rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-8946 
IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118833.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-8947 
IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118834
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-8948 
IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118835.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-8949 
IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118836.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Emptoris Supplier Lifecycle Management
Published: 2017-08-09T18:00:00.000Z
CVE-2016-8950 
IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118837.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-8951 
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to a denial of service attack. An attacker can exploit a vulnerability in the authentication features that could log out users and flood user accounts with emails. IBM X-Force ID: 118838.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-07-13T15:00:00.000Z
CVE-2016-8952 
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118839.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-07-13T15:00:00.000Z
CVE-2016-8953 
IBM Emptoris Sourcing 9.5.x through 10.1.x could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 118840.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-8954 
IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: DashDB Local
Published: 2017-02-08T22:00:00.000Z
CVE-2016-8960 
IBM Cognos Business Intelligence 10.2 could allow a user with lower privilege Capabilities to adopt the Capabilities of a higher-privilege user by intercepting the higher-privilege user's cookie value from its HTTP request and then reusing it in subsequent requests. IBM Reference #: 1993718.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Cognos Business Intelligence
Published: 2017-03-27T22:00:00.000Z
CVE-2016-8961 
IBM BigFix Inventory v9 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8962 
IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-04-26T17:00:00.000Z
CVE-2016-8963 
IBM BigFix Inventory v9 stores potentially sensitive information in log files that could be read by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8964 
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: BigFix Inventory
Published: 2017-07-13T15:00:00.000Z
CVE-2016-8966 
IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8967 
IBM BigFix Inventory v9 9.2 stores user credentials in plain in clear text which can be read by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T21:00:00.000Z
CVE-2016-8968 
IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998515.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-02-15T19:00:00.000Z
CVE-2016-8971 
IBM WebSphere MQ 8.0 could allow an authenticated user with queue manager permissions to cause a segmentation fault which would result in the box having to be rebooted to resume normal operations. IBM Reference #: 1998663.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: WebSphere MQ
Published: 2017-03-07T17:00:00.000Z
CVE-2016-8972 
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006, IV91007, IV91008, IV91010, IV91011.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: AIX
Published: 2017-02-15T19:00:00.000Z
CVE-2016-8973 
IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. IBM Reference #: 1999960.
Problem types: description: Other
Affected products: vendor: IBM Corporation
product: Rational Rhapsody Design Manager
Published: 2017-03-20T16:00:00.000Z
CVE-2016-8974 
IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 1997798.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Rhapsody Design Manager
Published: 2017-02-23T16:00:00.000Z
CVE-2016-8975 
IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118912.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Rhapsody Design Manager
Published: 2017-07-24T21:00:00.000Z
CVE-2016-8977 
IBM BigFix Inventory v9 could disclose sensitive information to an unauthorized user using HTTP GET requests. This information could be used to mount further attacks against the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8980 
IBM BigFix Inventory v9 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8981 
IBM BigFix Inventory v9 allows web pages to be stored locally which can be read by another user on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: BigFix Inventory
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8982 
IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: InfoSphere DataStage
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8986 
IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Reference #: 1998648.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: WebSphere MQ
Published: 2017-02-22T19:00:00.000Z
CVE-2016-8987 
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2017-06-08T21:00:00.000Z
CVE-2016-8998 
IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted SQL query and execute arbitrary code on the server. IBM Reference #: 1998747.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager
Published: 2017-02-24T18:00:00.000Z
CVE-2016-8999 
IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: InfoSphere Information Server
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9000 
IBM InfoSphere DataStage is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this vulnerability using a specially-crafted URL to navigate to a web page the attacker controls. An attacker could use this vulnerability to conduct clickjacking or other client-side browser attacks.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: InfoSphere Information Server
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9005 
IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: System Storage
Published: 2017-02-08T22:00:00.000Z
CVE-2016-9006 
IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: C1000264.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-03-08T19:00:00.000Z
CVE-2016-9008 
IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-02-01T22:00:00.000Z
CVE-2016-9009 
IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #: 1998647.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: WebSphere MQ
Published: 2017-02-24T18:00:00.000Z
CVE-2016-9010 
IBM WebSphere Message Broker 9.0 and 10.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM Reference #: 1997906.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Integration Bus
Published: 2017-02-15T19:00:00.000Z
CVE-2016-9011 
The wmf_malloc function in api.c in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (application crash) via a crafted wmf file, which triggers a memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9012 
CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request to /web/system/console/bundle.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-9013 
Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T20:00:00.000Z
CVE-2016-9014 
Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-09T20:00:00.000Z
CVE-2016-9015 
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-11T16:00:00.000Z
CVE-2016-9016 
Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-19T20:00:00.000Z
CVE-2016-9017 
Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "opname in crafted JavaScript file" approach, related to an "Out-of-Bounds read" issue affecting the jsC_dumpfunction function in the jsdump.c component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-9018 
Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5.705 through a crafted .QCP media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-9019 
SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-9020 
SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-07T16:00:00.000Z
CVE-2016-9021 
Exponent CMS before 2.6.0 has improper input validation in storeController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T02:09:27.000Z
CVE-2016-9022 
Exponent CMS before 2.6.0 has improper input validation in usersController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T02:10:26.000Z
CVE-2016-9023 
Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T02:13:32.000Z
CVE-2016-9025 
Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T02:11:12.000Z
CVE-2016-9026 
Exponent CMS before 2.6.0 has improper input validation in fileController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T02:12:11.000Z
CVE-2016-9028 
Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal session cookies of a legitimate AAA user via manipulation of Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-9031 
An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-8733.
Problem types: description: integer overflow
Affected products: vendor: Joyent
product: SmartOS
Published: 2016-12-14T17:00:00.000Z
CVE-2016-9032 
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9034.
Problem types: description: buffer overflow
Affected products: vendor: Joyent
product: SmartOS
Published: 2016-12-14T17:00:00.000Z
CVE-2016-9033 
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9035.
Problem types: description: buffer overflow
Affected products: vendor: Joyent
product: SmartOS
Published: 2016-12-14T17:00:00.000Z
CVE-2016-9034 
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9032.
Problem types: description: buffer overflow
Affected products: vendor: Joyent
product: SmartOS
Published: 2016-12-14T17:00:00.000Z
CVE-2016-9035 
An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9033.
Problem types: description: buffer overflow
Affected products: vendor: Joyent
product: SmartOS
Published: 2016-12-14T17:00:00.000Z
CVE-2016-9036 
An exploitable incorrect return value vulnerability exists in the mp_check function of Tarantool's Msgpuck library 1.0.3. A specially crafted packet can cause the mp_check function to incorrectly return success when trying to check if decoding a map16 packet will read outside the bounds of a buffer, resulting in a denial of service vulnerability.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Tarantool
product: Msgpuck library
Published: 2016-12-23T22:00:00.000Z