yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-0978: Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0979: Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0980, and CVE-2016-0981.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0980: Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0981.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0981: Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0980.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0982: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0983, and CVE-2016-0984.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0983: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0984.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0984: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0985: Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
Key phrases: execute arbitrary code, execute arbitrary code by leveraging an unspecified ", type confusion
CVE-2016-0986: Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0987: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0988: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0989: Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0990: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0991: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0992: Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1002, and CVE-2016-1005.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-0993: Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, integer overflow
CVE-2016-0994: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code by using the actionCallMethod opcode, use-after-free
CVE-2016-0995: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0996: Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via crafted arguments, use-after-free
CVE-2016-0997: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0998: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-0999: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-1000: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-1000000: Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection
Key phrases: suniqueid parameter blind sql injection
CVE-2016-1000001: flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect
Key phrases: open redirect
CVE-2016-1000002: gdm3 3.14.2 and possibly later has an information leak before screen lock
Key phrases: information leak
CVE-2016-1000003: Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
Key phrases: remote code execution
CVE-2016-1000004: Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
Key phrases: insufficient type checks
CVE-2016-1000005: mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
Key phrases: type confusion
CVE-2016-1000006: hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.
Key phrases: use-after-free, use after free
CVE-2016-1000007: Pagure 2.2.1 XSS in raw file endpoint
Key phrases: xss
CVE-2016-1000009: TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.
CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
Key phrases: remote code execution (rce) issue, products behavior, deserialization of untrusted data
CVE-2016-1000028: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).
Key phrases: xss issue, other admins
CVE-2016-1000029: Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).
Key phrases: xss issue
CVE-2016-1000030: Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
Key phrases: certificates imports, code execution
CVE-2016-1000031: Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
Key phrases: diskfileitem, file manipulation, remote code execution
CVE-2016-1000032: TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.
Key phrases: use a single solved CAPTCHA multiple times, replay, missing nonce
CVE-2016-1000033: Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.
Key phrases: tls ssl certification validation flaw, man in the middle
CVE-2016-1000037: Pagure: XSS possible in file attachment endpoint
Key phrases: xss
CVE-2016-1000104: A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
Key phrases: security Bypass, security bypass
CVE-2016-1000107: inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Key phrases: redirect an application's outbound HTTP traffic to
CVE-2016-1000108: yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Key phrases: redirect a CGI application's outbound HTTP traffic
CVE-2016-1000109: HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).
Key phrases: redirect a CGI application's outbound HTTP traffic, untrusted client data
CVE-2016-1000110: The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
Key phrases: redirect HTTP requests, http_proxy variable name clash
CVE-2016-1000111: Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Key phrases: redirect a CGI application's outbound HTTP traffic
CVE-2016-1000112: Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
Key phrases: unauthenticated remote, file upload
CVE-2016-1000113: XSS and SQLi in huge IT gallery v1.1.5 for Joomla
Key phrases: xss, sqli
CVE-2016-1000114: XSS in huge IT gallery v1.1.5 for Joomla
Key phrases: xss
CVE-2016-1000115: Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
Key phrases: sql injection, xss
CVE-2016-1000116: Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
Key phrases: sql injection, xss
CVE-2016-1000117: XSS & SQLi in HugeIT slideshow v1.0.4
Key phrases: xss, sqli
CVE-2016-1000118: XSS & SQLi in HugeIT slideshow v1.0.4
Key phrases: xss, sqli
CVE-2016-1000119: SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
Key phrases: sqli, xss
CVE-2016-1000120: SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
Key phrases: sqli, xss
CVE-2016-1000121: XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
Key phrases: xss, sqli
CVE-2016-1000122: XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
Key phrases: xss, sqli
CVE-2016-1000123: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
Key phrases: sql injection
CVE-2016-1000124: Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
Key phrases: sql injection
CVE-2016-1000125: Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
Key phrases: sql injection
CVE-2016-1000126: Reflected XSS in wordpress plugin admin-font-editor v1.8
Key phrases: reflected xss
CVE-2016-1000127: Reflected XSS in wordpress plugin ajax-random-post v2.00
Key phrases: reflected xss
CVE-2016-1000128: Reflected XSS in wordpress plugin anti-plagiarism v3.60
