yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-7933: The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppp_hdlc_if_print().
Key phrases: buffer overflow
CVE-2016-7934: The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print().
Key phrases: buffer overflow
CVE-2016-7935: The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print().
Key phrases: buffer overflow
CVE-2016-7936: The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print().
Key phrases: buffer overflow
CVE-2016-7937: The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print().
Key phrases: buffer overflow
CVE-2016-7938: The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame().
Key phrases: integer overflow
CVE-2016-7939: The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions.
Key phrases: buffer overflow
CVE-2016-7940: The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions.
Key phrases: buffer overflow
CVE-2016-7942: The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations.
Key phrases: gain privileges, gain privileges via vectors involving image type and, out-of-bounds read operations, out of bounds read
CVE-2016-7943: The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations.
Key phrases: gain privileges, gain privileges via vectors involving length fields, out-of-bounds write operations, out of bounds write
CVE-2016-7944: Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync.
Key phrases: gain privileges, gain privileges via a length value of INT_MAX, integer overflow, out of sync
CVE-2016-7945: Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields.
Key phrases: denial of service (out-of-bounds memory access or infinite loop), cause a denial of service (out-, multiple integer overflows, out of bounds memory
CVE-2016-7946: X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2016-7947: Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response.
Key phrases: trigger out-of-bounds write operations, multiple integer overflows, out of bounds write
CVE-2016-7948: X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data.
Key phrases: trigger out-of-bounds write operations, mishandling of reply data, out of bounds write
CVE-2016-7949: Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields.
Key phrases: trigger out-of-bounds write operations, buffer overflows, out of bounds write
CVE-2016-7950: The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
Key phrases: trigger out-of-bounds write operations, out of bounds write
CVE-2016-7951: Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks.
Key phrases: trigger out-of-bounds memory access, multiple integer overflows, out-of-bounds memory access operations, out of bounds memory
CVE-2016-7952: X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data.
Key phrases: denial of service (infinite loop), cause a denial of service (infinite loop
CVE-2016-7953: Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
Key phrases: have unspecified impact via an empty string, buffer underflow
CVE-2016-7954: Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.
Key phrases: inject arbitrary Ruby code, inject arbitrary Ruby code into an application by, gem name collision
CVE-2016-7955: The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information, modify the application, or execute arbitrary code as root via an "AV Report Scheduler" HTTP User-Agent header.
Key phrases: execute arbitrary code, bypass authentication, obtain sensitive information, bypass authentication and consequently obtain sensitive information
CVE-2016-7957: In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.
Key phrases: packet injection, malformed capture file, crash
CVE-2016-7958: In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.
Key phrases: packet injection, malformed capture file, crash
CVE-2016-7959: Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack.
Key phrases: obtain sensitive information, pre-shared key data, brute-force
CVE-2016-7960: Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors.
Key phrases: obtain sensitive configuration information, improper format, unspecified vectors
CVE-2016-7964: The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to restrict access to private networks. This allows users to scan ports of internal networks via SSRF, such as 10.0.0.1/8, 172.16.0.0/12, and 192.168.0.0/16.
Key phrases: scan ports of internal networks via SSRF, ssrf
CVE-2016-7965: DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can change the URL's hostname via the HTTP Host header.) The vulnerability can be triggered only if the Host header is not part of the web server routing process (e.g., if several domains are served by the same web server).
Key phrases: phishing
CVE-2016-7966: Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign (=) or a space into the injected HTML, which greatly reduces the available HTML functionality. Although it is possible to include an HTML comment indicator to hide content.
Key phrases: malicious url
CVE-2016-7967: KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. Since the generated html is executed in the local file security context by default access to remote and local URLs was enabled.
CVE-2016-7968: KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed.
Key phrases: included code
CVE-2016-7969: The wrap_lines_smart function in ass_render.c in libass before 0.13.4 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to "0/3 line wrapping equalization."
Key phrases: denial of service (out-of-bounds read), cause a denial of service (out-, unspecified vectors, out of bounds read
CVE-2016-7970: Buffer overflow in the calc_coeff function in libass/ass_blur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.
Key phrases: cause a denial of service via unspecified vectors, buffer overflow
CVE-2016-7972: The check_allocations function in libass/ass_shaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.
Key phrases: denial of service (memory allocation failure), cause a denial of service (memory allocation, unspecified vectors
CVE-2016-7973: The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions.
