JVN/CVE Demo: Jvninfos

JVN List

Name	Title	Summary	Cveinfo	Cvssv2	Jvnurl	Published Date	Last Updated Date	Actions
JVNDB-2016-004850	libarchive のサンドボックスコードにおける任意のファイルに書き込まれる脆弱性	libarchive のサンドボックスコードは、0 以外のデータサイズのハードリンクアーカイブのエントリを誤って処理するため、任意のファイルに書き込まれる脆弱性が存在します。	CVE-2016-5418	5	http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004850.html	2016-09-12	2016-11-17	View
JVNDB-2016-004389	cURL および libcurl における制限を回避される脆弱性	cURL および libcurl は、クライアント証明書が変更された場合、TLS セッションの再開を阻止しないため、制限を回避される脆弱性が存在します。	CVE-2016-5419	5	http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004389.html	2016-08-03	2016-11-17	View
JVNDB-2016-004390	cURL および libcurl における接続認証をハイジャックされる脆弱性	cURL および libcurl は、再利用に TLS 接続を選択する際、クライアント証明書をチェックしないため、接続認証をハイジャックされる脆弱性が存在します。	CVE-2016-5420	5	http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004390.html	2016-08-03	2016-11-17	View
JVNDB-2016-004391	libcurl における使用される接続を制御される脆弱性	libcurl には、解放済みメモリの使用 (Use-after-free) により、使用される接続を制御されるなど、不特定の影響を受ける脆弱性が存在します。	CVE-2016-5421	7.5	http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004391.html	2016-08-03	2016-11-17	View
JVNDB-2016-004547	Red Hat JBoss Operations Network の Web コンソールにおける admin 権限を取得される脆弱性	Red Hat JBoss Operations Network (JON) の Web コンソールは、スーパーユーザの役割を持つユーザを追加するリクエストを適切に許可しないため、admin 権限を取得される脆弱性が存在します。	CVE-2016-5422	6.5	http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004547.html	2016-08-31	2016-09-09	View

Page 13461 of 13768, showing 5 records out of 68839 total, starting on record 67301, ending on 67305

<<first <prev 13457 | 13458 | 13459 | 13460 | 13461 | 13462 | 13463 | 13464 | 13465 next> last>>

Actions

List NVD

History
+
Request History
4 previous requests available
====
Session
+
Session
- 0(null)
====
Request
+
Request

Cake Params
- plugin(null)
- controllerjvninfos
- actionindex
- named(array)
  page13461
  sortcveinfo_id
  directionasc
  Jvninfoscveinfos
- pass(empty)
- paging(array)
  Jvninfo(array)
  page13461
  current5
  count68839
  prevPage(true)
  nextPage(true)
  pageCount13768
  order(array)
  Jvninfo.cveinfo_idasc
  limit5
  options(array)
  page13461
  order(array)
  Jvninfo.cveinfo_idasc
  sortcveinfo_id
  directionasc
  conditions(empty)
  paramTypenamed
Post data

No post data.

Query string

No querystring data.

Cookie

To view Cookies, add CookieComponent to Controller

Current Route
- keys(array)
  0controller
  1action
- options(array)
  defaultRoute(true)
- defaults(array)
  plugin(null)
- template/:controller/:action/*
====
Sql Log
+

Sql Logs

default
No query logs.

====

Timer

+

Memory

Peak Memory Use 3.83 MB

Message	Memory use
Component initialization	1.38 MB
Controller action start	1.49 MB
Controller render start	2.26 MB
View render complete	2.76 MB

Timers

Total Request Time: 491 (ms)

Message	Time in ms	Graph
Core Processing (Derived from $_SERVER["REQUEST_TIME"])	3.25
Event: Controller.initialize	0.02
Event: Controller.startup	0.07
Controller action	467.81
Event: Controller.beforeRender	5.27
» Processing toolbar data	5.17
Rendering View	8.89
» Event: View.beforeRender	0.03
» Rendering APP/View/Jvninfos/index.ctp	7.64
» Event: View.afterRender	0.03
» Event: View.beforeLayout	0.02
» Rendering APP/View/Layouts/default.ctp	0.66
» » Rendering CORE/Cake/View/Elements/sql_dump.ctp	0.13
Event: View.afterLayout	0.00

