rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-5824 
libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T22:01:00.000Z
CVE-2016-5825 
The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T22:01:00.000Z
CVE-2016-5826 
The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string to the icalparser_parse_string function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T22:01:00.000Z
CVE-2016-5827 
The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string to the icalparser_parse_string function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-27T22:01:00.000Z
CVE-2016-5828 
The start_thread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-5829 
Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-27T10:00:00.000Z
CVE-2016-5832 
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5833 
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5834 
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5835 
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5836 
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5837 
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5838 
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5839 
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-29T14:00:00.000Z
CVE-2016-5840 
hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-06-30T16:00:00.000Z
CVE-2016-5841 
Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T15:00:00.000Z
CVE-2016-5842 
MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T15:00:00.000Z
CVE-2016-5843 
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-17T01:00:00.000Z
CVE-2016-5844 
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-5845 
SAP SAPCAR does not check the return value of file operations when extracting files, which allows remote attackers to cause a denial of service (program crash) via an invalid file name in an archive file, aka SAP Security Note 2312905.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-12T16:00:00.000Z
CVE-2016-5847 
SAP SAPCAR allows local users to change the permissions of arbitrary files and consequently gain privileges via a hard link attack on files extracted from an archive, possibly related to SAP Security Note 2327384.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-12T16:00:00.000Z
CVE-2016-5848 
Siemens SICAM PAS before 8.07 does not properly restrict password data in the database, which makes it easier for local users to calculate passwords by leveraging unspecified database privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T16:00:00.000Z
CVE-2016-5849 
Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-04T16:00:00.000Z
CVE-2016-5850 
Cross-site scripting (XSS) vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-5851 
python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-21T00:00:00.000Z
CVE-2016-5852 
For the NVIDIA Quadro, NVS, and GeForce products, GFE GameStream and NVTray Plugin unquoted service path vulnerabilities are examples of the unquoted service path vulnerability in Windows. A successful exploit of a vulnerable service installation can enable malicious code to execute on the system at the system/user privilege level. The CVE-2016-5852 ID is for the NVTray Plugin unquoted service path.
Problem types: description: Escalation of Privileges
Affected products: vendor: n/a
product: Quadro, NVS, GeForce (all versions)
Published: 2016-11-08T20:37:00.000Z
CVE-2016-5853 
In an audio driver in all Qualcomm products with Android releases from CAF using the Linux kernel, when a sanity check encounters a length value not in the correct range, an error message is printed, but code execution continues in the same way as for a correct length value.
Problem types: description: Detection of Error Condition Without Action in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5854 
In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, kernel heap memory can be exposed to userspace.
Problem types: description: Information Exposure in Secure Processor
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5855 
In a driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a user-supplied buffer is casted to a structure without checking if the source buffer is large enough.
Problem types: description: Buffer Over-read in Secure Processor
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5856 
Drivers/soc/qcom/spcom.c in the Qualcomm SPCom driver in the Android kernel 2017-03-05 allows local users to gain privileges, a different vulnerability than CVE-2016-5857.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T22:00:00.000Z
CVE-2016-5857 
The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application, aka Android internal bug 34386529 and Qualcomm internal bug CR#1094140.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2016-5858 
In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a user supplies a value too large, then an out-of-bounds read occurs.
Problem types: description: Improper Validation of Array Index in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5859 
In a sound driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integer overflow could occur followed by a buffer overflow.
Problem types: description: Integer Overflow to Buffer Overflow in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5860 
In an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, if a function is called with a very large length, an integer overflow could occur followed by a heap buffer overflow.
Problem types: description: Integer Overflow to Buffer Overflow in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5861 
In a display driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable controlled by userspace is used to calculate offsets and sizes for copy operations, which could result in heap overflow.
Problem types: description: Buffer Copy without Checking Size of Input in Display
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5862 
When a control related to codec is issued from userspace in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, the type casting is done to the container structure instead of the codec's individual structure, resulting in a device restart after kernel crash occurs.
Problem types: description: Untrusted Pointer Dereference in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5863 
In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing which can lead to out-of-bounds accesses.
Problem types: description: Improper Validation of Array Index in USB
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5864 
In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from userspace, and if they are set to a large value, integer overflow is possible followed by buffer overflow. In another function, a missing check for a lower bound may result in an out of bounds memory access.
Problem types: description: Integer Overflow to Buffer Overflow in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5867 
In a sound driver in Android for MSM, Firefox OS for MSM, QRD Android, some variables are from userspace and values can be chosen that could result in stack overflow.
Problem types: description: Buffer Copy without Checking Size of Input in Audio
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-16T15:00:00.000Z
CVE-2016-5868 
drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application compromising a privileged process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2016-5870 
The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact by triggering failure of an accept system call for an AF_MSM_IPC socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-04T18:00:00.000Z
CVE-2016-5871 
In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an image file.
Problem types: description: Integer Overflow to Buffer Overflow in UEFI
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2016-5872 
In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validated.
Problem types: description: Improper Input Validation in TrustZone
Affected products: vendor: Qualcomm, Inc.
product: All Qualcomm products
Published: 2017-08-18T18:00:00.000Z
CVE-2016-5873 
Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-5874 
Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-22T15:00:00.000Z
CVE-2016-5876 
ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-5878 
Open redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-08T01:00:00.000Z
CVE-2016-5879 
MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availability command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T14:00:00.000Z
CVE-2016-5880 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Domino
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5881 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: iNotes
Published: 2017-02-01T22:00:00.000Z
CVE-2016-5882 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Domino
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5883 
IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997010.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: iNotes
Published: 2017-02-23T16:00:00.000Z
CVE-2016-5884 
IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: IBM Domino 8.5.3.5, 8.5.3.6, 9.0.1, 8.5, 9.0, 8.5.1, 8.5.2, 8.5.3, 9.0.1.1, 8.0.2, 8.0, 8.0.1, 8.5.1.5, 8.5.2.4, 9.0.1.2, 8.5.0.1, 9.0.1.3, 8.5.1.4, 9.0.1.4, 9.0.1.5, 8.5.1.1, 9.0.1.6, 9.0.1.7
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5888 
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 115084.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Interact
Published: 2017-05-10T14:00:00.000Z
CVE-2016-5889 
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 115085.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Interact
Published: 2017-05-10T14:00:00.000Z
CVE-2016-5890 
IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote authenticated users to change arbitrary passwords via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-11-30T11:00:00.000Z
CVE-2016-5892 
Cross-site scripting (XSS) vulnerability in IBM 10x, as used in Multi-Enterprise Integration Gateway 1.x through 1.0.0.1 and B2B Advanced Communications before 1.0.0.5_2, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z
CVE-2016-5893 
IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2017-06-23T16:00:00.000Z
CVE-2016-5894 
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: WebSphere Commerce Enterprise
Published: 2017-03-08T19:00:00.000Z
CVE-2016-5896 
IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Maximo Asset Management
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5897 
IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5898 
IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a direct request, an attacker could exploit this vulnerability to obtain sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5899 
IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Jazz Reporting Service
Published: 2017-02-01T20:00:00.000Z
CVE-2016-5900 
IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the TLS certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tealeaf Customer Experience
Published: 2017-02-08T22:00:00.000Z
CVE-2016-5901 
Cross-site scripting (XSS) vulnerability in a test page in IBM Business Process Manager Advanced 8.5.6.0 through 8.5.7.0 before cumulative fix 2016.09 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-05T10:00:00.000Z