Key phrases: reflected xss
CVE-2016-1000129: Reflected XSS in wordpress plugin defa-online-image-protector v3.3
Key phrases: reflected xss
CVE-2016-1000130: Reflected XSS in wordpress plugin e-search v1.0
Key phrases: reflected xss
CVE-2016-1000131: Reflected XSS in wordpress plugin e-search v1.0
Key phrases: reflected xss
CVE-2016-1000132: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
Key phrases: reflected xss
CVE-2016-1000133: Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
Key phrases: reflected xss
CVE-2016-1000134: Reflected XSS in wordpress plugin hdw-tube v1.2
Key phrases: reflected xss
CVE-2016-1000135: Reflected XSS in wordpress plugin hdw-tube v1.2
Key phrases: reflected xss
CVE-2016-1000136: Reflected XSS in wordpress plugin heat-trackr v1.0
Key phrases: reflected xss
CVE-2016-1000137: Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
Key phrases: reflected xss
CVE-2016-1000138: Reflected XSS in wordpress plugin indexisto v1.0.5
Key phrases: reflected xss
CVE-2016-1000139: Reflected XSS in wordpress plugin infusionsoft v1.5.11
Key phrases: reflected xss
CVE-2016-1000140: Reflected XSS in wordpress plugin new-year-firework v1.1.9
Key phrases: reflected xss
CVE-2016-1000141: Reflected XSS in wordpress plugin page-layout-builder v1.9.3
Key phrases: reflected xss
CVE-2016-1000142: Reflected XSS in wordpress plugin parsi-font v4.2.5
Key phrases: reflected xss
CVE-2016-1000143: Reflected XSS in wordpress plugin photoxhibit v2.1.8
Key phrases: reflected xss
CVE-2016-1000144: Reflected XSS in wordpress plugin photoxhibit v2.1.8
Key phrases: reflected xss
CVE-2016-1000145: Reflected XSS in wordpress plugin pondol-carousel v1.0
Key phrases: reflected xss
CVE-2016-1000146: Reflected XSS in wordpress plugin pondol-formmail v1.1
Key phrases: reflected xss
CVE-2016-1000147: Reflected XSS in wordpress plugin recipes-writer v1.0.4
Key phrases: reflected xss
CVE-2016-1000148: Reflected XSS in wordpress plugin s3-video v0.983
Key phrases: reflected xss
CVE-2016-1000149: Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
Key phrases: reflected xss
CVE-2016-1000150: Reflected XSS in wordpress plugin simplified-content v1.0.0
Key phrases: reflected xss
CVE-2016-1000151: Reflected XSS in wordpress plugin tera-charts v1.0
Key phrases: reflected xss
CVE-2016-1000152: Reflected XSS in wordpress plugin tidio-form v1.0
Key phrases: reflected xss
CVE-2016-1000153: Reflected XSS in wordpress plugin tidio-gallery v1.1
Key phrases: reflected xss
CVE-2016-1000154: Reflected XSS in wordpress plugin whizz v1.0.7
Key phrases: reflected xss
CVE-2016-1000155: Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
Key phrases: reflected xss
CVE-2016-1000156: Mailcwp remote file upload vulnerability incomplete fix v1.100
Key phrases: mailcwp remote file upload
CVE-2016-10002: Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
Key phrases: leaked, attack requests, data leak
CVE-2016-1000213: Ruckus Wireless H500 web management interface CSRF
Key phrases: csrf
CVE-2016-1000214: Ruckus Wireless H500 web management interface authentication bypass
Key phrases: authentication bypass, web management interface authentication bypass
CVE-2016-1000215: Ruckus Wireless H500 web management interface denial of service
Key phrases: web management interface, denial of service
CVE-2016-1000216: Ruckus Wireless H500 web management interface authenticated command injection
Key phrases: authenticated command injection
CVE-2016-1000217: Zotpress plugin for WordPress SQLi in zp_get_account()
Key phrases: sqli
CVE-2016-1000218: Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page.
Key phrases: generate superfluous reports whenever an authenticated Kibana user, csrf
CVE-2016-1000219: Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
Key phrases: hijack sessions
CVE-2016-1000220: Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
Key phrases: execute arbitrary JavaScript, execute arbitrary JavaScript in users' browsers, xss
CVE-2016-1000221: Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
Key phrases: sensitive information
CVE-2016-1000222: Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.
Key phrases: engineered input
CVE-2016-1000229: swagger-ui has XSS in key names
Key phrases: xss
CVE-2016-1000232: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
Key phrases: regular expression parsing, denial of service
CVE-2016-1000236: Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
Key phrases: timing attack
CVE-2016-1000237: sanitize-html before 1.4.3 has XSS.
Key phrases: xss
CVE-2016-1000271: Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.
Key phrases: sql injection, exploitable
CVE-2016-1000282: Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Key phrases: command injection
CVE-2016-10003: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.
CVE-2016-1000307: Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to ProfileSettings page; (2) note parameter to PersonalNotes Section; (3) closed_msg, description, allowed_types parameters to WebsiteConfigurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via (, cross site scripting (xss)
CVE-2016-1000338: In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Key phrases: the introduction of 'invisible' data into, extra elements, invisible data
CVE-2016-1000339: In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
Key phrases: leak, leak information
CVE-2016-1000340: In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Key phrases: carry propagation bug
CVE-2016-1000341: In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Key phrases: gain information, gain information about the signature's k value, timing attack
CVE-2016-1000342: In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
Key phrases: the introduction of 'invisible' data into, extra elements, invisible data
CVE-2016-1000343: In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Key phrases: weak private key
CVE-2016-1000344: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Key phrases: unsafe
CVE-2016-1000345: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Key phrases: padding oracle
CVE-2016-1000346: In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
Key phrases: invalid keys
CVE-2016-1000352: In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Key phrases: unsafe
CVE-2016-10005: Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd requests, aka SAP Security Note 2344524.
