CWE-399 (page 4)
Page 4 of 27 — CVEs classified under CWE-399, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-1832 | Critical | 9.1 | 2016-10-03 | XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-d… |
CVE-2016-7498 | Medium | 6.5 | 2016-09-27 | OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (di… |
CVE-2016-6308 | Medium | 5.9 | 2016-09-26 | statem/statem_dtls.c in the DTLS implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remo… |
CVE-2016-6518 | High | 7.5 | 2016-09-26 | Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a denial of service (memory consumption and… |
CVE-2016-4772 | High | 7.5 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to cause a denial of service (unintended loc… |
CVE-2016-6409 | High | 7.5 | 2016-09-24 | The Data in Motion (DMo) component in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service… |
CVE-2016-7166 | Medium | 5.5 | 2016-09-21 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption a… |
CVE-2016-5427 | High | 7.5 | 2016-09-21 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of ser… |
CVE-2016-5426 | High | 7.5 | 2016-09-21 | PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname. |
CVE-2016-6403 | Medium | 5.9 | 2016-09-18 | The Data in Motion (DMo) application in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of servic… |
CVE-2016-1433 | Medium | 5.3 | 2016-09-18 | Cisco IOS XR 6.0 and 6.0.1 on NCS 6000 devices allows remote attackers to cause a denial of service (OSPFv3 process reload) via crafted OSPFv3 packets, aka Bug… |
CVE-2016-6407 | High | 7.5 | 2016-09-17 | Cisco AsyncOS through 9.5.0-444 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (link saturation) by making many H… |
CVE-2016-6401 | Medium | 5.3 | 2016-09-17 | Cisco Carrier Routing System (CRS) 5.1 and 5.1.4, as used in CRS Carrier Grade Services for CRS-1 and CRS-3 devices, allows remote attackers to cause a denial… |
CVE-2016-2179 | High | 7.5 | 2016-09-16 | The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which al… |
CVE-2016-6375 | Medium | 5.3 | 2016-09-12 | Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.121.0, and 8.3.x before 8.3.102.0 allow remote attackers to cause a de… |
CVE-2016-1469 | High | 7.5 | 2016-09-12 | The HTTP framework on Cisco SPA300, SPA500, and SPA51x devices allows remote attackers to cause a denial of service (device outage) via a series of malformed H… |
CVE-2016-1275 | Medium | 6.5 | 2016-09-09 | Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain… |
CVE-2016-6900 | Medium | 5.5 | 2016-09-07 | The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers with software befo… |
CVE-2016-6876 | High | 7.5 | 2016-09-07 | The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before… |
CVE-2016-7113 | High | 7.5 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-1415 | Medium | 5.5 | 2016-09-03 | Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted fi… |
CVE-2016-6376 | Medium | 6.5 | 2016-09-02 | The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.12… |
CVE-2016-6355 | High | 7.5 | 2016-08-23 | Memory leak in Cisco IOS XR 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to cause a denial of… |
CVE-2016-1466 | High | 7.5 | 2016-08-08 | Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1, and 11.5(1) allows re… |
CVE-2016-5359 | Medium | 5.9 | 2016-08-07 | epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 1.12.x before 1.12.12 mishandles offsets, which allows remote attackers to cause a denial of… |
CVE-2016-5350 | High | 7.5 | 2016-08-07 | epan/dissectors/packet-dcerpc-spoolss.c in the SPOOLS component in Wireshark 1.12.x before 1.12.12 and 2.x before 2.0.4 mishandles unexpected offsets, which al… |
CVE-2016-6513 | Medium | 5.9 | 2016-08-06 | epan/dissectors/packet-wbxml.c in the WBXML dissector in Wireshark 2.x before 2.0.5 does not restrict the recursion depth, which allows remote attackers to cau… |
CVE-2016-6511 | Medium | 5.9 | 2016-08-06 | epan/proto.c in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service (OpenFlow dissector large loop) via a… |
CVE-2016-6508 | Medium | 5.9 | 2016-08-06 | epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 uses an incorrect integer data type, which allows rem… |
CVE-2016-6507 | Medium | 5.9 | 2016-08-06 | epan/dissectors/packet-mmse.c in the MMSE dissector in Wireshark 1.12.x before 1.12.13 allows remote attackers to cause a denial of service (infinite loop) via… |
CVE-2016-6506 | Medium | 5.9 | 2016-08-06 | epan/dissectors/packet-wsp.c in the WSP dissector in Wireshark 1.12.x before 1.12.13 and 2.x before 2.0.5 allows remote attackers to cause a denial of service… |
CVE-2016-5412 | Medium | 6.5 | 2016-08-06 | arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to… |
CVE-2016-1276 | Medium | 5.9 | 2016-08-05 | Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D23, 12.3X48 before 12.3X48-D25, and 15.1X49 before 15.1X49-D40 on a High-End SRX-Series chassis sy… |
CVE-2016-1467 | Medium | 6.5 | 2016-07-28 | Cisco Videoscape Session Resource Manager (VSRM) allows remote attackers to cause a denial of service (device restart) by sending a traffic flood to upstream d… |
