rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-8864 
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-02T17:00:00.000Z
CVE-2016-8866 
The AcquireMagickMemory function in MagickCore/memory.c in ImageMagick 7.0.3.3 before 7.0.3.8 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8862.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T19:00:00.000Z
CVE-2016-8867 
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8869 
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8870 
The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8871 
In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to recover plaintext, aka an "OAEP side channel" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8875 
The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image, aka "Data from Faulting Address is used as one or more arguments in a subsequent Function Call starting at ConvertToPDF_x86!CreateFXPDFConvertor."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-8876 
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF image embedded in the XFA stream in a PDF document, aka "Read Access Violation starting at FoxitReader."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-8877 
Heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted JPEG2000 image embedded in a PDF document, aka a "corrupted suffix pattern" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-8878 
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-8879 
The thumbnail shell extension plugin (FoxitThumbnailHndlr_x86.dll) in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to cause a denial of service (out-of-bounds write and application crash) via a crafted JPEG2000 image embedded in a PDF document, aka an "Exploitable - Heap Corruption" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-8882 
The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-8883 
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-8884 
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-28T14:00:00.000Z
CVE-2016-8885 
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-8886 
The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-8887 
The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-8889 
In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including private keys and the wallet passphrase in its persistent command history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-28T15:00:00.000Z
CVE-2016-8897 
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T18:21:31.000Z
CVE-2016-8898 
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T16:20:41.000Z
CVE-2016-8899 
Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T18:18:53.000Z
CVE-2016-8900 
Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-24T16:11:37.000Z
CVE-2016-8901 
b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-05-23T17:56:13.000Z
CVE-2016-8902 
SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8903 
SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8904 
SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8905 
SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8906 
SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8907 
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8908 
SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-14T23:00:00.000Z
CVE-2016-8909 
The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via an entry with the same value for buffer length and pointer position.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8910 
The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) by leveraging failure to limit the ring descriptor count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-04T21:00:00.000Z
CVE-2016-8911 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8912 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8913 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8915 
IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same process. IBM Reference #: 1998649.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: WebSphere MQ
Published: 2017-02-22T19:00:00.000Z
CVE-2016-8916 
IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is issued. IBM X-Force ID: 118472.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T19:00:00.000Z
CVE-2016-8917 
IBM Sterling Order Management 9.2 - 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000943.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Sterling Order Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-8918 
IBM Integration Bus, under non default configurations, could allow a remote user to authenticate without providing valid credentials.
Problem types: description: Bypass Security
Affected products: vendor: IBM Corporation
product: Integration Bus
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8919 
IBM WebSphere Application Server may be vulnerable to a denial of service, caused by allowing serialized objects from untrusted sources to run and cause the consumption of resources.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: WebSphere Application Server
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8920 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8921 
IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: FileNet Content Manager
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8922 
Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: WebSphere Portal
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8923 
IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the profile of a higher privileged user that they should not have access to. IBM X-Force ID: 118536.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Curam Social Program Management
Published: 2017-04-20T21:00:00.000Z
CVE-2016-8924 
IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session identifier. An attacker could exploit this vulnerability to gain access to another user's session. IBM X-Force ID: 118537.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Maximo Asset Management
Published: 2017-04-26T17:00:00.000Z
CVE-2016-8925 
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to include arbitrary files which could allow the attacker to read any file on the system. IBM X-Force ID: 118538.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tivoli Application Dependency Discovery Manager
Published: 2017-04-14T16:00:00.000Z
CVE-2016-8926 
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized users. IBM X-Force ID: 118539.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tivoli Application Dependency Discovery Manager
Published: 2017-04-14T16:00:00.000Z
CVE-2016-8927 
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118540.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Tivoli Application Dependency Discovery Manager
Published: 2017-04-14T16:00:00.000Z
CVE-2016-8928 
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8929 
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8930 
IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8931 
IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8932 
IBM Kenexa LMS on Cloud could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8933 
IBM Kenexa LMS on Cloud could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing dot dot sequences (/../) to view arbitrary files on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8934 
IBM WebSphere Application Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: WebSphere Application Server for Bluemix
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8935 
IBM Kenexa LMS on Cloud 13.1, 13.2, 13.2.2, 13.2.3, 13.2.4 and 14.0.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999483.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-03-31T18:00:00.000Z
CVE-2016-8936 
IBM Social Rendering Templates for Digital Data Connector is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: WebSphere Portal
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8937 
The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information during authentication. An attacker could gain user or administrative access to the TSM server. IBM X-Force ID: 118750.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect
Published: 2017-10-05T17:00:00.000Z
CVE-2016-8938 
IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: UrbanCode Deploy
Published: 2017-02-01T22:00:00.000Z
CVE-2016-8939 
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) clients/agents store password information in the Windows Registry in a manner which can be compromised. IBM X-Force ID: 118790.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Protect
Published: 2017-06-07T17:00:00.000Z
CVE-2016-8940 
IBM Tivoli Storage Manager (IBM Spectrum Protect) 6.1, 6.2, 6.3, and 7.1 does not perform sufficient authority checking on SQL queries. As a result, an attacker is able to submit SQL queries that access database tables that are not intended for access or use by administrators. The access of these product specific database tables may allow access to passwords or other sensitive information for the product. IBM Reference #: 1998946.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager
Published: 2017-03-07T17:00:00.000Z
CVE-2016-8941 
IBM Tivoli Storage Productivity Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Spectrum Control Standard Select Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8942 
IBM Tivoli Storage Productivity Center could allow an authenticated user with intimate knowledge of the system to edit a limited set of properties on the server.
Problem types: description: Data Manipulation
Affected products: vendor: IBM Corporation
product: Spectrum Control Standard Select Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8943 
IBM Tivoli Storage Productivity Center is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Spectrum Control Standard Select Edition
Published: 2017-02-01T20:00:00.000Z
CVE-2016-8944 
IBM AIX 7.1 and 7.2 allows a local user to open a file with a specially crafted argument that would crash the system. IBM APARs: IV91488, IV91487, IV91456, IV90234.
Problem types: description: Denial of Service
Affected products: vendor: IBM Corporation
product: AIX
Published: 2017-02-15T19:00:00.000Z