Key phrases: buffer overflow
CVE-2016-7974: The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions.
Key phrases: buffer overflow
CVE-2016-7975: The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print().
Key phrases: buffer overflow
CVE-2016-7976: The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.
Key phrases: execute arbitrary code, execute arbitrary code via crafted userparams
CVE-2016-7977: Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document.
Key phrases: read arbitrary files, bypass the SAFER mode protection, bypass the SAFER mode protection mechanism and consequently
CVE-2016-7978: Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice.
Key phrases: execute arbitrary code, execute arbitrary code via vectors related to a, use-after-free, reference leak
CVE-2016-7979: Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.
Key phrases: execute arbitrary code, bypass the SAFER mode protection, bypass the SAFER mode protection mechanism and consequently, type confusion
CVE-2016-7980: Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider_xml request.  NOTE: this issue can be combined with CVE-2016-7998 to execute arbitrary PHP code.
Key phrases: execute arbitrary PHP code, hijack the authentication of administrators for requests that, cross-site request forgery (csrf), arbitrary php code, cross site request forgery
CVE-2016-7981: Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the var_url parameter in a valider_xml action.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2016-7982: Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the var_url parameter in a valider_xml action.
Key phrases: enumerate the files on the system via the, directory traversal
CVE-2016-7983: The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print().
Key phrases: buffer overflow
CVE-2016-7984: The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print().
Key phrases: buffer overflow
CVE-2016-7985: The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().
Key phrases: buffer overflow
CVE-2016-7986: The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.
Key phrases: buffer overflow
CVE-2016-7987: An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.
Key phrases: denial-of-service
CVE-2016-7988: On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of SVE-2016-6542.
CVE-2016-7989: On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message sent remotely triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class within wifi-service.jar. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed, a subset of SVE-2016-6542.
Key phrases: omacp message, crash
CVE-2016-7990: On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages (within WAP Push SMS messages) leading to a heap corruption that can result in Denial of Service and potentially remote code execution, a subset of SVE-2016-6542.
Key phrases: integer overflow condition, heap corruption, denial of service, remote code execution
CVE-2016-7991: On Samsung Galaxy S4 through S7 devices, the "omacp" app ignores security information embedded in the OMACP messages resulting in remote unsolicited WAP Push SMS messages being accepted, parsed, and handled by the device, leading to unauthorized configuration changes, a subset of SVE-2016-6542.
Key phrases: unauthorized configuration changes
CVE-2016-7992: The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().
Key phrases: buffer overflow
CVE-2016-7993: A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).
Key phrases: buffer overflow
CVE-2016-7994: Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2016-7995: Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.
Key phrases: denial of service (memory consumption), cause a denial of service (memory consumption, memory leak
CVE-2016-7996: Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.
Key phrases: have unspecified impact via a colormap with a, heap-based buffer overflow, heap based buffer overflow
CVE-2016-7997: The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors related to a ReferenceBlob and a NULL pointer.
Key phrases: denial of service (assertion failure and crash), cause a denial of service (assertion failure, referenceblob, null pointer
CVE-2016-7998: The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted (1) INCLUDE or (2) INCLURE tag and then accessing it with a valider_xml action.
Key phrases: execute arbitrary PHP code, execute arbitrary PHP code by uploading an HTML
CVE-2016-7999: ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url parameter in a valider_xml action.
Key phrases: conduct server side request forgery (SSRF)
CVE-2016-8005: File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
Key phrases: fail to identify the file name properly via, file extension filtering
CVE-2016-8006: Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Information and Event Management (SIEM) 9.6.0 MR3 allows an administrator to make changes to other SIEM users' information including user passwords without supplying the current administrator password a second time via the GUI or GUI terminal commands.
Key phrases: Authentication bypass, make changes to other SIEM users' information, authentication bypass
CVE-2016-8007: Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions.
Key phrases: Authentication bypass, manipulate the product's registry keys via specific, authentication bypass
CVE-2016-8008: Privilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus (SSP) 3.11.376 allows attackers to load a replacement of the version.dll file via McAfee McUICnt.exe onto a Windows system.
Key phrases: load a replacement of the version.dll file via, privilege escalation
CVE-2016-8009: Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call.
