yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-4766: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4767, and CVE-2016-4768.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2016-4767: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4768.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2016-4768: WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4767.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2016-4769: WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Key phrases: execute arbitrary code, denial of service (memory corruption and application crash), execute arbitrary code or cause a denial of
CVE-2016-4771: The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directory pathname.
Key phrases: bypass intended file-access restrictions, bypass intended file-access restrictions via a
CVE-2016-4772: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to cause a denial of service (unintended lock) via unspecified vectors.
Key phrases: denial of service (unintended lock), cause a denial of service (unintended lock, unspecified vectors
CVE-2016-4773: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4774 and CVE-2016-4776.
Key phrases: denial of service (out-of-bounds read), obtain sensitive memory-layout information, obtain sensitive memory-layout information or cause, out of bounds read
CVE-2016-4774: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4776.
Key phrases: denial of service (out-of-bounds read), obtain sensitive memory-layout information, obtain sensitive memory-layout information or cause, out of bounds read
CVE-2016-4775: The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
Key phrases: denial of service (memory corruption), gain privileges, gain privileges or cause a denial of service, unspecified vectors
CVE-2016-4776: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app, a different vulnerability than CVE-2016-4773 and CVE-2016-4774.
Key phrases: denial of service (out-of-bounds read), obtain sensitive memory-layout information, obtain sensitive memory-layout information or cause, out of bounds read
CVE-2016-4777: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.
Key phrases: execute arbitrary code, denial of service (invalid pointer dereference), execute arbitrary code in a privileged context or
CVE-2016-4778: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code in a privileged context or
CVE-2016-4779: Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of
CVE-2016-4780: An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "Thunderbolt" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
Key phrases: execute arbitrary code, denial of service (NULL pointer dereference), execute arbitrary code in a privileged context or, null pointer dereference
CVE-2016-4781: An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "SpringBoard" component, which allows physically proximate attackers to bypass the passcode attempt counter and unlock a device via unspecified vectors.
Key phrases: bypass the passcode attempt counter and unlock a device, unspecified vectors
CVE-2016-4782: Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."
Key phrases: have unspecified impact via a crafted intent:, intent scheme url
CVE-2016-4783: Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98_ww on Android before 4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), universal xss (uxss)
CVE-2016-4784: A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 : All versions < V 4.83; SIPROTEC 7UT686 : All versions < V 4.01; SIPROTEC 7SD686 : All versions < V 4.03; SIPROTEC 7SJ66 : All versions < V 4.20. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain sensitive device information if network access was obtained.
Key phrases: obtain sensitive device information, obtain sensitive device information if network access was
CVE-2016-4785: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices.
Key phrases: obtain a limited amount of device memory content, firmware variant profinet io
CVE-2016-4786: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Key phrases: denial of service (CPU consumption), cause a denial of service (CPU consumption, unspecified vectors
CVE-2016-4787: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authentication files in an unspecified directory via unknown vectors.
Key phrases: read sensitive system authentication files in an unspecified, unknown vectors
CVE-2016-4788: Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system file via unknown vectors.
Key phrases: read an unspecified system file via unknown vectors
CVE-2016-4789: Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4790: Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4791: The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors.
Key phrases: read arbitrary files, enumerate files, server side request forgery (ssrf), unspecified vectors, file read
CVE-2016-4792: Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors.
Key phrases: disclose sign in pages via unspecified vectors
CVE-2016-4793: The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
Key phrases: spoof their IP via the CLIENT-IP, spoofing
CVE-2016-4794: Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
Key phrases: denial of service (BUG), cause a denial of service (BUG), use-after-free, unspecified other impact, unspecified impact
CVE-2016-4796: Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file.
Key phrases: denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, heap based buffer overflow
CVE-2016-4797: Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.
Key phrases: denial of service (application crash), cause a denial of service (application crash, divide-by-zero
CVE-2016-4800: The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Key phrases: bypass protected resource restrictions, bypass protected resource restrictions and other security constraints
CVE-2016-4802: Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory.
Key phrases: execute arbitrary code, execute arbitrary code and conduct DLL hijacking attacks, untrusted search path, dll hijacking
CVE-2016-4803: CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
Key phrases: inject arbitrary email headers, inject arbitrary email headers via CRLF sequences in, crlf injection
CVE-2016-4804: The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap-based buffer overflow in the (1) read_fat function or an out-of-bounds heap read in (2) get_fat function.
