rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-8516 
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: Systems Insight Manager using OpenSSL
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8517 
A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Problem types: description: cross site scripting
Affected products: vendor: Hewlett Packard Enterprise
product: Systems Insight Manager using OpenSSL
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8518 
A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: Systems Insight Manager using OpenSSL
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8519 
A remote code execution vulnerability in HPE Operations Orchestration Community edition and Enterprise edition prior to v10.70 was found.
Problem types: description: Remote Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: Operations Orchestration
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8520 
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data.
Problem types: description: Remote Unauthorized Access
Affected products: vendor: Hewlett Packard Enterprise
product: Helion Eucalyptus
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8521 
A Remote click jacking vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found.
Problem types: description: Click Jacking
Affected products: vendor: Hewlett Packard Enterprise
product: Diagnostics
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8522 
A cross-site scripting vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found.
Problem types: description: Remote Cross-Site Scripting
Affected products: vendor: Hewlett Packard Enterprise
product: Diagnostics
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8523 
A Remote Arbitrary Code Execution vulnerability in HPE Smart Storage Administrator version before v2.60.18.0 was found.
Problem types: description: Remote Arbitrary Code Execution
Affected products: vendor: Hewlett Packard Enterprise
product: Smart Storage Administrator
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8525 
A Remote Disclosure of Information vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequent version.
Problem types: description: Remote Disclosure of Information
Affected products: vendor: Hewlett Packard Enterprise
product: iMC PLAT
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8526 
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.
Problem types: description: XML External Entity Vulnerability
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba AirWave
Published: 2018-08-06T20:00:00.000Z
CVE-2016-8527 
Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the VisualRF component of AirWave. By exploiting this vulnerability, an attacker who can trick a logged-in AirWave administrative user into clicking a link could obtain sensitive information, such as session cookies or passwords. The vulnerability requires that an administrative users click on the malicious link while currently logged into AirWave in the same browser.
Problem types: description: reflected cross site scripting
Affected products: vendor: Hewlett Packard Enterprise
product: Aruba AirWave
Published: 2018-08-06T20:00:00.000Z
CVE-2016-8528 
A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found.
Problem types: description: Remote Escalation of Privilege
Affected products: vendor: Hewlett Packard Enterprise
product: Helion Eucalyptus
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8529 
A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier was found. The problem was resolved in LeftHand OS v12.6 or any subsequent version.
Problem types: description: Remote Arbitrary Command Execution
Affected products: vendor: Hewlett Packard Enterprise
product: StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8530 
A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequent version.
Problem types: description: remote denial of service
Affected products: vendor: Hewlett Packard Enterprise
product: iMC PLAT
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8531 
A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Problem types: description: remote information disclosure
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8532 
A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Problem types: description: XSS
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8533 
A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Problem types: description: Priviledge Escalation
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8534 
A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Problem types: description: privilege elevation
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8535 
A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found.
Problem types: description: Http Parameter Pollutio
Affected products: vendor: Hewlett Packard Enterprise
product: Matrix Operating Environment
Published: 2018-02-15T22:00:00.000Z
CVE-2016-8561 
A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Users with elevated privileges to TIA-Portal and project data on the engineering station could possibly get privileged access on affected devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-18T21:00:00.000Z
CVE-2016-8562 
A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-18T21:00:00.000Z
CVE-2016-8563 
Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to cause a denial of service (ALM service outage) via crafted packets to TCP port 4410.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T10:00:00.000Z
CVE-2016-8564 
SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T10:00:00.000Z
CVE-2016-8565 
Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T10:00:00.000Z
CVE-2016-8566 
An issue was discovered in Siemens SICAM PAS before 8.00. Because of Storing Passwords in a Recoverable Format, an authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database.
Problem types: description: Siemens SICAM PAS Storing Passwords in a Recoverable Format
Affected products: vendor: n/a
product: Siemens SICAM PAS before 8.00
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8567 
An issue was discovered in Siemens SICAM PAS before 8.00. A factory account with hard-coded passwords is present in the SICAM PAS installations. Attackers might gain privileged access to the database over Port 2638/TCP.
Problem types: description: Siemens SICAM PAS hard-coded passwords
Affected products: vendor: n/a
product: Siemens SICAM PAS before 8.00
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8568 
The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T15:00:00.000Z
CVE-2016-8569 
The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T15:00:00.000Z
CVE-2016-8574 
The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-8575 
The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-8576 
The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8577 
Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8578 
The v9fs_iov_vunmarshal function in fsdev/9p-iov-marshal.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) by sending an empty string parameter to a 9P operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8579 
docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8580 
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8581 
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8582 
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8583 
Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8584 
Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessing the value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8585 
admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8586 
detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8587 
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8588 
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8589 
log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8590 
log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8591 
log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8592 
log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8593 
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-28T19:00:00.000Z
CVE-2016-8595 
The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T05:00:00.000Z
CVE-2016-8596 
Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8597 
Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8598 
Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8600 
In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8602 
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-14T18:00:00.000Z
CVE-2016-8605 
The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions. For example, mkdir without the optional mode argument would create directories as 0777. This is fixed in Guile 2.0.13. Prior versions are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T22:00:00.000Z
CVE-2016-8606 
The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-12T22:00:00.000Z
CVE-2016-8608 
JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Red Hat
product: BRMS
Published: 2018-08-01T14:00:00.000Z
CVE-2016-8609 
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Problem types: cwe_id: CWE-384
description: CWE-384
Affected products: vendor: Red Hat
product: keycloak
Published: 2018-08-01T17:00:00.000Z
CVE-2016-8610 
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: OpenSSL
product: OpenSSL
Published: 2017-11-13T22:00:00.000Z
CVE-2016-8611 
A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2 `/images` API POST method for authenticated users, resulting in possible denial of service attacks through database table saturation.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: The Openstack Foundation
product: openstack-glance
Published: 2018-07-31T20:00:00.000Z
CVE-2016-8612 
Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol parsing logic in the load balancer resulting in a Segmentation Fault in the serving httpd process.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Red Hat, Inc.
product: mod_cluster
Published: 2018-03-09T20:00:00.000Z
CVE-2016-8613 
A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: The Foreman Project
product: foreman
Published: 2018-07-31T20:00:00.000Z
CVE-2016-8614 
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Problem types: cwe_id: CWE-358
description: CWE-358
Affected products: vendor: Red Hat
product: Ansible
Published: 2018-07-31T21:00:00.000Z
CVE-2016-8615 
A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back and used for subsequent requests, a malicious HTTP server can inject new cookies for arbitrary domains into said cookie jar.
Problem types: cwe_id: CWE-99
description: CWE-99
Affected products: vendor: The Curl Project
product: curl
Published: 2018-08-01T06:00:00.000Z
CVE-2016-8616 
A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped credentials, an attacker can cause that connection to be reused if s/he knows the case-insensitive version of the correct password.
Problem types: cwe_id: CWE-592
description: CWE-592
Affected products: vendor: The Curl Project
product: curl
Published: 2018-08-01T06:00:00.000Z
CVE-2016-8617 
The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if it receives at least 1Gb as input via `CURLOPT_USERNAME`.
Problem types: cwe_id: CWE-787
description: CWE-787
Affected products: vendor: The Curl Project
product: curl
Published: 2018-07-31T22:00:00.000Z