Key phrases: cause DoS, privilege escalation, dos, unexpected behavior, unauthorized code execution
CVE-2016-8010: Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
Key phrases: bypass local security protection, Application protections bypass, bypass local security protection via a command-, application protections bypass
CVE-2016-8011: Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting
CVE-2016-8012: Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
Key phrases: inject hook DLLs into other processes via pages, access control
CVE-2016-8016: Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
Key phrases: obtain the existence of unauthorized files on the system, information exposure
CVE-2016-8017: Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
Key phrases: read files on the webserver via a crafted, special element injection
CVE-2016-8018: Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.
Key phrases: execute unauthorized commands via a crafted user input, cross-site request forgery (csrf), cross site request forgery
CVE-2016-8019: Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via a, cross-site scripting (xss)
CVE-2016-8020: Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted HTTP request, generation of code
CVE-2016-8021: Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.
Key phrases: execute arbitrary code, spoof update server and execute arbitrary code via, improper verification of cryptographic signature, spoofing
CVE-2016-8022: Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.
Key phrases: execute arbitrary code, bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux, Authentication bypass, execute arbitrary code or cause a denial of, authentication bypass, denial of service
CVE-2016-8023: Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie.
Key phrases: bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux, bypass server authentication, Authentication bypass, bypass server authentication via a crafted authentication cookie, authentication bypass
CVE-2016-8024: Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.
Key phrases: obtain sensitive information, obtain sensitive information via the server HTTP response, improper neutralization of crlf sequences in http headers, server http response spoofing
CVE-2016-8025: SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
Key phrases: obtain product information, obtain product information via a crafted HTTP request, sql injection
CVE-2016-8026: Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.
Key phrases: gain elevated privileges, gain elevated privileges via unspecified vectors, arbitrary command execution, arbitrary commands
CVE-2016-8027: SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
Key phrases: alter a SQL query, sql injection, disclosure of information
CVE-2016-8030: A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
Key phrases: create a Denial of Service on the active, memory corruption, denial of service
CVE-2016-8031: Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local security protection via a crafted input file.
Key phrases: bypass local security protection, bypass local security protection via a crafted input, software integrity
CVE-2016-8032: Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection via a crafted input file.
Key phrases: bypass local security protection, bypass local security protection via a crafted input, software integrity
CVE-2016-8100: Intel Integrated Performance Primitives (aka IPP) Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack.
Key phrases: side-channel
CVE-2016-8101: The updater subsystem in Intel SSD Toolbox before 3.3.7 allows local users to gain privileges via unspecified vectors.
Key phrases: gain privileges, gain privileges via unspecified vectors
CVE-2016-8102: Unquoted service path vulnerability in Intel Wireless Bluetooth Drivers 16.x, 17.x, and before 18.1.1607.3129 allows local users to launch processes with elevated privileges.
Key phrases: launch processes with elevated privileges, unquoted service path, elevate privileges
CVE-2016-8103: SMM call out in all Intel Branded NUC Kits allows a local privileged user to access the System Management Mode and take full control of the platform.
Key phrases: access the System Management Mode and take full, smm call out, full control
CVE-2016-8104: Buffer overflow in Intel PROSet/Wireless Software and Drivers in versions before 19.20.3 allows a local user to crash iframewrk.exe causing a potential denial of service.
Key phrases: crash iframewrk.exe causing a potential denial of service, buffer overflow
CVE-2016-8105: Drivers for the Intel Ethernet Controller X710 and Intel Ethernet Controller XL710 families before version 22.0 are vulnerable to a denial of service in certain layer 2 network configurations.
Key phrases: denial of service
CVE-2016-8106: A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker to stop the controller from processing network traffic working under certain network use conditions.
Key phrases: stop the controller from processing network traffic working, denial of service, non-volatile memory images
CVE-2016-8201: A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a logged-in user into making administrative changes on the traffic manager cluster.
Key phrases: trick a logged-in user into making, csrf, administrative changes
CVE-2016-8202: A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected versions, non-root users can gain root access with a combination of shell commands and parameters.
Key phrases: gain root access, elevate the privileges of user accounts accessing the, privilege escalation, combination of shell commands and parameters, elevate privileges
CVE-2016-8203: A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00, and 6.0.00a images could allow attackers to cause a denial of service (line card reset) via certain constructed IPsec control packets.
Key phrases: denial of service (line card reset), cause a denial of service (line card, memory corruption, constructed ipsec control packets
CVE-2016-8204: A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.
Key phrases: upload a malicious file in a section of, directory traversal
CVE-2016-8205: A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.