Key phrases: denial of service (crash), cause a denial of service (crash), heap-based buffer overflow, out-of-bounds heap read, heap based buffer overflow, out of bounds heap read
CVE-2016-4805: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions.
Key phrases: denial of service (memory corruption and system crash, or spinlock), cause a denial of service (memory corruption, use-after-free, unspecified other impact, unspecified impact
CVE-2016-4806: Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.
Key phrases: read/access web server sensitive files, local file inclusion
CVE-2016-4807: Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).
Key phrases: perform an XSS attack on logged in user, reflected xss
CVE-2016-4808: Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.
Key phrases: trick a logged in user to perform some, csrf (cross site request forgery), unwanted actions
CVE-2016-4809: The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
Key phrases: denial of service (application crash), cause a denial of service (application crash, large symlink
CVE-2016-4810: Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Policy rules on the XenDesktop Delivery Controller via unspecified vectors.
Key phrases: set Access Policy rules on the XenDesktop Delivery, unspecified vectors
CVE-2016-4811: The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attackers to obtain API access via unspecified vectors.
Key phrases: obtain API access, obtain API access via unspecified vectors, api access, man in the middle
CVE-2016-4812: Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4813: NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.
Key phrases: gain privileges, gain privileges by creating a SYSTEM_ADMIN account
CVE-2016-4814: Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows remote attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2016-4815: Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2016-4816: BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.
Key phrases: discover credentials and other sensitive information via unspecified, unspecified vectors
CVE-2016-4817: lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.
Key phrases: execute arbitrary code, denial of service (use-after-free and application crash), cause a denial of service (use-, use after free
CVE-2016-4818: DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verify SSL certificates.
Key phrases: ssl certificates
CVE-2016-4819: The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Library for Visual C++ 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted string
CVE-2016-4820: Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users.
Key phrases: hijack the authentication of arbitrary users, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4821: I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors.
Key phrases: denial of service (web-server crash), cause a denial of service (web-, unspecified vectors
CVE-2016-4822: Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.
Key phrases: execute arbitrary commands, execute arbitrary commands via unspecified vectors
CVE-2016-4823: Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.
Key phrases: denial of service (reboot), cause a denial of service (reboot), unspecified vectors
CVE-2016-4824: The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authentication attempts, which makes it easier for remote attackers to obtain network access via a brute-force attack.
Key phrases: obtain network access, brute-force
CVE-2016-4825: The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.
Key phrases: execute arbitrary PHP code, conduct PHP object injection attacks and execute arbitrary, php object injection
CVE-2016-4826: Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4827.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2016-4827: Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-4826.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2016-4828: The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.
Key phrases: obtain access, obtain access by leveraging knowledge of the e, sessions
CVE-2016-4829: DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
Key phrases: ssl certificates
CVE-2016-4830: Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
CVE-2016-4831: Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2016-4832: WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
CVE-2016-4833: Cross-site scripting (XSS) vulnerability in the Nofollow Links plugin before 1.0.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4834: modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors.
Key phrases: create or modify user accounts via unspecified vectors
CVE-2016-4837: SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2016-4838: The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION allows an attacker to execute unintended operations via a specially crafted application.
Key phrases: execute unintended operations via a specially crafted application
CVE-2016-4839: The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Forward for SHIZUOKA BANK (prior to v1.4.0), Money Forward for SBI Sumishin Net Bank (prior to v1.6.0), Money Forward for Tokai Tokyo Securities (prior to v1.4.0), Money Forward for THE TOHO BANK (prior to v1.3.0), Money Forward for YMFG (prior to v1.5.0) provided by Money Forward, Inc. and Money Forward for AppPass (prior to v7.18.3), Money Forward for au SMARTPASS (prior to v7.18.0), Money Forward for Chou Houdai (prior to v7.18.3) provided by SOURCENEXT CORPORATION do not properly implement the WebView class, which allows an attacker to disclose information stored on the device via a specially crafted application.
Key phrases: disclose information stored on the device via a
CVE-2016-4840: Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
CVE-2016-4841: Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers.
