rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9100 
Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can, under certain circumstances, obtain sensitive authentication credential information.
Problem types: description: Information disclosure
Affected products: vendor: Symantec Corporation
product: ASG
vendor: Symantec Corporation
product: ProxySG
Published: 2017-05-11T14:01:00.000Z
CVE-2016-9101 
Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9102 
Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9103 
The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9104 
Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9105 
Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9106 
Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T22:00:00.000Z
CVE-2016-9107 
The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-9108 
Integer overflow in the js_regcomp function in regexp.c in Artifex Software, Inc. MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T15:00:00.000Z
CVE-2016-9109 
Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences.  NOTE: this vulnerability exists due to an incomplete fix for CVE-2016-7563.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9111 
Incorrect access control mechanisms in Citrix Receiver Desktop Lock 4.5 allow an attacker to bypass the authentication requirement by leveraging physical access to a VDI for temporary disconnection of a LAN cable. NOTE: as of 20161208, the vendor could not reproduce the issue, stating "the researcher was unable to provide us with information that would allow us to confirm the behaviour and, despite extensive investigation on test deployments of supported products, we were unable to reproduce the behaviour as he described. The researcher has also, despite additional requests for information, ceased to respond to us."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-07T11:00:00.000Z
CVE-2016-9112 
Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-29T10:00:00.000Z
CVE-2016-9113 
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9114 
There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9115 
Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9116 
NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9117 
NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9118 
Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-30T22:00:00.000Z
CVE-2016-9119 
Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-9120 
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-08T21:00:00.000Z
CVE-2016-9121 
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Problem types: description: Cryptographic Issue
Affected products: vendor: n/a
product: Go JOSE All versions before 1.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9122 
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Problem types: description: Cryptographic Issue
Affected products: vendor: n/a
product: Go JOSE All versions before 1.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9123 
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Problem types: description: Memory Corruption
Affected products: vendor: n/a
product: Go JOSE All versions before 1.0.5
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9124 
Revive Adserver before 3.2.3 suffers from Improper Restriction of Excessive Authentication Attempts. The login page of Revive Adserver is vulnerable to password-guessing attacks. An account lockdown feature was considered, but rejected to avoid introducing service disruptions to regular users during such attacks. A random delay has instead been introduced as a countermeasure in case of password failures, along with a system to discourage parallel brute forcing. These systems will effectively allow the valid users to log in to the adserver, even while an attack is in progress.
Problem types: cwe_id: CWE-307
description: Improper Restriction of Excessive Authentication Attempts (CWE-307)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9125 
Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not invalidating the existing session upon a successful authentication. Under some circumstances, that could have been an opportunity for an attacker to steal an authenticated session.
Problem types: cwe_id: CWE-384
description: Session Fixation (CWE-384)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9126 
Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9127 
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9128 
Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user, by tricking them into visiting a specifically crafted URL.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9129 
Revive Adserver before 3.2.3 suffers from Information Exposure Through Discrepancy. It is possible to check whether or not an email address was associated to one or more user accounts on a target Revive Adserver instance by examining the message printed by the password recovery system. Such information cannot however be used directly to log in to the system, which requires a username.
Problem types: cwe_id: CWE-203
description: Information Exposure Through Discrepancy (CWE-203)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9130 
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9131 
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T06:06:00.000Z
CVE-2016-9132 
In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way which later causes memory corruption or other failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-9134 
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-03T10:00:00.000Z
CVE-2016-9135 
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-03T10:00:00.000Z
CVE-2016-9136 
Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83acfa950ec8a8a89 allows context-dependent attackers to obtain sensitive information by using the "crafted JavaScript" approach, related to a "Buffer Over-read" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-03T10:00:00.000Z
CVE-2016-9137 
Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-04T20:00:00.000Z
CVE-2016-9138 
PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::__toString with DateInterval::__wakeup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-04T20:00:00.000Z
CVE-2016-9139 
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.3.x before 3.3.16, 4.0.x before 4.0.19, and 5.0.x before 5.0.14 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-16T18:00:00.000Z
CVE-2016-9147 
named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a response containing an inconsistency among the DNSSEC-related RRsets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T06:06:00.000Z
CVE-2016-9148 
Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T15:00:00.000Z
CVE-2016-9149 
The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single quote characters, which allows remote authenticated users to conduct XPath injection attacks via a crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-19T06:29:00.000Z
CVE-2016-9150 
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-19T06:29:00.000Z
CVE-2016-9151 
Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 allows local users to gain privileges via crafted values of unspecified environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-19T06:29:00.000Z
CVE-2016-9152 
Cross-site scripting (XSS) vulnerability in ecrire/exec/plonger.php in SPIP 3.1.3 allows remote attackers to inject arbitrary web script or HTML via the rac parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-05T18:00:00.000Z
CVE-2016-9154 
Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.
Problem types: cwe_id: CWE-332
description: CWE-332: Insufficient Entropy in Pseudo-random Number Generator (PRNG)
Affected products: vendor: n/a
product: Desigo PX Web modules with all firmware versions < V6.00.046
Published: 2016-12-23T05:00:00.000Z
CVE-2016-9155 
The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances.
Problem types: description: incorrect access control
Affected products: vendor: n/a
product: SIEMENS-branded IP Cameras
Published: 2016-11-22T11:00:00.000Z
CVE-2016-9156 
A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the file system by sending specially crafted packets to port 19235/TCP.
Problem types: description: file manipulation
Affected products: vendor: n/a
product: Siemens SICAM PAS through V8.08
Published: 2016-12-05T08:09:00.000Z
CVE-2016-9157 
A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP.
Problem types: description: remote code execution
Affected products: vendor: n/a
product: Siemens SICAM PAS through V8.08
Published: 2016-12-05T08:09:00.000Z
CVE-2016-9158 
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions). Specially crafted packets sent to port 80/tcp could cause the affected devices to go into defect mode. A cold restart is required to recover the system.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Siemens AG
product: SIMATIC S7-300 CPU family
vendor: Siemens AG
product: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 V6 and earlier CPU family
vendor: Siemens AG
product: SIMATIC S7-400 V7 CPU family
Published: 2016-12-17T03:34:00.000Z
CVE-2016-9159 
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices.
Problem types: cwe_id: CWE-200
description: CWE-200: Information Exposure
Affected products: vendor: Siemens AG
product: SIMATIC S7-300 CPU family
vendor: Siemens AG
product: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)
vendor: Siemens AG
product: SIMATIC S7-400 V6 and earlier CPU family
vendor: Siemens AG
product: SIMATIC S7-400 V7 CPU family
vendor: Siemens AG
product: SIMATIC S7-410 V8 CPU family
vendor: Siemens AG
product: SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)
Published: 2016-12-17T03:34:00.000Z
CVE-2016-9160 
A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions.
Problem types: cwe_id: CWE-111
description: CWE-111: Direct Use of Unsafe JNI
Affected products: vendor: n/a
product: SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1)
Published: 2016-12-17T03:34:00.000Z
CVE-2016-9164 
Directory traversal vulnerability in diag.jsp file in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) 8.4 SP1 and earlier and CA Unified Infrastructure Management Snap (formerly CA Nimsoft Monitor Snap) allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T15:00:00.000Z