rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-9854 
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9855 
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9856 
An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9857 
An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9858 
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9859 
An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9860 
An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9861 
An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9862 
An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9863 
An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9864 
An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9865 
An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9866 
An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-11T02:00:00.000Z
CVE-2016-9867 
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and may achieve code execution to escalate privileges to root on ScaleIO Data Client (SDC) servers.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: n/a
product: EMC ScaleIO versions before 2.0.1.1
Published: 2017-01-06T22:00:00.000Z
CVE-2016-9868 
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may cause a denial-of-service by generating a kernel panic in the SCINI driver using IOCTL calls which may render the ScaleIO Data Client (SDC) server unavailable until the next reboot.
Problem types: description: Denial-of-service vulnerability via IOCTL calls
Affected products: vendor: n/a
product: EMC ScaleIO versions before 2.0.1.1
Published: 2017-01-06T22:00:00.000Z
CVE-2016-9869 
An issue was discovered in EMC ScaleIO versions before 2.0.1.1. Incorrect permissions on the SCINI driver may allow a low-privileged local attacker to modify the configuration and render the ScaleIO Data Client (SDC) server unavailable.
Problem types: description: Denial-of-service through configuration API
Affected products: vendor: n/a
product: EMC ScaleIO versions before 2.0.1.1
Published: 2017-01-06T22:00:00.000Z
CVE-2016-9870 
EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is affected by an LDAP injection vulnerability that could potentially be exploited by a malicious user to compromise the system.
Problem types: description: LDAP Injection
Affected products: vendor: n/a
product: EMC Isilon OneFS
Published: 2017-01-23T06:49:00.000Z
CVE-2016-9871 
EMC Isilon OneFS 7.2.1.0 - 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x is affected by a privilege escalation vulnerability that could potentially be exploited by attackers to compromise the affected system.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: EMC Isilon OneFS EMC Isilon OneFS 7.2.1.0 7.2.1.3, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, EMC Isilon OneFS 7.1.0.x
Published: 2017-02-03T07:24:00.000Z
CVE-2016-9872 
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.
Problem types: description: Reflected Cross-Site Scripting
Affected products: vendor: n/a
product: EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
Published: 2017-02-03T07:24:00.000Z
CVE-2016-9873 
EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information, modify data or disrupt services by causing execution of arbitrary DQL commands on the application.
Problem types: description: DQL Injection Vulnerability
Affected products: vendor: n/a
product: EMC Documentum D2 EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6
Published: 2017-02-03T07:24:00.000Z
CVE-2016-9877 
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.
Problem types: description: RabbitMQ authentication vulnerability
Affected products: vendor: n/a
product: Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
Published: 2016-12-29T09:02:00.000Z
CVE-2016-9878 
An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Problem types: description: Directory Traversal
Affected products: vendor: n/a
product: Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5
Published: 2016-12-29T09:02:00.000Z
CVE-2016-9879 
An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
Problem types: description: Encoded "/" in path variables
Affected products: vendor: n/a
product: Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1
Published: 2017-01-06T22:00:00.000Z
CVE-2016-9880 
The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker.
Problem types: description: Unauthenticated access
Affected products: vendor: Dell EMC
product: GemFire broker for Cloud Foundry
Published: 2018-03-16T20:00:00.000Z
CVE-2016-9882 
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. These logs are written to disk and often sent to a log aggregator via syslog.
Problem types: description: Logs Service Credentials
Affected products: vendor: n/a
product: Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0
Published: 2017-01-13T09:00:00.000Z
CVE-2016-9885 
An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by operators and application developers to connect to their cluster, is unauthenticated and publicly accessible. Because HTTPS communications are terminated at the gorouter, communications from the gorouter to GemFire clusters are unencrypted. An attacker could run any command available on gfsh and could cause denial of service, lost confidentiality of data, escalate privileges, or eavesdrop on other communications between the gorouter and the cluster.
Problem types: description: gfsh exposed over go router for GemFire for PCF
Affected products: vendor: n/a
product: GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1
Published: 2017-01-06T22:00:00.000Z
CVE-2016-9888 
An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-08T08:08:00.000Z
CVE-2016-9889 
Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T05:00:00.000Z
CVE-2016-9891 
Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-29T18:00:00.000Z
CVE-2016-9892 
The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses to license activation requests via a self-signed certificate.  NOTE: this issue can be combined with CVE-2016-0718 to execute arbitrary code remotely as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-02T23:00:00.000Z
CVE-2016-9893 
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Memory safety bugs fixed in Thunderbird 45.6
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9894 
A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.1.
Problem types: description: Buffer overflow in SkiaGL
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9895 
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: CSP bypass using marquee tag
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9896 
Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default. This vulnerability affects Firefox < 50.1.
Problem types: description: Use-after-free with WebVR
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9897 
Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Memory corruption in libGLES
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9898 
Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Use-after-free in Editor while manipulating DOM subtrees
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9899 
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Use-after-free while manipulating DOM events and audio elements
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9900 
External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Restricted external resources can be loaded by SVG images through data URLs
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9901 
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
Problem types: description: Data from Pocket server improperly sanitized before execution
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9902 
The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events. This allows content from other origins to fire events and inject content and commands into the Pocket context. Note: this issue does not affect users with e10s enabled. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
Problem types: description: Pocket extension does not validate the origin of events
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9903 
Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox < 50.1.
Problem types: description: XSS injection vulnerability in add-ons SDK
Affected products: vendor: Mozilla
product: Firefox
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9904 
An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts. This could be used to leak information, such as usernames embedded in JavaScript code, across websites. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Problem types: description: Cross-origin information leak in shared atoms
Affected products: vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9905 
A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6.
Problem types: description: Crash in EnumerateSubDocuments
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Thunderbird
Published: 2018-06-11T21:00:00.000Z
CVE-2016-9907 
Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-9908 
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-9909 
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-22T16:00:00.000Z
CVE-2016-9910 
The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-22T16:00:00.000Z
CVE-2016-9911 
Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z
CVE-2016-9912 
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-12-23T22:00:00.000Z