rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-6838 
Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, CH140 V3 and CH226 V3 servers with software before V100R001C00SPC122, CH220 V3 servers with software before V100R001C00SPC201, and CH121 V3 and CH222 V3 servers with software before V100R001C00SPC202 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSH encryption algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6839 
CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6840 
Cross-site scripting (XSS) vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 allows remote attackers to inject arbitrary web script or HTML via the loginName parameter to cgi-bin/doLogin_CgiEntry and possibly other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T14:00:00.000Z
CVE-2016-6842 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6843 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code can be injected to contact names. When adding those contacts to a group, the script code gets executed in the context of the user which creates or changes the group by using autocomplete. In most cases this is a user with elevated permissions. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6844 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6845 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when using base64 encoded "data" resources. This allows an attacker to provide hyperlinks that may execute script code instead of directing to a proper location. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6846 
Cross-site scripting (XSS) vulnerability in Open-Xchange (OX) AppSuite backend before 7.6.2-rev59, 7.8.0 before 7.8.0-rev38, 7.8.2 before 7.8.2-rev8; AppSuite frontend before 7.6.2-rev47, 7.8.0 before 7.8.0-rev30, and 7.8.2 before 7.8.2-rev8; Office Web before 7.6.2-rev16, 7.8.0 before 7.8.0-rev10, and 7.8.2 before 7.8.2-rev5; and Documentconverter-API before 7.8.2-rev5 allows remote attackers to inject arbitrary web script or HTML.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T14:00:00.000Z
CVE-2016-6847 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6848 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6850 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6851 
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6852 
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give hints about whether the provided file exists or not. Attackers may discover specific system files or library versions on the middleware server to prepare further attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6853 
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites, users might get lured into a phishing scheme. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6854 
An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-15T06:31:00.000Z
CVE-2016-6855 
Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cause a denial of service (out-of-bounds write and crash) via vectors involving passing invalid UTF-8 to GMarkup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T18:00:00.000Z
CVE-2016-6856 
Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-31T06:56:00.000Z
CVE-2016-6857 
Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13, 5.3.x before 5.3.0.11, 5.4.x before 5.4.0.11, 5.5.0.x before 5.5.0.10, 5.5.1.x before 5.5.1.11, 5.6.x before 5.6.0.11, and 5.7.x before 5.7.0.15 allows remote authenticated users to inject arbitrary web script or HTML via the ID field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-31T06:56:00.000Z
CVE-2016-6858 
Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5.1.1.12, 5.2.0.x and 5.3.0.x before 5.3.0.10, 5.4.x before 5.4.0.9, 5.5.0.x before 5.5.0.9, 5.5.1.x before 5.5.1.10, 5.6.x before 5.6.0.8, and 5.7.x before 5.7.0.9 allows remote authenticated users to inject arbitrary web script or HTML via the Name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-31T06:56:00.000Z
CVE-2016-6859 
Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-31T06:56:00.000Z
CVE-2016-6866 
slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-15T19:00:00.000Z
CVE-2016-6870 
Out-of-bounds write in the (1) mb_detect_encoding, (2) mb_send_mail, and (3) mb_detect_order functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6871 
Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6872 
Integer overflow in StringUtil::implode in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6873 
Self recursion in compact in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6874 
The array_*_recursive functions in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors, related to recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6875 
Infinite recursion in wddx in Facebook HHVM before 3.15.0 allows attackers to have unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-17T17:00:00.000Z
CVE-2016-6876 
The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3; BIG-IP AAM, AFM, and PEM 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3; BIG-IP Analytics 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1, and 12.0.0 before HF3; BIG-IP DNS 12.0.0 before HF3; BIG-IP Edge Gateway, WebAccelerator, and WOM 10.2.1 through 10.2.4 and 11.2.1; BIG-IP GTM 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, and 11.6.x before 11.6.1; and BIG-IP PSM 10.2.1 through 10.2.4 and 11.4.0 through 11.4.1 allows remote DNS servers to cause a denial of service (CPU consumption or Traffic Management Microkernel crash) via a crafted PTR response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6877 
Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page.  NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-05-05T20:00:00.000Z
CVE-2016-6878 
The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2016-6879 
The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-10T15:00:00.000Z
CVE-2016-6881 
The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T05:00:00.000Z
CVE-2016-6882 
MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-6883 
MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-6884 
TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-03T16:00:00.000Z
CVE-2016-6885 
The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-6886 
The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modulus for the secret key during RSA key exchange.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-6887 
The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via a CRT attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T16:00:00.000Z
CVE-2016-6888 
Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-10T00:00:00.000Z
CVE-2016-6890 
Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T22:00:00.000Z
CVE-2016-6891 
MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T22:00:00.000Z
CVE-2016-6892 
The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-05T22:00:00.000Z
CVE-2016-6893 
Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-02T14:00:00.000Z
CVE-2016-6894 
Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a denial of service (device reboot) by sending crafted packets to the control plane.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-04T21:00:00.000Z
CVE-2016-6896 
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T21:00:00.000Z
CVE-2016-6897 
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-18T21:00:00.000Z
CVE-2016-6898 
XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service (web service outage) via a crafted XML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6899 
The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, and XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSL encryption algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6900 
The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers with software before V100R003C00SPC617; RH2288H V3 servers with software before V100R003C00SPC515; RH5885 V3 servers with software before V100R003C10SPC102; and XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610 allows local users to cause a denial of service (iBMC resource consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-07T19:00:00.000Z
CVE-2016-6901 
Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers with software before V200R007C00SPC900 allows remote authenticated users to cause a denial of service via format string specifiers in vectors involving partial commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T16:00:00.000Z
CVE-2016-6902 
lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T19:00:00.000Z
CVE-2016-6903 
lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T19:00:00.000Z
CVE-2016-6904 
Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials.
Problem types: description: Plain text authentication
Affected products: vendor: NetApp
product: VASA Provider for Clustered Data ONTAP
Published: 2017-12-11T15:00:00.000Z
CVE-2016-6905 
The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-10-03T21:00:00.000Z
CVE-2016-6906 
The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file, related to the decompression buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-15T14:00:00.000Z