rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-4383 
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2016-4384 
HPE Performance Center before 12.50 and LoadRunner before 12.50 allow remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T01:00:00.000Z
CVE-2016-4385 
The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-29T14:00:00.000Z
CVE-2016-4386 
HPE Network Automation Software 10.10 allows local users to write to arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-29T14:00:00.000Z
CVE-2016-4387 
The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4388, CVE-2016-4389, and CVE-2016-4390.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z
CVE-2016-4388 
The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4389, and CVE-2016-4390.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z
CVE-2016-4389 
The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4388, and CVE-2016-4390.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z
CVE-2016-4390 
The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4388, and CVE-2016-4389.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z
CVE-2016-4391 
A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HP ArcSight WINC Connector
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4392 
A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1.
Problem types: description: remote cross-site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HP Business Service Manager
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4393 
HPE System Management Homepage before v7.6 allows "remote authenticated" attackers to obtain sensitive information via unspecified vectors, related to an "XSS" issue.
Problem types: description: XSS
Affected products: vendor: HPE
product: HPE System Management Homepage before v7.6
Published: 2016-10-28T21:00:00.000Z
CVE-2016-4394 
HPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive information via unspecified vectors, related to an "HSTS" issue.
Problem types: description: HSTS
Affected products: vendor: HPE
product: HPE System Management Homepage before v7.6
Published: 2016-10-28T21:00:00.000Z
CVE-2016-4395 
HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer Overflow" issue.
Problem types: description: Buffer Overflow
Affected products: vendor: HPE
product: HPE System Management Homepage before v7.6
Published: 2016-10-28T21:00:00.000Z
CVE-2016-4396 
HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer Overflow" issue.
Problem types: description: Buffer Overflow
Affected products: vendor: HPE
product: HPE System Management Homepage before v7.6
Published: 2016-10-28T21:00:00.000Z
CVE-2016-4397 
A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
Problem types: description: local code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HP Network Node Manager (NNMi)
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4398 
A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
Problem types: description: remote arbitrary code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HP Network Node Manager (NNMi)
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4399 
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HP Network Node Manager (NNMi)
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4400 
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HP Network Node Manager (NNMi)
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4401 
Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T14:32:30.000Z
CVE-2016-4402 
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
Problem types: description: remote code execution via buffer overflow
Affected products: vendor: Hewlett Packard Enterprise
product: HP Keyview
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4403 
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
Problem types: description: remote code execution via memory corruption
Affected products: vendor: Hewlett Packard Enterprise
product: HP Keyview
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4404 
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
Problem types: description: remote code execution via a memory allocation issue
Affected products: vendor: Hewlett Packard Enterprise
product: HP Keyview
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4405 
A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
Problem types: description: remote code execution
Affected products: vendor: Hewlett Packard Enterprise
product: HP Business Service Manager
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4406 
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
Problem types: description: cross site scripting (XSS)
Affected products: vendor: Hewlett Packard Enterprise
product: HP Integrated Lights-Out 3 (iLO 3), HPE Integrated Lights-Out 4 (iLO 4)
Published: 2018-08-06T20:00:00.000Z
CVE-2016-4407 
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T14:00:00.000Z
CVE-2016-4412 
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-4414 
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T19:00:00.000Z
CVE-2016-4415 
wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4416 
epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4417 
Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4418 
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4419 
epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4420 
The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4421 
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion, stack consumption, and application crash) via a packet that specifies deeply nested data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-01T01:00:00.000Z
CVE-2016-4422 
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-06T17:00:00.000Z
CVE-2016-4423 
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T22:00:00.000Z
CVE-2016-4425 
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-17T14:00:00.000Z
CVE-2016-4426 
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: zulip
Published: 2022-07-28T16:31:52.000Z
CVE-2016-4427 
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: n/a
product: zulip
Published: 2022-07-28T16:32:08.000Z
CVE-2016-4428 
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-4429 
Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-4430 
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T22:00:00.000Z
CVE-2016-4431 
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T22:00:00.000Z
CVE-2016-4432 
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T20:00:00.000Z
CVE-2016-4433 
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T22:00:00.000Z
CVE-2016-4434 
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-29T20:00:00.000Z
CVE-2016-4435 
An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.
Problem types: description: DoS
Affected products: vendor: Pivotal
product: Cloud Foundry
Published: 2017-05-25T17:00:00.000Z
CVE-2016-4436 
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T15:00:00.000Z
CVE-2016-4437 
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2016-4438 
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T22:00:00.000Z
CVE-2016-4439 
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-20T14:00:00.000Z
CVE-2016-4440 
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-4441 
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-20T14:00:00.000Z
CVE-2016-4442 
The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-02T14:00:00.000Z
CVE-2016-4443 
Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-14T18:00:00.000Z
CVE-2016-4444 
The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T18:00:00.000Z
CVE-2016-4445 
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T18:00:00.000Z
CVE-2016-4446 
The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T18:00:00.000Z
CVE-2016-4447 
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-09T16:00:00.000Z
CVE-2016-4448 
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-09T16:00:00.000Z
CVE-2016-4449 
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-09T16:00:00.000Z
CVE-2016-4450 
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2016-4451 
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-19T21:00:00.000Z
CVE-2016-4453 
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T22:00:00.000Z
CVE-2016-4454 
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-01T22:00:00.000Z
CVE-2016-4455 
The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-4456 
The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T21:00:00.000Z
CVE-2016-4457 
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-08T18:00:00.000Z
CVE-2016-4459 
Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T20:00:00.000Z
CVE-2016-4460 
Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-22T18:00:00.000Z