rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-8360 
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.
Problem types: description: Moxa SoftCMS double free
Affected products: vendor: n/a
product: Moxa SoftCMS prior to Version 1.6
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8361 
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an attacker into the system without authentication.
Problem types: description: Lynxspring JENEsys BAS Bridge no password
Affected products: vendor: n/a
product: Lynxspring JENEsys BAS Bridge 1.1.8 and older
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8362 
An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. Any user is able to download log files by accessing a specific URL.
Problem types: description: Moxa OnCell Security forceful browsing
Affected products: vendor: n/a
product: Moxa OnCell
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8363 
An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. User is able to execute arbitrary OS commands on the server.
Problem types: description: Moxa OnCell execute arbitrary OS commands
Affected products: vendor: n/a
product: Moxa OnCell
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8364 
An issue was discovered in IBHsoftec S7-SoftPLC prior to 4.12b. Object memory can read a network packet that is larger than the space that is available, a Heap-based Buffer Overflow.
Problem types: description: IBHsoftec S7-SoftPLC CPX43 Heap-based Buffer Overflow Vulnerability
Affected products: vendor: n/a
product: IBHsoftec S7-SoftPLC CPX43 prior to 4.12b
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8365 
OSIsoft PI System software (Applications using PI Asset Framework (AF) Client versions prior to PI AF Client 2016, Version 2.8.0; Applications using PI Software Development Kit (SDK) versions prior to PI SDK 2016, Version 1.4.6; PI Buffer Subsystem, versions prior to and including, Version 4.4; and PI Data Archive versions prior to PI Data Archive 2015, Version 3.4.395.64) operates between endpoints without a complete model of endpoint features potentially causing the product to perform actions based on this incomplete model, which could result in a denial of service. OSIsoft reports that in order to exploit the vulnerability an attacker would need to be locally connected to a server. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H)
Problem types: cwe_id: CWE-437
description: Incomplete model of enpoint features CWE-437
Affected products: vendor: OSIsoft
product: PI System software
Published: 2018-04-03T14:00:00.000Z
CVE-2016-8366 
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. The password macro can be configured in a way that the password is stored and transferred in clear text.
Problem types: cwe_id: CWE-312
description: CWE-312: Cleartext Storage of Sensitive Information
Affected products: vendor: Phoenix Contact
product: Phoenix Contact ILC PLCs
Published: 2018-04-05T16:00:00.000Z
CVE-2016-8367 
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.
Problem types: description: Schneider Electric Magelis HMI Resource Consumption
Affected products: vendor: n/a
product: Schneider Electric Magelis HMI
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8368 
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. The affected Ethernet interface module is connected to a MELSEC-Q PLC, which may allow a remote attacker to connect to the PLC via Port 5002/TCP and cause a denial of service, requiring the PLC to be reset to resume operation. This is caused by an Unrestricted Externally Accessible Lock.
Problem types: description: Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module Unrestricted Externally Accessible Lock
Affected products: vendor: n/a
product: Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8369 
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application does not sufficiently verify if a request was intentionally provided by the user who submitted the request (CROSS-SITE REQUEST FORGERY).
Problem types: description: Lynxspring JENEsys BAS Bridge csrf
Affected products: vendor: n/a
product: Lynxspring JENEsys BAS Bridge 1.1.8 and older
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8370 
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. Weakly encrypted passwords are transmitted to a MELSEC-Q PLC.
Problem types: description: Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module weak encryption
Affected products: vendor: n/a
product: Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8371 
The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.
Problem types: cwe_id: CWE-592
description: CWE-592: Authentication Bypass Issues
Affected products: vendor: Phoenix Contact
product: Phoenix Contact ILC PLCs
Published: 2018-04-05T16:00:00.000Z
CVE-2016-8372 
An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. A password is transmitted in a format that is not sufficiently secure.
Problem types: description: Moxa ioLogik E1200 Series password
Affected products: vendor: n/a
product: Moxa ioLogik E1200 Series before 3.12
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8374 
An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION.
Problem types: description: Schneider Electric Magelis HMI Resource Consumption
Affected products: vendor: n/a
product: Schneider Electric Magelis HMI
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8375 
An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC unit. An unauthorized user with physical access to an affected Alaris PC unit may be able to obtain unencrypted wireless network authentication credentials and other sensitive technical data by disassembling the PC unit and accessing the device's flash memory. The Alaris 8015 PC unit, Version 9.7, and the 8000 PC unit store wireless network authentication credentials and other sensitive technical data on internal flash memory. Accessing the internal flash memory of the affected device would require special tools to extract data and carrying out this attack at a healthcare facility would increase the likelihood of detection.
Problem types: description: BD Alaris 8000/8015 Insufficiently Protected Credentials Vulnerabilities
Affected products: vendor: n/a
product: BD Alaris 8015 through 9.7 and 8000
Published: 2017-02-13T22:00:00.000Z
CVE-2016-8376 
An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. This non-validated redirect/non-validated forward (OPEN REDIRECT) allows chaining with authenticated vulnerabilities.
Problem types: description: Kabona AB WDC open redirect
Affected products: vendor: n/a
product: Kabona AB WDC Vulnerabilities prior to Version 3.4.0
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8377 
An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vulnerability exists when the software application connects to a malicious server, resulting in a stack buffer overflow. This causes an exploitable Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.
