rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9220 
A Denial of Service Vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause the connection table to be full of invalid connections and be unable to process new incoming requests. More Information: CSCvb66659. Known Affected Releases: 8.2(130.0). Known Fixed Releases: 8.2(131.10) 8.2(131.6) 8.2(141.0) 8.3(104.56) 8.4(1.88) 8.4(1.91).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Mobility Express 2800 and 3800
Published: 2017-01-26T07:45:00.000Z
CVE-2016-9221 
A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenticated, adjacent attacker to cause authentication to fail. Affected Products: This vulnerability affects Cisco Mobility Express 2800 Series and 3800 Series Access Points when configured in local mode in 40 MHz. More Information: CSCvb33575. Known Affected Releases: 8.2(121.12) 8.4(1.82). Known Fixed Releases: 8.2(131.2) 8.2(131.3) 8.2(131.4) 8.2(141.0) 8.3(104.53) 8.3(104.54) 8.4(1.80) 8.4(1.85).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Mobility Express 2800 Series and 3800 Series Access Points
Published: 2017-01-26T07:45:00.000Z
CVE-2016-9222 
A vulnerability in the web-based management interface of Cisco NetFlow Generation Appliance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvb15229. Known Affected Releases: 1.0(2).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco NetFlow Generation Appliance 1.0(2)
Published: 2017-01-26T07:45:00.000Z
CVE-2016-9223 
A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. Affected Products: This vulnerability affect all releases of Cisco CloudCenter Orchestrator (CCO) deployments where the Docker Engine TCP port 2375 is open on the system and bound to local address 0.0.0.0 (any interface).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco CloudCenter Orchestrator
Published: 2016-12-26T07:55:00.000Z
CVE-2016-9224 
A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information: CSCvc31635. Known Affected Releases: 10.6(9). Known Fixed Releases: 11.0(0).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Jabber Guest Server 10.6(9)
Published: 2016-12-26T07:55:00.000Z
CVE-2016-9225 
A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could allow an unauthenticated, remote attacker to cause the CX module to be unable to process further traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of IP fragments. An attacker could exploit this vulnerability by sending crafted fragmented IP traffic across the CX module. An exploit could allow the attacker to exhaust free packet buffers in shared memory (SHM), causing the CX module to be unable to process further traffic, resulting in a DoS condition. This vulnerability affects all versions of the ASA CX Context-Aware Security module. Cisco has not released and will not release software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCva62946.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: all versions of the ASA CX Context-Aware Security module
Published: 2017-02-01T19:00:00.000Z
CVE-2016-9242 
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-07T11:00:00.000Z
CVE-2016-9243 
HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-27T17:00:00.000Z
CVE-2016-9244 
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.
Problem types: description: TLS Session Ticket uninitialized memory leak
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, PEM, PSM
Published: 2017-02-09T15:00:00.000Z
CVE-2016-9245 
In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with BIG-IP APM profiles, regardless of settings. The issue is also exposed with the non-default "Normalize URI" configuration options used in iRules and/or BIG-IP LTM policies. An attacker may be able to disrupt traffic or cause the BIG-IP system to fail over to another device in the device group.
Problem types: description: denial of service
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
Published: 2017-03-07T21:00:00.000Z
CVE-2016-9247 
Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets may cause the Traffic Management Microkernel (TMM) to restart.
Problem types: description: TCP Analytics vulnerability
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
Published: 2017-01-10T16:00:00.000Z
CVE-2016-9249 
An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
Problem types: description: BIG-IP Virtual Server with TCP Fast Open vulnerability
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, WebSafe
Published: 2017-01-31T15:00:00.000Z
CVE-2016-9250 
In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.
Problem types: description: Arbitrary File Deletion via Undisclosed Mechanism
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP
Published: 2017-05-10T14:00:00.000Z
CVE-2016-9251 
In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.
Problem types: description: Undisclosed privilege escalation in iControl Rest
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP
Published: 2017-05-09T15:00:00.000Z
CVE-2016-9252 
The Traffic Management Microkernel (TMM) in F5 BIG-IP before 11.5.4 HF3, 11.6.x before 11.6.1 HF2 and 12.x before 12.1.2 does not properly handle minimum path MTU options for IPv6, which allows remote attackers to cause a denial-of-service (DoS) through unspecified vectors.
