rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-7889 
The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-12-27T18:00:00.000Z
CVE-2015-7890 
Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T14:54:18.000Z
CVE-2015-7891 
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops, aka SVE-2015-4598.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2015-7892 
Stack-based buffer overflow in the m2m1shot_compat_ioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.buf_out.num_planes value in an ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-09T19:22:11.000Z
CVE-2015-7893 
SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-11T19:00:00.000Z
CVE-2015-7894 
The DCMProvider service in Samsung LibQjpeg on a Samsung SM-G925V device running build number LRX22G.G925VVRU1AOE2 allows remote attackers to cause a denial of service (segmentation fault and process crash) and execute arbitrary code via a crafted JPG.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-09T18:00:00.000Z
CVE-2015-7895 
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-7896 
LibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memory corruption and SIGSEGV) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T20:00:00.000Z
CVE-2015-7897 
The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attackers to gain privileges or cause a denial of service (memory corruption) via a crafted BMP image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-16T19:00:00.000Z
CVE-2015-7898 
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-27T20:00:00.000Z
CVE-2015-7899 
The com_content component in Joomla! 3.x before 3.4.5 does not properly check ACLs, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-29T20:00:00.000Z
CVE-2015-7900 
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7901 
Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7902 
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7903 
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7904 
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-28T10:00:00.000Z
CVE-2015-7905 
Unitronics VisiLogic OPLC IDE before 9.8.02 allows remote attackers to execute unspecified code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-13T02:00:00.000Z
CVE-2015-7906 
LOYTEC LIP-3ECTB 6.0.1, LINX-100, LVIS-3E100, and LIP-ME201 devices allow remote attackers to read a password-hash backup file via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-7907 
Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-7908 
Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-7909 
Stack-based buffer overflow in Hospira Communication Engine (CE) before 1.2 in LifeCare PCA Infusion System 5.07, Plum A+ Infusion System 13.40, and Plum A+3 Infusion System 13.40 allows remote attackers to cause a denial of service or possibly have unspecified other impact via traffic on TCP port 5000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-22T11:00:00.000Z
CVE-2015-7910 
Exemys Telemetry Web Server relies on an HTTP Location header to indicate that a client is unauthorized, which allows remote attackers to bypass intended access restrictions by disregarding this header and processing the response body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-19T11:00:00.000Z
CVE-2015-7911 
Saia Burgess PCD1.M0xx0, PCD1.M2xx0, PCD2.M5xx0, PCD3.Mxx60, PCD3.Mxxx0, PCD7.D4xxD, PCD7.D4xxV, PCD7.D4xxWTPF, and PCD7.D4xxxT5F devices before 1.24.50 and PCD3.T665 and PCD3.T666 devices before 1.24.41 have hardcoded credentials, which allows remote attackers to obtain administrative access via an FTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T02:00:00.000Z
CVE-2015-7912 
The Ice Faces servlet in ag_server_service.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows remote attackers to upload and execute arbitrary Java code via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-21T11:00:00.000Z
CVE-2015-7913 
ag_server_service.exe in the AggreGate Server Service in Tibbo AggreGate before 5.30.06 allows local users to execute arbitrary Java code with SYSTEM privileges by using the Apache Axis AdminService deployment method to publish a class.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-21T11:00:00.000Z
CVE-2015-7914 
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-06T02:00:00.000Z
CVE-2015-7915 
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-06T02:00:00.000Z
CVE-2015-7916 
Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-02-06T02:00:00.000Z
CVE-2015-7917 
Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T02:00:00.000Z
CVE-2015-7918 
Multiple buffer overflows in the F1BookView ActiveX control in F1 Bookview in Schneider Electric ProClima before 6.2 allow remote attackers to execute arbitrary code via the (1) Attach, (2) DefinedName, (3) DefinedNameLocal, (4) ODBCPrepareEx, (5) ObjCreatePolygon, (6) SetTabbedTextEx, or (7) SetValidationRule method, a different vulnerability than CVE-2015-8561.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-15T02:00:00.000Z
CVE-2015-7919 
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-7921 
The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-06T23:00:00.000Z
CVE-2015-7923 
Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-30T11:00:00.000Z
CVE-2015-7924 
eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7925 
Cross-site request forgery (CSRF) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to hijack the authentication of administrators for requests that trigger firmware upload, removal of configuration data, or a reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7926 
eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7927 
Cross-site scripting (XSS) vulnerability on eWON devices with firmware through 10.1s0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7928 
eWON devices with firmware before 10.1s0 do not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7929 
eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T11:00:00.000Z
CVE-2015-7930 
Adcon Telemetry A840 Telemetry Gateway Base Station has hardcoded credentials, which allows remote attackers to obtain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-24T01:00:00.000Z
CVE-2015-7931 
The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-24T01:00:00.000Z
CVE-2015-7932 
Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-24T01:00:00.000Z
CVE-2015-7934 
The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-24T01:00:00.000Z
CVE-2015-7935 
Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T02:00:00.000Z
CVE-2015-7936 
Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-23T02:00:00.000Z
CVE-2015-7937 
Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-12-21T11:00:00.000Z
CVE-2015-7938 
Advantech EKI-132x devices with firmware before 2015-12-31 allow remote attackers to bypass authentication via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-09T02:00:00.000Z
CVE-2015-7939 
Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-01-09T02:00:00.000Z
CVE-2015-7940 
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-09T16:00:00.000Z
CVE-2015-7941 
libxml2 2.9.2 does not properly stop parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and libxml2 crash) via crafted XML data to the (1) xmlParseEntityDecl or (2) xmlParseConditionalSections function in parser.c, as demonstrated by non-terminated entities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-18T16:00:00.000Z
CVE-2015-7942 
The xmlParseConditionalSections function in parser.c in libxml2 does not properly skip intermediary entities when it stops parsing invalid input, which allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted XML data, a different vulnerability than CVE-2015-7941.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-18T16:00:00.000Z
CVE-2015-7943 
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-18T18:00:00.000Z
CVE-2015-7944 
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2, when used in SSL mode, allows remote attackers to cause a denial of service (resource consumption) via SSL parameter renegotiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T17:00:00.000Z
CVE-2015-7945 
The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x before 2.10.8, 2.11.x before 2.11.8, 2.12.x before 2.12.6, 2.13.x before 2.13.3, 2.14.x before 2.14.2, and 2.15.x before 2.15.2 allows remote attackers to obtain the DRBD secret via instance information job results.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T17:00:00.000Z
CVE-2015-7946 MTP service exposed during emergency dialer
Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Canonical
product: unity8 (Ubuntu)
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Michael Terry
Published: 2020-05-07T22:15:13.142Z
CVE-2015-7961 
SafeNet Authentication Service Remote Web Workplace Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7962 
SafeNet Authentication Service for Outlook Web App Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7963 
SafeNet Authentication Service for AD FS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7964 
SafeNet Authentication Service for NPS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7965 
SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7966 
SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7965.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7967 
SafeNet Authentication Service for Citrix Web Interface Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-02T22:00:00.000Z
CVE-2015-7968 
nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusion via the sap/bc/ui2/nwbc/nwbc_ext2int/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-09T13:34:18.000Z
CVE-2015-7969 
Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-30T15:00:00.000Z
CVE-2015-7970 
The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a "time-consuming linear scan," related to Populate-on-Demand.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-30T15:00:00.000Z
CVE-2015-7971 
Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-10-30T15:00:00.000Z