Key phrases: inject arbitrary email headers
CVE-2016-4842: Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read.
Key phrases: obtain information, obtain information on when an email is read, cybozu mailwise
CVE-2016-4843: Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information.
Key phrases: obtain sensitive cookie information
CVE-2016-4844: Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks.
Key phrases: conduct clickjacking attacks, cybozu mailwise
CVE-2016-4845: Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.
Key phrases: hijack the authentication of arbitrary users for requests, cross-site request forgery (csrf), delete content, cross site request forgery
CVE-2016-4846: Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
Key phrases: untrusted search path
CVE-2016-4847: Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML by leveraging, cross-site scripting (xss)
CVE-2016-4848: Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4849: Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COM_getCurrentURL function in (1) public_html/layout/default/header.thtml, (2) public_html/layout/bento/header.thtml, (3) public_html/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML by leveraging, cross-site scripting (xss)
CVE-2016-4850: LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code.
Key phrases: execute arbitrary code, line, man in the middle
CVE-2016-4851: Cross-site scripting (XSS) vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4852: YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers to cause a denial of service (application crash) via a crafted emoji character sequence.
Key phrases: denial of service (application crash), cause a denial of service (application crash
CVE-2016-4853: AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via crafted saved data, arbitrary os command
CVE-2016-4854: Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors.
Key phrases: perform arbitrary operations, hijack the authentication of administrators to perform arbitrary, cross-site request forgery (csrf), unspecified vectors, cross site request forgery
CVE-2016-4855: Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4856: Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4857: Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splunk Light prior to 6.4.2 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Key phrases: redirect users to arbitrary web sites and conduct, open redirect, phishing, unspecified vectors
CVE-2016-4858: Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4859: Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Key phrases: redirect users to arbitrary web sites and conduct, open redirect, unspecified vectors
CVE-2016-4860: Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command.
Key phrases: reconfigure the device or cause a denial of, denial of service
CVE-2016-4861: The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Key phrases: conduct SQL injection attacks by leveraging failure to, sql injection
CVE-2016-4862: Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitrary PHP code on the servers.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code on the servers, arbitrary php code
CVE-2016-4863: The Toshiba FlashAir SD-WD/WC series Class 6 model with firmware version 1.00.04 and later, FlashAir SD-WD/WC series Class 10 model W-02 with firmware version 2.00.02 and later, FlashAir SD-WE series Class 10 model W-03, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir II Class 10 model W-02 series with firmware version 2.00.02 and later, FlashAir III Class 10 model W-03 series, FlashAir Class 6 model with firmware version 1.00.04 and later, FlashAir W-02 series Class 10 model with firmware version 2.00.02 and later, FlashAir W-03 series Class 10 model does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled, which allows attackers with access to STA side LAN can obtain files or data.
Key phrases: obtain files or data, STA side LAN can obtain files or data, internet pass-thru mode
CVE-2016-4864: H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
Key phrases: cause a denial-of-service (, denial-of-service (dos), format string specifiers, denial of service
CVE-2016-4865: Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Customapp function.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2016-4866: Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows attackers with administrator rights to inject arbitrary web script or HTML via the Project function.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2016-4867: Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restriction to view unauthorized project information via the Project function.
Key phrases: bypass access restriction, bypass access restriction to view unauthorized project information
CVE-2016-4868: Email header injection vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote attackers to inject arbitrary email headers to send unintended emails via specially crafted requests.
Key phrases: inject arbitrary email headers, inject arbitrary email headers to send unintended emails, email header injection
CVE-2016-4869: Cybozu Office 9.0.0 to 10.4.0 allow remote attackers to obtain session information via a page where CGI environment variables are displayed.
Key phrases: obtain session information, obtain session information via a page where CGI, cgi environment variables
CVE-2016-4870: Cross-site scripting vulnerability in Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the Schedule function.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting
CVE-2016-4871: Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to cause a denial of service.
Key phrases: cause a denial of service
CVE-2016-4872: Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to bypass access restrictions to view the names of unauthorized projects via a breadcrumb trail.
Key phrases: bypass access restrictions, bypass access restrictions to view the names of, breadcrumb trail
CVE-2016-4873: Cybozu Office 9.0.0 to 10.4.0 allows remote authenticated attackers to execute unintended operations via the Project function.