Key phrases: obtain sensitive information, obtain sensitive information via webdynpro/dispatcher/
CVE-2016-10006: In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Key phrases: bypass the library protections, xss
CVE-2016-10007: SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy, sql injection
CVE-2016-10008: SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the _EXT_STRUCTURE_direction, sql injection
CVE-2016-10009: Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
Key phrases: execute arbitrary local PKCS#11 modules by leveraging control, untrusted search path
CVE-2016-1001: Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, heap-based buffer overflow, heap based buffer overflow
CVE-2016-10010: sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.
Key phrases: gain privileges, gain privileges via unspecified vectors, unix-domain sockets
CVE-2016-10011: authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
Key phrases: obtain sensitive private-key information, obtain sensitive private-key information by leveraging
CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.
Key phrases: gain privileges, gain privileges by leveraging access to a sandboxed
CVE-2016-10013: Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.
Key phrases: gain privileges, gain privileges by leveraging mishandling of SYSCALL singlestep, syscall singlestep
CVE-2016-1002: Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1005.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10024: Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.
Key phrases: denial of service (host hang or crash), cause a denial of service (host hang
CVE-2016-10025: VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.
Key phrases: denial of service (hypervisor crash), cause a denial of service (hypervisor crash, null pointer check
CVE-2016-10026: ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.
Key phrases: revert certain changes by leveraging permissions to change
CVE-2016-10027: Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.
Key phrases: bypass TLS protections, bypass TLS protections and trigger use of cleartext, race condition, man in the middle
CVE-2016-10028: The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
Key phrases: denial of service (out-of-bounds read and process crash), cause a denial of service (out-, out of bounds read
CVE-2016-10029: The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.
Key phrases: denial of service (out-of-bounds read and process crash), cause a denial of service (out-, out of bounds read
CVE-2016-10030: The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.
Key phrases: assume control of an arbitrary file on the
CVE-2016-10031: WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts, the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer.
Key phrases: execute arbitrary code, execute arbitrary code with elevated privileges on the, weak file permissions
CVE-2016-10033: The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\" (backslash double quote) in a crafted Sender property.
Key phrases: execute arbitrary code, pass extra parameters to the mail command and
CVE-2016-10034: The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\" (backslash double quote) in a crafted e-mail address.
Key phrases: execute arbitrary code, pass extra parameters to the mail command and
CVE-2016-10036: Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.
Key phrases: execute arbitrary code, (1) deploy an arbitrary servlet application, unrestricted file upload, denial of service, arbitrary file
CVE-2016-10037: Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter, related to browser/directory/getlist.
Key phrases: perform local file inclusion/traversal/manipulation, directory traversal
CVE-2016-10038: Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.
Key phrases: perform local file inclusion/traversal/manipulation, directory traversal
CVE-2016-10039: Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.
Key phrases: perform local file inclusion/traversal/manipulation, directory traversal
CVE-2016-10040: Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.
Key phrases: denial of service (application crash), cause a denial of service (application crash, stack-based buffer overflow, stack based buffer overflow
CVE-2016-10041: An issue was discovered in Sprecher Automation SPRECON-E Service Program before 3.43 SP0. Under certain preconditions, it is possible to execute telegram simulation as a non-admin user. As prerequisites, a user must have created an online-connection, validly authenticated and authorized as administrator, and executed telegram simulation. After that, the online-connection must have been closed. Incorrect caching of client data then may lead to privilege escalation, where a subsequently acting non-admin user is permitted to do telegram simulation. In order to exploit this vulnerability, a potential attacker would need to have both a valid engineering-account in the SPRECON RBAC system as well as access to a service/maintenance computer with SPRECON-E Service Program running. Additionally, a valid admin-user must have closed the service connection beforehand without closing the program, having executed telegram simulation; the attacker then has access to the running software instance. Hence, there is no risk from external attackers.
Key phrases: privilege escalation
CVE-2016-10042: Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request, leading to denial of service and information disclosure.
Key phrases: Bypass in the Web interface of Arcadyan SLT-00 Star, Authorization Bypass, denial of service and information disclosure, authorization bypass
CVE-2016-10043: An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application's responses. Attackers could execute unauthorized commands, which could then be used to disable the software, or read, write, and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner (apache user).
Key phrases: inject arbitrary OS commands, os command injection, arbitrary os command, execute commands
CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
Key phrases: bypass intended SELinux W^X policy, gain privileges, execute access
CVE-2016-10045: The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
Key phrases: execute arbitrary code, pass extra parameters to the mail command and
CVE-2016-10046: Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
Key phrases: denial of service (application crash), cause a denial of service (application crash, heap-based buffer overflow, heap based buffer overflow