rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-5232 
Buffer overflow in Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (system crash) via a crafted app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T16:00:00.000Z
CVE-2016-5233 
Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182 allow remote base stations to obtain sensitive subscriber signal strength information via vectors involving improper security status verification, aka HWPSIRT-2015-12007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-10T15:00:00.000Z
CVE-2016-5234 
Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 videoconference devices with software before V500R002C00SPC100, when an unspecified service is enabled, allows remote attackers to execute arbitrary code via a crafted packet, aka HWPSIRT-2016-05054.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-13T14:00:00.000Z
CVE-2016-5235 
A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user to inject HTML via a crafted alert.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-01T15:54:40.000Z
CVE-2016-5236 
Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inject arbitrary web script or HTML when creating a new user, account or signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-01T15:59:19.000Z
CVE-2016-5237 
Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privileges as demonstrated by a Trojan horse Steam.exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-5238 
The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-14T14:00:00.000Z
CVE-2016-5239 
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T19:00:00.000Z
CVE-2016-5240 
The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of service (infinite loop) by converting a circularly defined SVG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-27T22:00:00.000Z
CVE-2016-5241 
magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted svg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T15:00:00.000Z
CVE-2016-5242 
The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-07T14:00:00.000Z
CVE-2016-5243 
The tipc_nl_compat_link_dump function in net/tipc/netlink_compat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-5244 
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-5247 
The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240, TS440, and TS540 devices; and ThinkStation E32, P300, and P310 devices might allow local users or physically proximate attackers to bypass the Secure Boot protection mechanism by leveraging an AMI test key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T15:00:00.000Z
CVE-2016-5248 
The StopProxy command in LSC.Services.SystemService in Lenovo Solution Center before 3.3.003 allows local users to terminate arbitrary processes via the PID argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T16:00:00.000Z
CVE-2016-5249 
Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T16:00:00.000Z
CVE-2016-5250 
Mozilla Firefox before 48.0, Firefox ESR < 45.4 and Thunderbird < 45.4 allow remote attackers to obtain sensitive information about the previously retrieved page via Resource Timing API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5251 
Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5252 
Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5253 
The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback application-path parameter and a hard link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5254 
Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5255 
Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5256 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5257 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5258 
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5259 
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5260 
Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, which might allow attackers to discover cleartext passwords by reading a session restoration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5261 
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5262 
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5263 
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5264 
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5265 
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5266 
Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5267 
Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a right-to-left character set.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5268 
Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI_SAFE_FOR_UNTRUSTED_CONTENT flags of about: URLs that are used for error pages, which makes it easier for remote attackers to conduct spoofing attacks via a crafted URL, as demonstrated by misleading text after an about:neterror?d= substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T01:00:00.000Z
CVE-2016-5270 
Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5271 
The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5272 
The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5273 
The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5274 
Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5275 
Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5276 
Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5277 
Use-after-free vulnerability in the nsRefreshDriver::Tick function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5278 
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5279 
Mozilla Firefox before 49.0 allows user-assisted remote attackers to obtain sensitive full-pathname information during a local-file drag-and-drop operation via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5280 
Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via bidirectional text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5281 
Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5282 
Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a jar: URL for a favicon resource.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5283 
Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5284 
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-22T22:00:00.000Z
CVE-2016-5285 
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
Problem types: description: denial of service
Affected products: vendor: Mozilla
product: Network Security Services
Published: 2019-11-15T15:44:05.000Z
CVE-2016-5287 
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.
Problem types: description: Crash in nsTArray_base<T>::SwapArrayElements
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5288 
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.
Problem types: description: Web content can read cache entries
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5289 
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.
Problem types: description: Memory safety bugs fixed in Firefox 50
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5290 
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Problem types: description: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5291 
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Problem types: description: Same-origin policy violation using local HTML file and saved shortcut file
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5292 
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
Problem types: description: URL parsing causes crash
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5293 
When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
Problem types: description: Write to arbitrary file with Mozilla Updater and Maintenance Service using updater.log hardlink
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5294 
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Problem types: description: Arbitrary target directory for result files of update process
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-5295 
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
Problem types: description: Mozilla Maintenance Service: Ability to read arbitrary files as SYSTEM
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z