rainbutterfly/cve_corpus huggingface dataset:
CVE-2016-6099 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-02T22:00:00.000Z
CVE-2016-6100 
IBM Disposal and Governance Management for IT and IBM Global Retention Policy and Schedule Management, components of IBM Atlas Policy Suite 6.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Reference #: 2000771.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Atlas Policy Suite
Published: 2017-04-05T18:00:00.000Z
CVE-2016-6102 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM Reference #: 2000359.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-03-27T22:00:00.000Z
CVE-2016-6103 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-02T22:00:00.000Z
CVE-2016-6104 
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-07T16:00:00.000Z
CVE-2016-6105 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 do not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas.
Problem types: description: Bypass Security
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-01T21:00:00.000Z
CVE-2016-6110 
IBM Tivoli Storage Manager discloses unencrypted login credentials to Vmware vCenter that could be obtained by a local user.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Tivoli Storage Manager
Published: 2017-02-01T22:00:00.000Z
CVE-2016-6111 
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Cram Social Program Management
Published: 2017-03-31T18:00:00.000Z
CVE-2016-6112 
IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Marketing Platform
Published: 2017-05-22T20:00:00.000Z
CVE-2016-6113 
IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Domino
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6114 
IBM Emptoris Sourcing 9.5.x through 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118352.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Sourcing
Published: 2017-07-12T17:00:00.000Z
CVE-2016-6115 
IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: Spectrum Scale
Published: 2017-02-01T22:00:00.000Z
CVE-2016-6116 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-02T22:00:00.000Z
CVE-2016-6117 
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 can be deployed with active debugging code that can disclose sensitive information.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Key Lifecycle Manager
Published: 2017-02-01T21:00:00.000Z
CVE-2016-6118 
IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118356.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Supplier Lifecycle Management
Published: 2017-07-24T21:00:00.000Z
CVE-2016-6121 
IBM Emptoris Supplier Lifecycle Management 10.0.x and 10.1.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 118383.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Emptoris Supplier Lifecycle Management
Published: 2017-08-09T18:00:00.000Z
CVE-2016-6122 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 discloses answers to security questions in a response to authenticated users.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6123 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6124 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to upload arbitrary files, which could allow the attacker to execute arbitrary code on the vulnerable server.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6125 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6126 
IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Kenexa LMS on Cloud
Published: 2017-02-01T20:00:00.000Z
CVE-2016-6127 
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified content type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-03T16:00:00.000Z
CVE-2016-6128 
The gdImageCropThreshold function in gd_crop.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 7.0.9, allows remote attackers to cause a denial of service (application crash) via an invalid color index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-07T10:00:00.000Z
CVE-2016-6129 
The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-13T18:00:00.000Z
CVE-2016-6130 
Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-03T21:00:00.000Z
CVE-2016-6131 
The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of remembered mangled types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T15:00:00.000Z
CVE-2016-6132 
The gdImageCreateFromTgaCtx function in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-12T15:00:00.000Z
CVE-2016-6133 
Cross-site scripting (XSS) vulnerability in Ektron Content Management System before 9.1.0.184SP3(9.1.0.184.3.127) allows remote attackers to inject arbitrary web script or HTML via the rptStatus parameter in a Report action to WorkArea/SelectUserGroup.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-07-25T20:00:00.000Z
CVE-2016-6136 
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-06T20:00:00.000Z
CVE-2016-6137 
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-27T15:00:00.000Z
CVE-2016-6138 
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6139 
SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6140 
SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203591.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6142 
SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SYSLOG via vectors related to the SQL protocol, aka SAP Security Note 2197459.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T16:00:00.000Z
CVE-2016-6143 
SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs, aka SAP Security Note 2170806.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-13T14:00:00.000Z
CVE-2016-6144 
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6145 
The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the username exists and is locked when the detailed_error_on_connect option is not supported or is configured as "False," which allows remote attackers to enumerate database users via a series of login attempts, aka SAP Security Note 2216869.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6146 
The NameServer in SAP TREX 7.10 Revision 63 allows remote attackers to obtain sensitive TNS information via an unspecified query, aka SAP Security Note 2234226.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-27T15:00:00.000Z
CVE-2016-6147 
An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via unspecified vectors, aka SAP Security Note 2234226.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6148 
SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement, aka SAP Security Note 2233136.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6149 
SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files, aka SAP Security Note 2252941.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6150 
The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-05T14:00:00.000Z
CVE-2016-6151 
CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-26T01:00:00.000Z
CVE-2016-6152 
CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-26T01:00:00.000Z
CVE-2016-6153 
os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T00:00:00.000Z
CVE-2016-6154 
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-23T21:06:51.000Z
CVE-2016-6156 
Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a "double fetch" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-06T20:00:00.000Z
CVE-2016-6158 
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allow remote attackers to hijack the authentication of administrators for requests that (1) restore factory settings or (2) reboot the device via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-6159 
The management interface of Huawei WS331a routers with software before WS331a-10 V100R001C01B112 allows remote attackers to bypass authentication and obtain administrative access by sending "special packages" to the LAN interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-21T14:00:00.000Z
CVE-2016-6160 
tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related issue to CVE-2017-14266.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-6161 
The output function in gd_gif_out.c in the GD Graphics Library (aka libgd) allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-12T15:00:00.000Z
CVE-2016-6162 
net/core/skbuff.c in the Linux kernel 4.7-rc6 allows local users to cause a denial of service (panic) or possibly have unspecified other impact via certain IPv6 socket operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-06T20:00:00.000Z
CVE-2016-6163 
The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-03T15:00:00.000Z
CVE-2016-6164 
Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers to have unspecified impact via vectors involving sample size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-23T21:00:00.000Z
CVE-2016-6167 
Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) UxTheme.dll or (2) ntmarta.dll file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-30T22:00:00.000Z
CVE-2016-6168 
Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (application crash) and execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T17:00:00.000Z
CVE-2016-6169 
Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (memory corruption and application crash) or potentially execute arbitrary code via the Bezier data in a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-07T17:00:00.000Z
CVE-2016-6170 
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-06T14:00:00.000Z
CVE-2016-6171 
Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone transfer for (1) DDNS, (2) AXFR, or (3) IXFR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T15:00:00.000Z
CVE-2016-6172 
PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (memory exhaustion and secondary DNS server crash) via a large (1) AXFR or (2) IXFR response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-09-26T16:00:00.000Z
CVE-2016-6173 
NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone transfer with unlimited data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-09T15:00:00.000Z
CVE-2016-6174 
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-07-12T19:00:00.000Z
CVE-2016-6175 
Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-07T15:00:00.000Z
CVE-2016-6177 
The Huawei OceanStor 5800 V300R003C00 has an integer overflow vulnerability. An authenticated attacker may send massive abnormal Network File System (NFS) packets, causing an anomaly in specific disk arrays.
Problem types: description: Integer Overflow
Affected products: vendor: n/a
product: OceanStor 5800 V3 V300R003C00
Published: 2017-04-02T20:00:00.000Z
CVE-2016-6178 
Huawei NE40E and CX600 devices with software before V800R007SPH017; PTN 6900-2-M8 devices with software before V800R007SPH019; NE5000E devices with software before V800R006SPH018; and CloudEngine devices 12800 with software before V100R003SPH010 and V100R005 before V100R005SPH006 allow remote attackers with control plane access to cause a denial of service or execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-08-02T16:00:00.000Z