====

Log
+

Logs

There were no log entries made this request

====
Variables
+
View Variables
- jvninfos(array)
  0(array)
  Jvninfo(array)
  id4077
  nameJVNDB-2016-004850
  titlelibarchive のサンドボックスコードにおける任意のファイルに書き込まれる脆弱性
  summarylibarchive のサンドボックスコードは、0 以外のデータサイズのハードリンクアーカイブのエントリを誤って処理するため、任意のファイルに書き込まれる脆弱性が存在します。
  cveinfo_nameCVE-2016-5418
  cveinfo_id91924
  nvdinfo_nameCVE-2016-5418
  nvdinfo_id20672
  cvssv25
  cvssv37.5
  jvnurlhttp://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004850.html
  published_date2016-09-12
  registered_date2016-09-27
  last_updated_date2016-11-17
  deleted(null)
  created0000-00-00 00:00:00
  modified(null)
  Cveinfo(array)
  id91924
  nameCVE-2016-5105
  statusCandidate
  descriptionThe megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
  phaseAssigned (20160526)
  votesNone (candidate not yet proposed)
  comments(null)
  deleted(null)
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  Nvdinfo(array)
  id20672
  nameCVE-2016-5418
  descriptionThe sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
  reject(null)
  CVSS_version2
  CVSS_score5
  severityMedium
  CVSS_base_score5
  CVSS_impact_subscore2.9
  CVSS_exploit_subscore10
  nvd_xml_version(null)
  CVSS_vector(AV:N/AC:L/Au:N/C:N/I:P/A:N)
  sourcecve
  pub_date2017-01-19
  published2016-09-21
  modified_date2016-11-28
  typeCVE
  seq2016-5418
  deleted(null)
  created(null)
  modified(null)
  1(array)
  Jvninfo(array)
  id3616
  nameJVNDB-2016-004389
  titlecURL および libcurl における制限を回避される脆弱性
  summarycURL および libcurl は、クライアント証明書が変更された場合、TLS セッションの再開を阻止しないため、制限を回避される脆弱性が存在します。
  cveinfo_nameCVE-2016-5419
  cveinfo_id91925
  nvdinfo_nameCVE-2016-5419
  nvdinfo_id20673
  cvssv25
  cvssv37.5
  jvnurlhttp://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004389.html
  published_date2016-08-03
  registered_date2016-08-18
  last_updated_date2016-11-17
  deleted(null)
  created0000-00-00 00:00:00
  modified(null)
  Cveinfo(array)
  id91925
  nameCVE-2016-5106
  statusCandidate
  descriptionThe megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest administrators to cause a denial of service (out-of-bounds write access) via vectors involving a MegaRAID Firmware Interface (MFI) command.
  phaseAssigned (20160526)
  votesNone (candidate not yet proposed)
  comments(null)
  deleted(null)
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  Nvdinfo(array)
  id20673
  nameCVE-2016-5419
  descriptioncurl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.
  reject
  CVSS_version2
  CVSS_score5
  severityMedium
  CVSS_base_score5
  CVSS_impact_subscore2.9
  CVSS_exploit_subscore10
  nvd_xml_version
  CVSS_vector(AV:N/AC:L/Au:N/C:P/I:N/A:N)
  sourcecve
  pub_date2017-07-18
  published2016-08-10
  modified_date2017-07-10
  typeCVE
  seq2016-5419
  deleted0000-00-00 00:00:00
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  2(array)
  Jvninfo(array)
  id3617
  nameJVNDB-2016-004390
  titlecURL および libcurl における接続認証をハイジャックされる脆弱性
  summarycURL および libcurl は、再利用に TLS 接続を選択する際、クライアント証明書をチェックしないため、接続認証をハイジャックされる脆弱性が存在します。
  cveinfo_nameCVE-2016-5420
  cveinfo_id91926
  nvdinfo_nameCVE-2016-5420
  nvdinfo_id20674
  cvssv25
  cvssv37.5
  jvnurlhttp://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004390.html
  published_date2016-08-03
  registered_date2016-08-18
  last_updated_date2016-11-17
  deleted(null)
  created0000-00-00 00:00:00
  modified(null)
  Cveinfo(array)
  id91926
  nameCVE-2016-5107
  statusCandidate
  descriptionThe megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds read and crash) via unspecified vectors.
  phaseAssigned (20160526)
  votesNone (candidate not yet proposed)
