rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9447 
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-9448 
The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags TIFF_SETGET_C16ASCII or TIFF_SETGET_C32_ASCII to values that access 0-byte arrays.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9297.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T17:00:00.000Z
CVE-2016-9449 
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T18:00:00.000Z
CVE-2016-9450 
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T18:00:00.000Z
CVE-2016-9451 
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T18:00:00.000Z
CVE-2016-9452 
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-25T18:00:00.000Z
CVE-2016-9453 
The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T17:00:00.000Z
CVE-2016-9454 
Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists, requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9455 
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9456 
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery (CSRF) (CWE-352)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9457 
Revive Adserver before 3.2.3 suffers from Reflected XSS. `www/admin/stats.php` is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed, such as setPerPage, pageId, bannerid, period_start, period_end, and possibly others.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.3
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9459 
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However, Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.
Problem types: cwe_id: CWE-209
description: Cross-Site Scripting Using MIME Type Mismatch (CWE-209)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9460 
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a content-spoofing attack in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
Problem types: cwe_id: CWE-451
description: User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9461 
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying edit check permissions on WebDAV copy actions. The WebDAV endpoint was not properly checking the permission on a WebDAV COPY action. This allowed an authenticated attacker with access to a read-only share to put new files in there. It was not possible to modify existing files.
Problem types: cwe_id: CWE-275
description: Permission Issues (CWE-275)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9462 
Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are not properly verifying restore privileges when restoring a file. The restore capability of Nextcloud/ownCloud was not verifying whether a user has only read-only access to a share. Thus a user with read-only access was able to restore old versions.
Problem types: cwe_id: CWE-275
description: Permission Issues (CWE-275)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9463 
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. Note: The SMB backend is disabled by default and requires manual configuration in the Nextcloud/ownCloud config file. If you have not configured the SMB backend then you're not affected by this vulnerability.
Problem types: cwe_id: CWE-303
description: Incorrect Implementation of Authentication Algorithms (CWE-303)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9464 
Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group.
Problem types: cwe_id: CWE-285
description: Improper Authorization (CWE-285)
Affected products: vendor: n/a
product: Nextcloud Server Nextcloud Server before 9.0.54 and 10.0.0
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9465 
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9466 
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9467 
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the files app. The location bar in the files app was not verifying the passed parameters. An attacker could craft an invalid link to a fake directory structure and use this to display an attacker-controlled error message to the user.
Problem types: cwe_id: CWE-451
description: User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9468 
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from content spoofing in the dav app. The exception message displayed on the DAV endpoints contained partially user-controllable input leading to a potential misrepresentation of information.
Problem types: cwe_id: CWE-451
description: User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected products: vendor: n/a
product: Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9469 
Multiple versions of GitLab expose a dangerous method to any authenticated user that could lead to the deletion of all Issue and MergeRequest objects on a GitLab instance. For GitLab instances with publicly available projects this vulnerability could be exploited by an unauthenticated user. A fix was included in versions 8.14.3, 8.13.8, and 8.12.11, which were released on December 5th 2016 at 3:59 PST. The GitLab versions vulnerable to this are 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1, 8.14.2, and 8.14.2-ee.
Problem types: cwe_id: CWE-749
description: Exposed Dangerous Method or Function (CWE-749)
Affected products: vendor: n/a
product: GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9470 
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected File Download. `www/delivery/asyncspc.php` was vulnerable to the fairly new Reflected File Download (RFD) web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from a trusted domain.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.5 and 4.0.0
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9471 
Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fact that such characters are normally ignored when an HTML page is displayed in a browser. The issue could have therefore been exploited for user spoofing, although elevated privileges are required to create users within Revive Adserver.
Problem types: cwe_id: CWE-75
description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.5 and 4.0.0
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9472 
Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost, dbUser, and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective.