Key phrases: upload a malicious file in a section of, directory traversal
CVE-2016-8206: A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to write to arbitrary files, and consequently delete the files.
Key phrases: write to arbitrary files, directory traversal, delete the files
CVE-2016-8207: A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to read arbitrary files including files with sensitive user information.
Key phrases: read arbitrary files, read arbitrary files including files with sensitive user, directory traversal, sensitive user information
CVE-2016-8209: Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.
Key phrases: denial of service (crash and reload), cause a denial of service (crash and, improper checks
CVE-2016-8211: EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection Advisor 6.2.3 prior to patch 446 has a path traversal vulnerability that may potentially be exploited by malicious users to compromise the affected system.
Key phrases: path traversal
CVE-2016-8212: An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
Key phrases: improper ocsp validation
CVE-2016-8213: EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects Version 1.9, prior to P30 and Version 1.10, prior to P17; and EMC Documentum Administrator Version 7.0, Version 7.1, and Version 7.2 prior to P18 contain a Stored Cross-Site Scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Key phrases: stored cross-site scripting
CVE-2016-8214: EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3.0 and 7.3.1 contain a vulnerability that may allow malicious administrators to compromise Avamar servers.
Key phrases: compromise Avamar servers
CVE-2016-8215: EMC RSA Security Analytics 10.5.3 and 10.6.2 contains fixes for a Reflected Cross-Site Scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Key phrases: reflected cross-site scripting
CVE-2016-8216: EMC Data Domain OS (DD OS) 5.4 all versions, EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.
Key phrases: command injection
CVE-2016-8217: EMC RSA BSAFE Crypto-J versions prior to 6.2.2 has a PKCS#12 Timing Attack Vulnerability. A possible timing attack could be carried out by modifying a PKCS#12 file that has an integrity MAC for which the password is not known. An attacker could then feed the modified PKCS#12 file to the toolkit and guess the current MAC one byte at a time. This is possible because Crypto-J uses a non-constant-time method to compare the stored MAC with the calculated MAC. This vulnerability is similar to the issue described in CVE-2015-2601.
Key phrases: timing attack, integrity
CVE-2016-8218: An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue.
Key phrases: impersonate other users to the routing API, unauthenticated jwt signing algorithm in routing
CVE-2016-8219: An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails.
Key phrases: application downtime
CVE-2016-8220: Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route.
Key phrases: information disclosure
CVE-2016-8221: Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules (IOMs), certain log files viewable by authenticated users may contain passwords for internal administrative LXCA accounts with temporary passwords that are used internally by LXCA code.
Key phrases: privilege escalation
CVE-2016-8222: A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
Key phrases: call System Management Mode (SMM) services, be altered (such as boot sequence), denial of service
CVE-2016-8223: During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on some Windows 10 PCs where a user with local privileges could run arbitrary code with administrator level privileges.
Key phrases: run arbitrary code, local privilege escalation
CVE-2016-8224: A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or privilege escalation attack on the system.
Key phrases: denial of service, privilege escalation
CVE-2016-8225: Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with elevated privileges.
Key phrases: execute code with elevated privileges, unquoted service path, elevate privileges
CVE-2016-8226: The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure.
Key phrases: cause a denial of service via updating a
CVE-2016-8227: Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute code with elevated privileges.
Key phrases: execute code with elevated privileges, privilege escalation, elevate privileges
CVE-2016-8228: In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.
Key phrases: execute code
CVE-2016-8229: A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by the system where LSB is installed.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2016-8230: In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers.
Key phrases: http connection
CVE-2016-8231: In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate.
CVE-2016-8232: Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 allows an unauthenticated attacker with access to the AMM's IP address to send a crafted URL that could inject a malicious script to access a user's AMM data such as cookies or other session information.
Key phrases: the AMM's IP address to send a, document object model-(dom) based cross-site scripting
CVE-2016-8233: Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a non-privileged user.
Key phrases: non-secure, clear text form
CVE-2016-8235: Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated privileges.
Key phrases: execute code with elevated privileges, privilege escalation, elevate privileges
CVE-2016-8236: Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than 3.77.
CVE-2016-8237: Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.
Key phrases: execute arbitrary code, remote code execution, man in the middle
CVE-2016-8271: Huawei eSpace IAD V300R002C01SPC100 and earlier versions have an information leak vulnerability; an attacker can check and download the fault information by accessing a special URL.
