rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-7943 
The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7944 
Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7945 
Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7946 
X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7947 
Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7948 
X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7949 
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7950 
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7951 
Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7952 
X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7953 
Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-13T20:00:00.000Z
CVE-2016-7954 
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-22T22:00:00.000Z
CVE-2016-7955 
The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T16:00:00.000Z
CVE-2016-7957 
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T10:00:00.000Z
CVE-2016-7958 
In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-12T10:00:00.000Z
CVE-2016-7959 
Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T10:00:00.000Z
CVE-2016-7960 
Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-13T10:00:00.000Z
CVE-2016-7964 
The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7965 
DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7966 
Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-7967 
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-7968 
KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-7969 
The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-7970 
Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-7972 
The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-7973 
The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7974 
The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7975 
The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7976 
The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2016-7977 
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-23T03:56:00.000Z
CVE-2016-7978 
Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-23T03:56:00.000Z
CVE-2016-7979 
Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-23T03:56:00.000Z
CVE-2016-7980 
Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request.  NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7981 
Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7982 
Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7983 
The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7984 
The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7985 
The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7986 
The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7987 
An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.
Problem types: description: Siemens SICAM RTU Devices Denial-of-Service Vulnerability
Affected products: vendor: n/a
product: Siemens SICAM RTU Devices before 08
Published: 2017-02-13T21:00:00.000Z
CVE-2016-7988 
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of SVE-2016-6542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7989 
On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message sent remotely triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class within wifi-service.jar. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed, a subset of SVE-2016-6542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7990 
On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages (within WAP Push SMS messages) leading to a heap corruption that can result in Denial of Service and potentially remote code execution, a subset of SVE-2016-6542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7991 
On Samsung Galaxy S4 through S7 devices, the "omacp" app ignores security information embedded in the OMACP messages resulting in remote unsolicited WAP Push SMS messages being accepted, parsed, and handled by the device, leading to unauthorized configuration changes, a subset of SVE-2016-6542.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-31T10:00:00.000Z
CVE-2016-7992 
The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7993 
A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-28T01:33:00.000Z
CVE-2016-7994 
Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-10T00:00:00.000Z
CVE-2016-7995 
Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-10T00:00:00.000Z
CVE-2016-7996 
Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7997 
The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7998 
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-7999 
ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T17:00:00.000Z
CVE-2016-8005 
File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
Problem types: description: File extension filtering vulnerability
Affected products: vendor: Intel
product: McAfee Email Gateway (MEG)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8006 
Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Information and Event Management (SIEM) 9.6.0 MR3 allows an administrator to make changes to other SIEM users' information including user passwords without supplying the current administrator password a second time via the GUI or GUI terminal commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T22:00:00.000Z
CVE-2016-8007 
Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: Intel
product: Host Intrusion Prevention Services (HIPS)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8008 
Privilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus (SSP) 3.11.376 allows attackers to load a replacement of the version.dll file via McAfee McUICnt.exe onto a Windows system.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: Intel
product: Security Scan Plus (SSP)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8009 
Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: Intel
product: McAfee Application Control (MAC)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8010 
Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
Problem types: description: Application protections bypass vulnerability
Affected products: vendor: Intel
product: McAfee Application Control (MAC)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8011 
Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site.
Problem types: description: Cross-site scripting vulnerability
Affected products: vendor: Intel
product: McAfee Endpoint Security (ENS) Web Control
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8012 
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
Problem types: description: Access control vulnerability
Affected products: vendor: Intel
product: Data Loss Prevention Endpoint (DLPe)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8016 
Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
Problem types: description: Information exposure
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8017 
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
Problem types: description: Special element injection vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8018 
Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.
Problem types: description: Cross-site request forgery (CSRF) vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8019 
Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
Problem types: description: Cross-site scripting (XSS) vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8020 
Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.
Problem types: description: Improper control of generation of code vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8021 
Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.
Problem types: description: Improper verification of cryptographic signature vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8022 
Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.
Problem types: description: Authentication bypass by spoofing vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z
CVE-2016-8023 
Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie.
Problem types: description: Authentication bypass by assumed-immutable data vulnerability
Affected products: vendor: Intel
product: VirusScan Enterprise Linux (VSEL)
Published: 2017-03-14T22:00:00.000Z