment.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2015-5150 
Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.90 allow remote authenticated users to inject arbitrary web script or HTML via the (1) query parameter in the run_query_editor_query module to CustomReportHandler.do, (2) compAcct parameter to jsp/ResetADPwd.jsp, or (3) redirectTo parameter to jsp/CacheScreenWidth.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2015-5151 
Cross-site scripting (XSS) vulnerability in the Slider Revolution (revslider) plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the client_action parameter in a revslider_ajax_action action to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-30T14:00:00.000Z
CVE-2015-5152 
Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-14T20:00:00.000Z
CVE-2015-5153 
Pulp does not remove permissions for named objects upon deletion, which allows authenticated users to gain the privileges of a deleted object via creating an object with the same name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T18:00:00.000Z
CVE-2015-5154 
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-5156 
The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-19T10:00:00.000Z
CVE-2015-5157 
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-31T10:00:00.000Z
CVE-2015-5158 
Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-08T16:00:00.000Z
CVE-2015-5159 
python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-30T18:00:00.000Z
CVE-2015-5160 
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T21:00:00.000Z
CVE-2015-5161 
The Zend_Xml_Security::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-25T17:00:00.000Z
CVE-2015-5162 
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-07T14:00:00.000Z
CVE-2015-5163 
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-19T15:00:00.000Z
CVE-2015-5164 
The Qpid server on Red Hat Satellite 6 does not properly restrict message types, which allows remote authenticated users with administrative access on a managed content host to execute arbitrary code via a crafted message, related to a pickle processing problem in pulp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T16:00:00.000Z
CVE-2015-5165 
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-5166 
Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by unplugging a block device twice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-12T14:00:00.000Z
CVE-2015-5167 
The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-12T14:00:00.000Z
CVE-2015-5168 
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T16:00:00.000Z
CVE-2015-5169 
Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5170 
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T17:00:00.000Z
CVE-2015-5171 
The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T17:00:00.000Z
CVE-2015-5172 
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T17:00:00.000Z
CVE-2015-5173 
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-24T17:00:00.000Z
CVE-2015-5174 
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-25T01:00:00.000Z
CVE-2015-5175 
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-07T20:00:00.000Z
CVE-2015-5176 
The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-11T14:00:00.000Z
CVE-2015-5177 
Double free vulnerability in the SLPDKnownDAAdd function in slpd/slpd_knownda.c in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-20T21:00:00.000Z
CVE-2015-5178 
The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-27T16:00:00.000Z
CVE-2015-5179 
FreeIPA might display user data improperly via vectors involving non-printable characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-20T16:00:00.000Z
CVE-2015-5180 
res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-5181 
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5182 
Cross-site request forgery (CSRF) vulnerability in the jolokia API in A-MQ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5183 
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5184 
Console: CORS headers set to allow all in Red Hat AMQ.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2015-5185 
The lookupProviders function in providerMgr.c in sblim-sfcb 1.3.4 and 1.3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty className in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-28T20:00:00.000Z
CVE-2015-5186 
Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-06T21:00:00.000Z
CVE-2015-5187 
Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T18:00:00.000Z
CVE-2015-5188 
Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-27T16:00:00.000Z
CVE-2015-5189 
Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T14:00:00.000Z
CVE-2015-5190 
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-03T14:00:00.000Z
CVE-2015-5191 
VMware Tools prior to 10.0.9 contains multiple file system races in libDeployPkg, related to the use of hard-coded paths under /tmp. Successful exploitation of this issue may result in a local privilege escalation. CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: VMware
product: VMware Tools
Published: 2017-07-28T21:00:00.000Z
CVE-2015-5194 
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-5195 
ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-21T14:00:00.000Z
CVE-2015-5198 
libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to gain privileges via unspecified vectors, related to the VDPAU_DRIVER_PATH environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-08T15:00:00.000Z
CVE-2015-5199 
Directory traversal vulnerability in dlopen in libvdpau before 1.1.1 allows local users to gain privileges via the VDPAU_DRIVER environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-08T15:00:00.000Z
CVE-2015-5200 
The trace functionality in libvdpau before 1.1.1, when used in a setuid or setgid application, allows local users to write to arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-08T15:00:00.000Z
CVE-2015-5201 
VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x before 6-6.7-20151117.0 as packaged in Red Hat Enterprise Virtualization before 3.5.6 when VSDM is run with -spice disable-ticketing and a VM is suspended and then restored, allows remote attackers to log in without authentication via unspecified vectors.
Problem types: description: Weak Authentication
Affected products: vendor: RedHat
product: Enterprise Virtualization Hypervisor (aka RHEV-H)
Published: 2020-02-25T20:16:02.000Z
CVE-2015-5203 
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2015-5204 
CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-17T19:00:00.000Z
CVE-2015-5206 
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-13T16:00:00.000Z
CVE-2015-5207 
Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-09T20:00:00.000Z
CVE-2015-5208 
Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-09T20:00:00.000Z
CVE-2015-5209 
Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vectors involving a top object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-29T15:00:00.000Z
CVE-2015-5210 
Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-02T19:00:00.000Z
CVE-2015-5211 
Under some situations, the Spring Framework 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14 and older unsupported versions is vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-25T17:00:00.000Z
CVE-2015-5212 
Integer underflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2, when the configuration setting "Load printer settings with the document" is enabled, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted PrinterSetup data in an ODF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-10T16:00:00.000Z