Problem types: description: Fatek Automation PLC WinProladder Stack-Based Buffer Overflow Vulnerability
Affected products: vendor: n/a
product: Fatek Automation PLC WinProladder 3.11 Build 14701
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8378 
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards for protecting credentials.
Problem types: description: Lynxspring JENEsys BAS Bridge lacks sufficient safeguards
Affected products: vendor: n/a
product: Lynxspring JENEsys BAS Bridge 1.1.8 and older
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8379 
An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. Users are restricted to using short passwords.
Problem types: description: Moxa ioLogik E1200 Series password
Affected products: vendor: n/a
product: Moxa ioLogik E1200 Series before 3.12
Published: 2017-02-13T21:00:00.000Z
CVE-2016-8380 
The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.
Problem types: cwe_id: CWE-767
description: CWE-767: Access to Critical Private Variable via Public Method
Affected products: vendor: Phoenix Contact
product: Phoenix Contact ILC PLCs
Published: 2018-04-05T16:00:00.000Z
CVE-2016-8382 
An exploitable heap corruption vulnerability exists in the Doc_SetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send a malicious doc file to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Antenna House
product: AntennaHouse
Published: 2018-04-24T19:00:00.000Z
CVE-2016-8383 
An exploitable heap corruption vulnerability exists in the Doc_GetFontTable functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious doc file to trigger this vulnerability.
Problem types: description: arbitrary code execution
Affected products: vendor: Antenna House
product: AntennaHouse
Published: 2018-04-24T19:00:00.000Z
CVE-2016-8384 
An exploitable heap corruption vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter.
Problem types: description: heap overflow
Affected products: vendor: Antenna House
product: AntennaHouse
Published: 2018-04-24T19:00:00.000Z
CVE-2016-8385 
An exploitable uninitialized variable vulnerability which leads to a stack-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF to XML a stack variable will be left uninitialized which will later be used to fetch a length that is used in a copy operation. In most cases this will allow an aggressor to write outside the bounds of a stack buffer which is used to contain colors. This can lead to code execution under the context of the account running the tool.
Problem types: description: PDF Code Execution
Affected products: vendor: Iceni
product: Argus
Published: 2017-02-27T21:00:00.000Z
CVE-2016-8386 
An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to use a size out of the font to search through a linked list of buffers to return. Due to a signedness issue, a buffer smaller than the requested size will be returned. Later when the tool tries to populate this buffer, the overflow will occur which can lead to code execution under the context of the user running the tool.
Problem types: description: PDF Code Execution
Affected products: vendor: Iceni
product: Argus
Published: 2017-02-27T21:00:00.000Z
CVE-2016-8387 
An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types terminating with an LZW encoded type, an overflow may occur due to a lack of bounds checking by the LZW decoder. This can lead to code execution under the context of the account of the user running it.
Problem types: description: Buffer Overflow
Affected products: vendor: Iceni
product: Argus
Published: 2017-02-27T21:00:00.000Z
CVE-2016-8388 
An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will explicitly trust an index within the specific font object and use it to write the font's name to a single object within an array of objects.
Problem types: description: Heap Overwrite
Affected products: vendor: Iceni
product: Argus
Published: 2017-02-28T15:00:00.000Z
CVE-2016-8389 
An exploitable integer-overflow vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will attempt to convert each character from a font into a polygon and then attempt to rasterize these shapes. As the application attempts to iterate through the rows and initializing the polygon shape in the buffer, it will write outside of the bounds of said buffer. This can lead to code execution under the context of the account running it.
Problem types: description: Integer Overflow
Affected products: vendor: Iceni
product: Argus
Published: 2017-02-28T15:00:00.000Z
CVE-2016-8390 
An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with specific section headers to trigger this vulnerability.
Problem types: description: remote code execution
Affected products: vendor: Talos
product: Hopper
Published: 2018-06-04T19:00:00.000Z
CVE-2016-8391 
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31253255. References: QC-CR#1072166.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8392 
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31385862. References: QC-CR#1073136.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8393 
An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31911920.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8394 
An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31913197.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8395 
A denial of service vulnerability in the NVIDIA camera driver could enable an attacker to cause a local permanent denial of service, which may require reflashing the operating system to repair the device. This issue is rated as High due to the possibility of local permanent denial of service. Product: Android. Versions: Kernel-3.10. Android ID: A-31403040. References: N-CVE-2016-8395.
Problem types: description: Denial of service
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8396 
An information disclosure vulnerability in the MediaTek video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-31249105.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8397 
An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-31385953. References: N-CVE-2016-8397.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8398 
Unauthenticated messages processed by the UE. Certain NAS messages are processed when no EPS security context exists in the UE. Product: Android. Versions: Kernel 3.18. Android ID: A-31548486. References: QC-CR#877705.
Problem types: description: Unauthenticated Messages
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T20:00:00.000Z
CVE-2016-8399 
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
Problem types: description: Elevation of privilege
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8400 
An information disclosure vulnerability in the NVIDIA librm library (libnvrm) could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: Kernel-3.18. Android ID: A-31251599. References: N-CVE-2016-8400.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8401 
An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31494725.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8402 
An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31495231.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8403 
An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31495348.
Problem types: description: Information disclosure
Affected products: vendor: Google Inc.
product: Android
Published: 2017-01-12T15:00:00.000Z
CVE-2016-8404 
An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB driver and networking subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31496950.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android Kernel-3.10
Published: 2017-01-12T15:00:00.000Z