  comments(null)
  deleted(null)
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  Nvdinfo(array)
  id20674
  nameCVE-2016-5420
  descriptioncurl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
  reject(null)
  CVSS_version2
  CVSS_score5
  severityMedium
  CVSS_base_score5
  CVSS_impact_subscore2.9
  CVSS_exploit_subscore10
  nvd_xml_version(null)
  CVSS_vector(AV:N/AC:L/Au:N/C:N/I:P/A:N)
  sourcecve
  pub_date2017-01-19
  published2016-08-10
  modified_date2016-11-28
  typeCVE
  seq2016-5420
  deleted(null)
  created(null)
  modified(null)
  3(array)
  Jvninfo(array)
  id3618
  nameJVNDB-2016-004391
  titlelibcurl における使用される接続を制御される脆弱性
  summarylibcurl には、解放済みメモリの使用 (Use-after-free) により、使用される接続を制御されるなど、不特定の影響を受ける脆弱性が存在します。
  cveinfo_nameCVE-2016-5421
  cveinfo_id91927
  nvdinfo_nameCVE-2016-5421
  nvdinfo_id20675
  cvssv27.5
  cvssv39.8
  jvnurlhttp://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004391.html
  published_date2016-08-03
  registered_date2016-08-18
  last_updated_date2016-11-17
  deleted(null)
  created0000-00-00 00:00:00
  modified(null)
  Cveinfo(array)
  id91927
  nameCVE-2016-5108
  statusCandidate
  descriptionBuffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.
  phaseAssigned (20160527)
  votesNone (candidate not yet proposed)
  comments(null)
  deleted(null)
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  Nvdinfo(array)
  id20675
  nameCVE-2016-5421
  descriptionUse-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
  reject(null)
  CVSS_version2
  CVSS_score7.5
  severityHigh
  CVSS_base_score7.5
  CVSS_impact_subscore6.4
  CVSS_exploit_subscore10
  nvd_xml_version(null)
  CVSS_vector(AV:N/AC:L/Au:N/C:P/I:P/A:P)
  sourcecve
  pub_date2017-01-19
  published2016-08-10
  modified_date2016-11-28
  typeCVE
  seq2016-5421
  deleted(null)
  created(null)
  modified(null)
  4(array)
  Jvninfo(array)
  id3774
  nameJVNDB-2016-004547
  titleRed Hat JBoss Operations Network の Web コンソールにおける admin 権限を取得される脆弱性
  summaryRed Hat JBoss Operations Network (JON) の Web コンソールは、スーパーユーザの役割を持つユーザを追加するリクエストを適切に許可しないため、admin 権限を取得される脆弱性が存在します。
  cveinfo_nameCVE-2016-5422
  cveinfo_id91928
  nvdinfo_nameCVE-2016-5422
  nvdinfo_id20676
  cvssv26.5
  cvssv38.8
  jvnurlhttp://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004547.html
  published_date2016-08-31
  registered_date2016-09-09
  last_updated_date2016-09-09
  deleted(null)
  created0000-00-00 00:00:00
  modified(null)
  Cveinfo(array)
  id91928
  nameCVE-2016-5109
  statusCandidate
  descriptionCitrix Worx Home for iOS before 10.3.6 and XenMobile MDX Toolkit for iOS before 10.3.6 might allow physically proximate attackers to bypass in-application Apple Touch ID authentication via unspecified vectors, related to an application requiring re-authentication.
  phaseAssigned (20160528)
  votesNone (candidate not yet proposed)
  comments(null)
  deleted(null)
  created0000-00-00 00:00:00
  modified0000-00-00 00:00:00
  Nvdinfo(array)
  id20676
  nameCVE-2016-5422
  descriptionThe web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.
  reject(null)
  CVSS_version2
  CVSS_score6.5
  severityMedium
  CVSS_base_score6.5
  CVSS_impact_subscore6.4
  CVSS_exploit_subscore8
  nvd_xml_version(null)
  CVSS_vector(AV:N/AC:L/Au:S/C:P/I:P/A:P)
  sourcecve
  pub_date2017-01-19
  published2016-09-07
  modified_date2016-09-08
  typeCVE
  seq2016-5422
  deleted(null)
  created(null)
  modified(null)
- $request->data(empty)
- $this->validationErrors(array)
  Jvninfo(empty)
  Cveinfo(empty)
  Nvdinfo(empty)
- Loaded Helpers(array)
  0Number
  1SimpleGraph
  2Paginator
  3DebugTimer
  4Toolbar
  5Html
  6Text
  7Form
  8Session
  9HtmlToolbar
====