Problem types: description: TMM data-plane
Affected products: vendor: F5 Networks
product: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, PSM, WebAccelerator, WebSafe
Published: 2017-03-27T18:00:00.000Z
CVE-2016-9253 
In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket profile.
Problem types: description: Websocket profile vulnerability
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP
Published: 2017-05-09T15:00:00.000Z
CVE-2016-9256 
In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change.
Problem types: description: iControl vulnerability CVE-2016-9256
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP
Published: 2017-05-09T15:00:00.000Z
CVE-2016-9257 
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
Problem types: description: Non-authenticated XSS attack against Administrative interface via public interface
Affected products: vendor: F5 Networks, Inc.
product: BIG-IP APM
Published: 2017-05-09T15:00:00.000Z
CVE-2016-9259 
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-28T18:00:00.000Z
CVE-2016-9260 
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-31T22:00:00.000Z
CVE-2016-9261 
Cross-site scripting (XSS) vulnerability in Tenable Log Correlation Engine (aka LCE) before 4.8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-28T18:00:00.000Z
CVE-2016-9262 
Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9263 
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-12T16:00:00.000Z
CVE-2016-9264 
Buffer overflow in the printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9265 
The printMP3Headers function in listmp3.c in Libming 0.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9266 
listmp3.c in libming 0.4.7 allows remote attackers to unspecified impact via a crafted mp3 file, which triggers an invalid left shift.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9268 
Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-10T20:00:00.000Z
CVE-2016-9269 
Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to run arbitrary commands on the system as root via Patch Update functionality. This was resolved in Version 6.5 CP 1737.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z
CVE-2016-9271 
Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-26T15:32:01.000Z
CVE-2016-9272 
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T11:00:00.000Z
CVE-2016-9273 
tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF_STRIPCHOP mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9274 
Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T17:00:00.000Z
CVE-2016-9275 
Heap-based buffer overflow in the _dwarf_skim_forms function in libdwarf/dwarf_macro5.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9276 
The dwarf_get_aranges_list function in dwarf_arrange.c in Libdwarf before 20161124 allows remote attackers to cause a denial of service (out-of-bounds read).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9277 
Integer overflow in SystemUI in KK(4.4) and L(5.0/5.1) on Samsung Note devices allows attackers to cause a denial of service (UI restart) via vectors involving APIs and an activity that computes an out-of-bounds array index, aka SVE-2016-6906.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T19:00:00.000Z
CVE-2016-9278 
The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a crafted ioctl command. The Samsung ID is SVE-2016-6736.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9279 
Use-after-free vulnerability in the Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows attackers to obtain sensitive information via unspecified vectors. The Samsung ID is SVE-2016-6853.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9282 
SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T22:00:00.000Z
CVE-2016-9283 
SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T22:00:00.000Z
CVE-2016-9284 
getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T22:00:00.000Z
CVE-2016-9285 
framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T22:00:00.000Z
CVE-2016-9286 
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T22:00:00.000Z
CVE-2016-9287 
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-15T11:00:00.000Z
CVE-2016-9288 
In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-11T23:00:00.000Z
CVE-2016-9294 
Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service (application crash)" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer dereference" issue affecting the jscompile.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-12T00:00:00.000Z
CVE-2016-9296 
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-12T02:19:00.000Z
CVE-2016-9297 
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII tag values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9298 
Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T22:01:00.000Z
CVE-2016-9299 
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T23:00:00.000Z
CVE-2016-9303 
Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-25T19:00:00.000Z
CVE-2016-9304 
Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-25T19:00:00.000Z
CVE-2016-9305 
Improper handling in the Autodesk FBX-SDK before 2017.1 of type mismatches and previously deleted objects related to reading and converting malformed FBX format files can allow attackers to gain access to uninitialized pointers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-25T19:00:00.000Z
CVE-2016-9306 
Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-25T19:00:00.000Z
CVE-2016-9307 
Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-25T19:00:00.000Z
CVE-2016-9310 
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-9311 
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-9312 
ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-9313 
security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-28T03:01:00.000Z
CVE-2016-9314 
Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linux_1707 and earlier allows authenticated, remote users with least privileges to backup the system configuration and download it onto their local machine. This backup file contains sensitive information like passwd/shadow files, RSA certificates, Private Keys and Default Passphrase, etc. This was resolved in Version 6.5 CP 1737.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-21T07:46:00.000Z