Problem types: cwe_id: CWE-79
description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Affected products: vendor: n/a
product: Revive Adserver All versions before 3.2.5 and 4.0.0
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9473 
Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier suffer from Full Address Bar Spoofing, allowing attackers to trick a victim by displaying a malicious page for legitimate domain names.
Problem types: cwe_id: CWE-451
description: User Interface (UI) Misrepresentation of Critical Information (CWE-451)
Affected products: vendor: n/a
product: Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier
Published: 2017-03-28T02:46:00.000Z
CVE-2016-9479 
The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-02T16:00:00.000Z
CVE-2016-9480 
libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-29T23:00:00.000Z
CVE-2016-9481 
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-29T23:00:00.000Z
CVE-2016-9482 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass
Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to access the administrator panel by navigating directly to /admin.php?mod=admin&func=panel
Problem types: cwe_id: CWE-302
description: CWE-302
Affected products: vendor: PHP FormMail
product: Generator
Credits: lang: en
value: Thanks to Pouya Darabi for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9483 PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted data
The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download() function. A remote unauthenticated attacker may be able to use this vulnerability to inject PHP code, or along with CVE-2016-9484 to perform local file inclusion attacks and obtain files from the server.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: PHP FormMail
product: Generator
Credits: lang: en
value: Thanks to Pouya Darabi for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9484 PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal
The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated attacker to perform a path traversal and access arbitrary files on the server. The PHP FormMail Generator website does not use version numbers and is updated continuously. Any PHP form code generated by this website prior to 2016-12-06 may be vulnerable.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: PHP FormMail
product: Generator
Credits: lang: en
value: Thanks to Pouya Darabi for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9485 On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because it fails to set any permissions on downloaded file objects
On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. The SecureConnector agent fails to set any permissions on downloaded file objects. This allows a malicious user to take ownership of any of these files and make modifications to it, regardless of where the files are saved. These files are then executed under SYSTEM privileges. A malicious unprivileged user can overwrite these executable files with malicious code before the SecureConnector agent executes them, causing the malicious code to be run under the SYSTEM account.
Problem types: cwe_id: CWE-378
description: CWE-378
Affected products: vendor: Microsoft
product: Windows SecureConnector agent
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9486 On Windows endpoints, the SecureConnector agent is vulnerable to privilege escalation whereby an authenticated unprivileged user can obtain administrator privileges on the endpoint because files are created in a folder with incorrect privileges
On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report information about the host to the CounterACT management appliance. The SecureConnector agent downloads these scripts and executables as needed from the CounterACT management appliance and runs them on the endpoint. By default, these executable files are downloaded to and run from the %TEMP% directory of the currently logged on user, despite the fact that the SecureConnector agent is running as SYSTEM. Aside from the downloaded scripts, the SecureConnector agent runs a batch file with SYSTEM privileges from the temp directory of the currently logged on user. If the naming convention of this script can be derived, which is made possible by placing it in a directory to which the user has read access, it may be possible overwrite the legitimate batch file with a malicious one before SecureConnector executes it. It is possible to change this directory by setting the the configuration property config.script_run_folder.value in the local.properties configuration file on the CounterACT management appliance, however the batch file which is run does not follow this property.
Problem types: cwe_id: CWE-379
description: CWE-379
Affected products: vendor: Microsoft
product: Windows SecureConnector agent
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9487 EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
Problem types: cwe_id: CWE-611
description: CWE-611
Affected products: vendor: EpubCheck
product: EpubCheck
Credits: lang: en
value: Thanks to Craig Arendt for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9488 ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: ManageEngine
product: Applications Manager
Published: 2018-06-05T14:00:00.000Z
CVE-2016-9489 ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass
In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e. changing their group to one with higher privileges like "ADMIN". A user is also able to change properties of another user, e.g. change another user's password.
Problem types: cwe_id: CWE-269
description: CWE-269
Affected products: vendor: ManageEngine
product: Applications Manager
Credits: lang: en
value: Thanks to Lukasz Juszczyk for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z