+

App Constants

No application environment available.

CakePHP Constants

Constant	Value
APP	/virtual/inogo77/public_html/jvn/app/
APP_DIR	app
APPLIBS	/virtual/inogo77/public_html/jvn/app/Lib/
CACHE	/virtual/inogo77/public_html/jvn/app/tmp/cache/
CAKE	/virtual/inogo77/public_html/jvn/lib/Cake/
CAKE_CORE_INCLUDE_PATH	/virtual/inogo77/public_html/jvn/lib
CORE_PATH	/virtual/inogo77/public_html/jvn/lib/
CAKE_VERSION	2.6.0
CSS	/virtual/inogo77/public_html/jvn/app/webroot/css/
CSS_URL	css/
DS	/
FULL_BASE_URL	http://inogo77.s500.xrea.com
IMAGES	/virtual/inogo77/public_html/jvn/app/webroot/img/
IMAGES_URL	img/
JS	/virtual/inogo77/public_html/jvn/app/webroot/js/
JS_URL	js/
LOGS	/virtual/inogo77/public_html/jvn/app/tmp/logs/
ROOT	/virtual/inogo77/public_html/jvn
TESTS	/virtual/inogo77/public_html/jvn/app/Test/
TMP	/virtual/inogo77/public_html/jvn/app/tmp/
VENDORS	/virtual/inogo77/public_html/jvn/vendors/
WEBROOT_DIR	webroot
WWW_ROOT	/virtual/inogo77/public_html/jvn/app/webroot/

PHP Environment

Environment Variable	Value
Php Version	5.6.40
Phprc	php56.ini
Php Fcgi Children	1
Pwd	/virtual/inogo77/public_html/.fast-cgi-bin
Php Fcgi Max Requests	10000
Shlvl	0
Path	/usr/local/bin:/usr/bin:/bin
Http Connection	close
Script Name	/jvn/app/webroot/index.php
Request Uri	/jvn/jvninfos/index/page:13461/sort:cveinfo_id/direction:asc/Jvninfos:cveinfos
Query String
Request Method	GET
Server Protocol	HTTP/1.1
Gateway Interface	CGI/1.1
Redirect Url	/jvn/app/webroot/jvninfos/index/page:13461/sort:cveinfo_id/direction:asc/Jvninfos:cveinfos
Remote Port	11232
Script Filename	/virtual/inogo77/public_html/jvn/app/webroot/index.php
Server Admin	[no address given]
Context Document Root	/virtual/inogo77/public_html
Context Prefix
Request Scheme	http
Document Root	/virtual/inogo77/public_html
Remote Addr	3.12.41.25
Server Port	80
Server Addr	160.251.151.205
Server Name	inogo77.s500.xrea.com
Server Software	Apache
Server Signature
Http Host	inogo77.s500.xrea.com
Http Accept Encoding	gzip, br, zstd, deflate
Http User Agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
Http Accept	/
Gem Home	/usr/local/rvm/gems/ruby-2.3.0
X Dostranslated Ip	3.12.41.25
Mm Country Code	US
Mmdb Info	result found
Mmdb Addr	3.12.41.25
Unique Id	aBqiZcJhYBjmQLZMjxfbWwAAAZ8
Redirect Status	200
Redirect Gem Home	/usr/local/rvm/gems/ruby-2.3.0
Redirect X Dostranslated Ip	3.12.41.25
Redirect Mm Country Code	US
Redirect Mmdb Info	result found
Redirect Mmdb Addr	3.12.41.25
Redirect Unique Id	aBqiZcJhYBjmQLZMjxfbWwAAAZ8
Redirect Redirect Status	200
Redirect Redirect Gem Home	/usr/local/rvm/gems/ruby-2.3.0
Redirect Redirect X Dostranslated Ip	3.12.41.25
Redirect Redirect Mm Country Code	US
Redirect Redirect Mmdb Info	result found
Redirect Redirect Mmdb Addr	3.12.41.25
Redirect Redirect Unique Id	aBqiZcJhYBjmQLZMjxfbWwAAAZ8
Fcgi Role	RESPONDER
Php Self	/jvn/app/webroot/index.php
Request Time Float	1746575973.6545
Request Time	1746575973

