rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9490 ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ManageEngine
product: Applications Manager
Published: 2018-06-05T14:00:00.000Z
CVE-2016-9491 ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation due to improper restriction of an XML external entity
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
Problem types: cwe_id: CWE-611
description: CWE-611
Affected products: vendor: ManageEngine
product: Applications Manager
Credits: lang: en
value: Thanks to Lukasz Juszczyk for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9492 PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to unrestricted upload of dangerous file types. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: PHP FormMail
product: Generator
Credits: lang: en
value: Thanks to Ibram Marzouk for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9493 PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting
The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In the generated form.lib.php file, upload file types are checked against a hard-coded list of dangerous extensions. This list does not include all variations of PHP files, which may lead to execution of the contained PHP code if the attacker can guess the uploaded filename. The form by default appends a short random string to the end of the filename.
Problem types: cwe_id: CWE-80
description: CWE-80
Affected products: vendor: PHP FormMail
product: Generator
Credits: lang: en
value: Thanks to Ibram Marzouk for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9494 Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation, potentially leading to denial of service
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may lead to a denial of service.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Hughes Satellite Modem
product: HN7740S
vendor: Hughes Satellite Modem
product: DW7000
vendor: Hughes Satellite Modem
product: HN7000S/SM
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9495 Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's default telnet port (23) can be obtained through using one of a few default credentials shared among all devices.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Hughes Satellite Modem
product: HN7740S
vendor: Hughes Satellite Modem
product: DW7000
vendor: Hughes Satellite Modem
product: HN7000S/SM
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9496 Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication to access certain pages
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: Hughes Satellite Modem
product: HN7740S
vendor: Hughes Satellite Modem
product: DW7000
vendor: Hughes Satellite Modem
product: HN7000S/SM
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9497 Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, is vulnerable to an authentication bypass using an alternate path or channel. By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: Hughes Satellite Modem
product: HN7740S
vendor: Hughes Satellite Modem
product: DW7000
vendor: Hughes Satellite Modem
product: HN7000S/SM
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9498 ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: ManageEngine
product: Applications Manager
Credits: lang: en
value: Thanks to Lukasz Juszczyk for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9499 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
Problem types: cwe_id: CWE-204
description: CWE-204
Affected products: vendor: Accellion
product: FTP Server
Credits: lang: en
value: Thanks to Ashish Kamble for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9500 The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
Problem types: cwe_id: CWE-80
description: CWE-80
Affected products: vendor: Accellion
product: FTP Server
Credits: lang: en
value: Thanks to Ashish Kamble for reporting this vulnerability.
Published: 2018-07-13T20:00:00.000Z
CVE-2016-9532 
Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tif file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T17:00:00.000Z
CVE-2016-9533 
tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference heap-buffer-overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9534 
tif_write.c in libtiff 4.0.6 has an issue in the error code path of TIFFFlushData1() that didn't reset the tif_rawcc and tif_rawcp members. Reported as MSVR 35095, aka "TIFFFlushData1 heap-buffer-overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9535 
tif_predict.h and tif_predict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual tile size like YCbCr with subsampling. Reported as MSVR 35105, aka "Predictor heap-buffer-overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9536 
tools/tiff2pdf.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers in t2p_process_jpeg_strip(). Reported as MSVR 35098, aka "t2p_process_jpeg_strip heap-buffer-overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9537 
tools/tiffcrop.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in buffers. Reported as MSVR 35093, MSVR 35096, and MSVR 35097.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9538 
tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9539 
tools/tiffcrop.c in libtiff 4.0.6 has an out-of-bounds read in readContigTilesIntoBuffer(). Reported as MSVR 35092.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9540 
tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile heap-buffer-overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-22T19:00:00.000Z
CVE-2016-9553 
The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP addresses from accessing the device. The device doesn't properly escape the information passed in the variables 'unblockip' and 'blockip' before calling the shell_exec() function which allows for system commands to be injected into the device. The code erroneously suggests that the information handled is protected by utilizing the variable name 'escapedips' - however this was not the case. The Sophos ID is NSWA-1258.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T12:38:00.000Z
CVE-2016-9554 
The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php), in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities, /controllers/MgrDiagnosticTools.php, is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T12:38:00.000Z
CVE-2016-9555 
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-28T03:01:00.000Z
CVE-2016-9556 
The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9557 
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-23T18:00:00.000Z
CVE-2016-9558 
(1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit pattern in a signed leb number, aka a "negation overflow."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-28T18:00:00.000Z
CVE-2016-9559 
coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-01T15:00:00.000Z
CVE-2016-9560 
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T19:00:00.000Z
CVE-2016-9561 
The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T05:00:00.000Z
CVE-2016-9562 
SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4TunnelingApp!web/myServlet URI, aka SAP Security Note 2313835.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-23T02:00:00.000Z
CVE-2016-9563 
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-23T02:00:00.000Z
CVE-2016-9564 
Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-9565 
MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T22:00:00.000Z
CVE-2016-9566 
base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file.  NOTE: this can be leveraged by remote attackers using CVE-2016-9565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T22:00:00.000Z
CVE-2016-9567 
The mDNIe system service on Samsung Mobile S7 devices with M(6.0) software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The Samsung ID is SVE-2016-6343.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-23T11:00:00.000Z
CVE-2016-9568 
A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-19T19:00:00.000Z
CVE-2016-9569 
The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T18:00:00.000Z
CVE-2016-9570 
cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and application crash) by leveraging access to the NetMon named pipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-12T18:00:00.000Z
CVE-2016-9572 
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: The OpenJPEG Project
product: openjpeg
Published: 2018-08-01T16:00:00.000Z
CVE-2016-9573 
An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The OpenJPEG Project
product: openjpeg
Published: 2018-08-01T06:00:00.000Z
CVE-2016-9574 
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
Problem types: cwe_id: CWE-325
description: CWE-325
Affected products: vendor: [UNKNOWN]
product: nss
Published: 2018-07-19T13:00:00.000Z
CVE-2016-9575 
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: FreeIPA
product: ipa
Published: 2018-03-13T13:00:00.000Z
CVE-2016-9576 
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-28T07:42:00.000Z
CVE-2016-9577 
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
Problem types: cwe_id: CWE-20
description: CWE-20
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: Red Hat
product: spice
Published: 2018-07-27T20:00:00.000Z
CVE-2016-9578 
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.
Problem types: cwe_id: CWE-20
description: CWE-20
cwe_id: CWE-770
description: CWE-770
Affected products: vendor: Red Hat
product: spice
Published: 2018-07-27T21:00:00.000Z
CVE-2016-9579 
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Red Hat
product: ceph
Published: 2018-08-01T16:00:00.000Z
CVE-2016-9580 
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: The OpenJPEG Project
product: openjpeg2
Published: 2018-08-01T16:00:00.000Z
CVE-2016-9581 
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
Problem types: cwe_id: CWE-835
description: CWE-835
cwe_id: CWE-122
description: CWE-122
Affected products: vendor: The OpenJPEG Project
product: openjpeg2
Published: 2018-08-01T14:00:00.000Z
CVE-2016-9583 
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
Problem types: cwe_id: CWE-190
description: CWE-190
cwe_id: CWE-125
description: CWE-125
Affected products: vendor: The Jasper Project
product: jasper
Published: 2018-08-01T17:00:00.000Z
CVE-2016-9584 
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-9585 
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: Red Hat, Inc.
product: EAP-5
Published: 2018-03-09T15:00:00.000Z
CVE-2016-9586 
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: redhat
product: curl
Published: 2018-04-23T18:00:00.000Z
CVE-2016-9587 
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: unspecified
product: Ansible
Published: 2018-04-24T16:00:00.000Z