Key phrases: execute unintended operations via the Project function, project function
CVE-2016-4874: Cybozu Office 9.0.0 through 10.4.0 allows remote attackers to conduct a "reflected file download" attack.
Key phrases: conduct a "reflected file download" attack
CVE-2016-4875: Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4876: Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators to execute arbitrary PHP code via unspecified vectors.
Key phrases: execute arbitrary PHP code, hijack the authentication of administrators to execute arbitrary, cross-site request forgery (csrf), unspecified vectors, cross site request forgery
CVE-2016-4877: Cross-site scripting vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4878: Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4879: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4880: Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4881: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4882: Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4883: Cross-site scripting vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4884: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4885: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Feed version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4886: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4887: Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Uploader version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Key phrases: hijack the authentication of administrators via unspecified vectors, cross-site request forgery (csrf), cross site request forgery
CVE-2016-4888: Cross-site scripting (XSS) vulnerability in ZOHO ManageEngine ServiceDesk Plus before 9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-4889: ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to have unspecified impact by leveraging failure to restrict access to unknown functions.
Key phrases: have unspecified impact by leveraging failure to restrict, failure to restrict access to unknown functions
CVE-2016-4890: ZOHO ManageEngine ServiceDesk Plus before 9.2 uses an insecure method for generating cookies, which makes it easier for attackers to obtain sensitive password information by leveraging access to a cookie.
Key phrases: obtain sensitive password, insecure method
CVE-2016-4891: Cross-site request forgery (CSRF) vulnerability in SetsucoCMS all versions allows remote attackers to hijack the authentication of an administrator to change settings via unspecified vectors.
Key phrases: hijack the authentication of an administrator to change, cross-site request forgery (csrf), unspecified vectors, cross site request forgery
CVE-2016-4892: Cross-site scripting vulnerability in SetsucoCMS all versions allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4893: SQL injection vulnerability in the SetsucoCMS all versions allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2016-4894: SetsucoCMS all versions allows remote attackers to cause a denial of service via unspecified vectors.
Key phrases: cause a denial of service via unspecified vectors
CVE-2016-4895: SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.
Key phrases: conduct code injection attacks via unspecified vectors
CVE-2016-4896: SetsucoCMS all versions does not properly manage sessions, which allows remote attackers to disclose or alter unauthorized information via unspecified vectors.
Key phrases: disclose or alter unauthorized information via unspecified vectors, sessions
CVE-2016-4897: Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.
Key phrases: cross-site scripting (xss)
CVE-2016-4898: The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
Key phrases: remote command execution, unspecified attack vectors
CVE-2016-4899: The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
Key phrases: remote command execution, unspecified attack vectors
CVE-2016-4900: Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2016-4901: Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2016-4902: Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
Key phrases: gain privileges, gain privileges via a Trojan horse DLL in, untrusted search path, unspecified
CVE-2016-4903: Cross-site scripting vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting, unspecified vectors
CVE-2016-4904: Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to hijack the authentication of a user to perform unintended operations via unspecified vectors.
Key phrases: hijack the authentication of a user to perform, cross-site request forgery (csrf), unintended operations, unspecified vectors, cross site request forgery
CVE-2016-4905: SQL injection vulnerability in the WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows attackers with administrator rights to execute arbitrary SQL commands via unspecified vectors.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2016-4906: Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cybozu Garoon Keitai.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via ", cross-site scripting
CVE-2016-4907: Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
Key phrases: obtain CSRF tokens via unspecified vectors., csrf tokens
CVE-2016-4908: Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to alter or delete another, unspecified vectors
CVE-2016-4909: Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to force a logout via unspecified vectors.
Key phrases: hijack the authentication of a logged in user, cross-site request forgery (csrf), unspecified vectors, cross site request forgery
CVE-2016-4910: Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters via unspecified vectors.
Key phrases: bypass access restriction, bypass access restriction to delete other operational administrators, unspecified vectors
CVE-2016-4911: The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Key phrases: bypass intended access restrictions, prevent revocation of a chain of tokens and
CVE-2016-4912: The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a large number of crafted packets, which triggers a memory allocation failure.
Key phrases: denial of service (NULL pointer dereference and crash), cause a denial of service (NULL pointer, null pointer dereference, memory allocation failure