Key phrases: information leak
CVE-2016-8272: Huawei PC client software HiSuite 4.0.5.300_OVE has an information leak vulnerability; an attacker who can log in to the system can copy out the user's proxy password, causing information leaks.
Key phrases: information leak, information leaks
CVE-2016-8273: Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise the PC.
Key phrases: insecure http, mitm, compromise the pc, integrity
CVE-2016-8274: Huawei PC client software HiSuite 4.0.5.300_OVE has a dynamic link library (DLL) hijack vulnerability; an attacker can make the system load malicious DLL files to execute arbitrary code.
Key phrases: execute arbitrary code, hijack
CVE-2016-8275: Huawei AnyOffice V200R006C00 could allow an authenticated, remote attacker to cause the software to deny services by uploading an XML bomb.
Key phrases: cause the software to deny services by uploading, xml bomb
CVE-2016-8276: Buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.
Key phrases: execute arbitrary code, denial of service (server restart), cause a denial of service (server restart, buffer overflow
CVE-2016-8277: Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified command parameter.
Key phrases: denial of service (device restart), cause a denial of service (device restart, unspecified command parameter
CVE-2016-8278: Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service (device restart) via an unspecified URL.
Key phrases: denial of service (device restart), cause a denial of service (device restart, unspecified url
CVE-2016-8279: The video driver in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B362, CRR-UL20 before CRR-UL20C00B362, CRR-CL00 before CRR-CL00C92B362, and CRR-CL20 before CRR-CL20C92B362; P8 smartphones with software GRA-TL00 before GRA-TL00C01B366, GRA-UL00 before GRA-UL00C00B366, GRA-UL10 before GRA-UL10C00B366, and GRA-CL00 before GRA-CL00C92B366; and Honor 6 and Honor 6 Plus smartphones with software before 6.9.16 allows attackers to cause a denial of service (device reboot) via a crafted application.
Key phrases: denial of service (device reboot), cause a denial of service (device reboot
CVE-2016-8280: Directory traversal vulnerability in Huawei eSight before V300R003C20SPC005 allows remote authenticated users to read arbitrary files via unspecified vectors.
Key phrases: read arbitrary files, read arbitrary files via unspecified vectors, directory traversal
CVE-2016-8281: Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-5536.
Key phrases: affect confidentiality, unspecified, unknown vectors, unspecified vulnerability, confidentiality and integrity, integrity and availability
CVE-2016-8282: Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported versions that are affected are 2.0.1, 2.2.0 and 12.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle FLEXCUBE Private Banking. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle FLEXCUBE Private Banking, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle FLEXCUBE Private Banking accessible data as well as unauthorized read access to a subset of Oracle FLEXCUBE Private Banking accessible data. CVSS v3.0 Base Score 6.1 (Confidentiality and Integrity impacts).
Key phrases: compromise Oracle FLEXCUBE Private Banking, confidentiality and integrity impacts
CVE-2016-8283: Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types.
Key phrases: affect availability via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8284: Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.
Key phrases: affect availability via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8285: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality and integrity via vectors related to Candidate Gateway.
Key phrases: affect confidentiality and integrity via vectors related to, unspecified, unspecified vulnerability
CVE-2016-8286: Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.
Key phrases: affect confidentiality via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8287: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication.
Key phrases: affect availability via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8288: Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.
Key phrases: affect integrity via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8289: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB.
Key phrases: affect integrity and availability via vectors related to, unspecified, unspecified vulnerability
CVE-2016-8290: Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633.
Key phrases: affect availability via vectors related to Server:, unspecified, unspecified vulnerability
CVE-2016-8291: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Mobile Application Platform.
Key phrases: affect confidentiality and integrity via vectors related to, unspecified, unspecified vulnerability
CVE-2016-8292: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition Manager.
Key phrases: affect confidentiality and integrity via vectors related to, unspecified, unspecified vulnerability
CVE-2016-8293: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5529 and CVE-2016-5530.
Key phrases: affect confidentiality and integrity via vectors related to, unspecified, unspecified vulnerability
CVE-2016-8294: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality via unknown vectors.
Key phrases: affect confidentiality via unknown vectors, unspecified, unspecified vulnerability
CVE-2016-8295: Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Key phrases: affect confidentiality via unknown vectors, unspecified, unspecified vulnerability
CVE-2016-8296: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to LDAP.
Key phrases: affect confidentiality and integrity via vectors related to, unspecified, unspecified vulnerability