rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-10706 
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-12T19:00:00.000Z
CVE-2016-10707 
jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-18T23:00:00.000Z
CVE-2016-10708 
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-21T22:00:00.000Z
CVE-2016-10709 
pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-22T04:00:00.000Z
CVE-2016-10710 
Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-25T23:00:00.000Z
CVE-2016-10711 
Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-29T20:00:00.000Z
CVE-2016-10712 
In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during file uploads). For example, a "$uri = stream_get_meta_data(fopen($file, "r"))['uri']" call mishandles the case where $file is data:text/plain;uri=eviluri, -- in other words, metadata can be set by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-09T06:00:00.000Z
CVE-2016-10713 
An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-13T19:00:00.000Z
CVE-2016-10714 
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-27T22:00:00.000Z
CVE-2016-10715 
The Artezio Kanban Board plugin 1.4 revision 1914 for Atlassian Jira has XSS via the Board Name in a Create New Board action, related to an artezioboard/mainPage.jspa?kanbanId=7#/kanban-view URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-16T13:00:00.000Z
CVE-2016-10716 
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspa#period/month URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-16T13:00:00.000Z
CVE-2016-10717 
A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-21T21:00:00.000Z
CVE-2016-10718 
Brave Browser before 0.13.0 allows a tab to close itself even if the tab was not opened by a script, resulting in denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-04-04T02:00:00.000Z
CVE-2016-10719 
TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to steal the cookie information, which contains the base64 encoded username and password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-15T13:11:13.000Z
CVE-2016-10721 
partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T23:00:00.000Z
CVE-2016-10722 
partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock, related to the mark_reserved_sectors function. An attacker may be able to execute arbitrary code in the context of the user running the affected application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-02T23:00:00.000Z
CVE-2016-10723 
An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-06-21T13:00:00.000Z
CVE-2016-10724 
Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T22:00:00.000Z
CVE-2016-10725 
In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-05T22:00:00.000Z
CVE-2016-10726 
The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-10T11:00:00.000Z
CVE-2016-10727 
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-20T04:00:00.000Z
CVE-2016-10728 
An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet is received as the first packet on a flow in the to_client direction, it confuses the rule grouping lookup logic. The toclient inspection will then continue with the wrong rule group. This can lead to missed detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-07-23T20:00:00.000Z
CVE-2016-10729 
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2016-10730 
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API script. It should not be run by users directly. It uses star to backup and restore data. It runs binaries with root permissions when parsing the command line argument --star-path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-24T21:00:00.000Z
CVE-2016-10731 
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2016-10732 
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2016-10733 
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2016-10734 
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-10-28T03:00:00.000Z
CVE-2016-10735 
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T05:00:00.000Z
CVE-2016-10736 
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-09T23:00:00.000Z
CVE-2016-10737 
Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T04:00:00.000Z
CVE-2016-10738 
Zenbership v107 has CSRF via admin/cp-functions/event-add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-16T04:00:00.000Z
CVE-2016-10739 
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-21T19:00:00.000Z
CVE-2016-10740 
Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-29T02:00:00.000Z
CVE-2016-10741 
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-01T16:00:00.000Z
CVE-2016-10742 
Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-17T16:00:00.000Z
CVE-2016-10743 
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-23T18:55:50.000Z
CVE-2016-10744 
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-27T03:54:26.000Z
CVE-2016-10745 
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-08T13:00:48.000Z
CVE-2016-10746 
libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-18T15:56:00.000Z
CVE-2016-10749 
parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-29T13:46:59.000Z
CVE-2016-10750 
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-22T13:40:06.000Z
CVE-2016-10751 
osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:40:09.000Z
CVE-2016-10752 
serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:40:22.000Z
CVE-2016-10753 
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:40:34.000Z
CVE-2016-10754 
modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:40:48.000Z
CVE-2016-10755 
AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:41:01.000Z
CVE-2016-10756 
Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:41:16.000Z
CVE-2016-10757 
In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:41:31.000Z
CVE-2016-10758 
PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the image_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:41:45.000Z
CVE-2016-10759 
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T17:41:57.000Z
CVE-2016-10760 
On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:46:33.000Z
CVE-2016-10761 
Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-29T19:06:11.000Z
CVE-2016-10762 
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T11:22:33.000Z
CVE-2016-10763 
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-18T11:22:22.000Z
CVE-2016-10764 
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T21:38:43.000Z
CVE-2016-10765 
edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T16:10:32.000Z
CVE-2016-10766 
edx-platform before 2016-06-06 allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-29T16:12:06.000Z
CVE-2016-10767 
cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:51:51.000Z
CVE-2016-10768 
cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:52:34.000Z
CVE-2016-10769 
cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:53:16.000Z
CVE-2016-10770 
cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:54:14.000Z
CVE-2016-10771 
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:55:04.000Z
CVE-2016-10772 
cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:55:48.000Z
CVE-2016-10773 
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:56:27.000Z
CVE-2016-10774 
cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:57:28.000Z
CVE-2016-10775 
cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-05T12:58:08.000Z
CVE-2016-10776 
cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:47:51.000Z
CVE-2016-10777 
cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:49:30.000Z
CVE-2016-10778 
cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:48:40.000Z
CVE-2016-10779 
cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:50:16.000Z
CVE-2016-10780 
cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:52:01.000Z
CVE-2016-10781 
cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:52:51.000Z
CVE-2016-10782 
cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:53:43.000Z
CVE-2016-10783 
cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:54:26.000Z
CVE-2016-10784 
cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:55:08.000Z
CVE-2016-10785 
cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:55:51.000Z
CVE-2016-10786 
cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-06T12:56:49.000Z