====

Include
+
Included Files

Include Paths
- 0/virtual/inogo77/public_html/jvn/lib
- 2/opt/remi/php56/root/usr/share/pear
- 3/opt/remi/php56/root/usr/share/php
- 4/usr/share/pear
- 5/usr/share/php
- 6-> /virtual/inogo77/public_html/jvn/lib/Cake/
Included Files
- core(array)
  Cache(array)
  0CORE/Cache/Cache.php
  1CORE/Cache/Engine/FileEngine.php
  2CORE/Cache/CacheEngine.php
  Component(array)
  0CORE/Controller/Component/SessionComponent.php
  1CORE/Controller/Component/PaginatorComponent.php
  Config(array)
  0CORE/Config/routes.php
  1CORE/Config/config.php
  Controller(array)
  0CORE/Controller/Controller.php
  1CORE/Controller/ComponentCollection.php
  2CORE/Controller/Component.php
  Datasource(array)
  0CORE/Model/Datasource/CakeSession.php
  1CORE/Model/Datasource/Database/Mysql.php
  2CORE/Model/Datasource/DboSource.php
  3CORE/Model/Datasource/DataSource.php
  Error(array)
  0CORE/Error/exceptions.php
  1CORE/Error/ErrorHandler.php
  I18n(array)
  0CORE/I18n/I18n.php
  1CORE/I18n/L10n.php
  Log(array)
  0CORE/Log/CakeLog.php
  1CORE/Log/LogEngineCollection.php
  2CORE/Log/Engine/FileLog.php
  3CORE/Log/Engine/BaseLog.php
  4CORE/Log/CakeLogInterface.php
  Model(array)
  0CORE/Model/Model.php
  1CORE/Model/BehaviorCollection.php
  2CORE/Model/ConnectionManager.php
  Network(array)
  0CORE/Network/CakeRequest.php
  1CORE/Network/CakeResponse.php
  Other(array)
  0CORE/bootstrap.php
  1CORE/basics.php
  2CORE/Core/App.php
  3CORE/Core/Configure.php
  4CORE/Core/CakePlugin.php
  5CORE/Event/CakeEventListener.php
  6CORE/Event/CakeEvent.php
  7CORE/Event/CakeEventManager.php
  8CORE/Core/Object.php
  Routing(array)
  0CORE/Routing/Dispatcher.php
  1CORE/Routing/Filter/AssetDispatcher.php
  2CORE/Routing/DispatcherFilter.php
  3CORE/Routing/Filter/CacheDispatcher.php
  4CORE/Routing/Router.php
  5CORE/Routing/Route/CakeRoute.php
  6CORE/Routing/Route/PluginShortRoute.php
  Utility(array)
  0CORE/Utility/Hash.php
  1CORE/Utility/Inflector.php
  2CORE/Utility/ObjectCollection.php
  3CORE/Utility/Debugger.php
  4CORE/Utility/String.php
  5CORE/Utility/ClassRegistry.php
  View(array)
  0CORE/View/HelperCollection.php
- app(array)
  Component(array)
  0APP/Controller/Component/CommonComponent.php
  Config(array)
  0APP/Config/core.php
  1APP/Config/bootstrap.php
  2APP/Config/routes.php
  3APP/Config/database.php
  Controller(array)
  0APP/Controller/JvninfosController.php
  1APP/Controller/AppController.php
  Model(array)
  0APP/Model/Jvninfo.php
  1APP/Model/AppModel.php
  2APP/Model/Cveinfo.php
  3APP/Model/Nvdinfo.php
  Other(array)
  0APP/webroot/index.php
- plugins(array)
  DebugKit(array)
  Component(array)
  0DebugKit/Controller/Component/ToolbarComponent.php
  Other(array)
  0DebugKit/Lib/DebugMemory.php
  1DebugKit/Lib/Panel/HistoryPanel.php
  2DebugKit/Lib/DebugPanel.php
  3DebugKit/Lib/Panel/SessionPanel.php
  4DebugKit/Lib/Panel/RequestPanel.php
  5DebugKit/Lib/Panel/SqlLogPanel.php
  6DebugKit/Lib/Panel/TimerPanel.php
  7DebugKit/Lib/Panel/LogPanel.php
  8DebugKit/Lib/Panel/VariablesPanel.php
  9DebugKit/Lib/Panel/EnvironmentPanel.php
  10DebugKit/Lib/Panel/IncludePanel.php
  11DebugKit/Lib/DebugTimer.php
  Log(array)
  0DebugKit/Lib/Log/Engine/DebugKitLog.php
====