CVE-2016-1465 | Medium | 6.5 | 2016-07-28 | Cisco Nexus 1000v Application Virtual Switch (AVS) devices before 5.2(1)SV3(1.5i) allow remote attackers to cause a denial of service (ESXi hypervisor crash an… |
CVE-2016-1460 | Medium | 6.5 | 2016-07-28 | Cisco Wireless LAN Controller (WLC) devices 7.4(121.0) and 8.0(0.30220.385) allow remote attackers to cause a denial of service via crafted wireless management… |
CVE-2016-1459 | Medium | 5.3 | 2016-07-17 | Cisco IOS 12.4 and 15.0 through 15.5 and IOS XE 3.13 through 3.17 allow remote authenticated users to cause a denial of service (device reload) via crafted att… |
CVE-2016-1426 | High | 7.5 | 2016-07-15 | Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Processor reload) via craf… |
CVE-2016-3767 | High | 7.8 | 2016-07-11 | The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3765 | High | 7.7 | 2016-07-11 | decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a den… |
CVE-2016-3754 | High | 7.5 | 2016-07-11 | mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not limit process-memory usage, which allows re… |
CVE-2016-1546 | Medium | 5.9 | 2016-07-06 | The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, w… |
CVE-2016-5706 | High | 7.5 | 2016-07-03 | js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service… |
CVE-2016-1440 | Medium | 5.3 | 2016-07-02 | The proxy process on Cisco Web Security Appliance (WSA) devices through 9.1.0-070 allows remote attackers to cause a denial of service (CPU consumption) by est… |
CVE-2016-5368 | High | 7.5 | 2016-06-30 | Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted M… |
CVE-2016-4057 | Medium | 6.5 | 2016-06-30 | Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of craft… |
CVE-2016-0260 | High | 7.5 | 2016-06-29 | Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by tr… |
CVE-2016-3949 | High | 7.5 | 2016-06-27 | Siemens SIMATIC S7-300 Profinet-enabled CPU devices with firmware before 3.2.12 and SIMATIC S7-300 Profinet-disabled CPU devices with firmware before 3.3.12 al… |
CVE-2016-5435 | Medium | 5.9 | 2016-06-24 | Memory leak in Huawei IPS Module, NGFW Module, NIP6300, NIP6600, and Secospace USG6300, USG6500, USG6600, USG9500, and AntiDDoS8000 V500R001C00 before V500R001… |
CVE-2016-1428 | Medium | 6.5 | 2016-06-23 | Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device restart) via a sequenc… |
CVE-2015-6289 | High | 7.5 | 2016-06-23 | Cisco IOS 15.5(3)M on Integrated Services Router (ISR) 800, 819, and 829 devices allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2016-1432 | Medium | 6.5 | 2016-06-18 | Cisco IOS XE 3.15S and 3.16S on cBR-8 Converged Broadband Router devices allows remote authenticated users to cause a denial of service (NULL pointer dereferen… |
CVE-2016-5300 | High | 7.5 | 2016-06-16 | The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU con… |
CVE-2014-9747 | High | 7.5 | 2016-06-07 | The t42_parse_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-only mode, which all… |
CVE-2016-4423 | High | 7.5 | 2016-06-01 | The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2… |
CVE-2016-1379 | Medium | 6.5 | 2016-05-28 | Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing, which allows remote authenticated users to cause a denial… |
CVE-2016-1385 | Medium | 6.5 | 2016-05-26 | The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, m… |
CVE-2016-4021 | High | 7.5 | 2016-05-26 | The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption)… |
CVE-2016-1383 | High | 7.5 | 2016-05-25 | Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2016-1381 | High | 7.5 | 2016-05-25 | Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (mem… |
CVE-2015-8877 | High | 7.5 | 2016-05-22 | The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent all… |
CVE-2016-2208 | Critical | 9.1 | 2016-05-19 | The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of serv… |
CVE-2016-1399 | High | 7.5 | 2016-05-14 | The packet-processing microcode in Cisco IOS 15.2(2)EA, 15.2(2)EA1, 15.2(2)EA2, and 15.2(4)EA on Industrial Ethernet 4000 devices and 15.2(2)EB and 15.2(2)EB1… |
CVE-2015-5727 | High | 7.5 | 2016-05-13 | The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecif… |
CVE-2016-2094 | High | 7.5 | 2016-05-06 | The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a r… |
CVE-2016-1369 | High | 7.5 | 2016-05-05 | The Adaptive Security Appliance (ASA) 5585-X FirePOWER Security Services Processor (SSP) module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misco… |
CVE-2016-1368 | High | 7.5 | 2016-05-05 | Cisco FirePOWER System Software 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances, and on the Advanced Malware Protection (… |
CVE-2016-4008 | Medium | 5.9 | 2016-05-05 | The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attack… |
CVE-2016-2109 | High | 7.5 | 2016-05-05 | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attacke… |
CVE-2016-4419 | Medium | 5.9 | 2016-05-01 | epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial… |
CVE-2016-3156 | Medium | 5.5 | 2016-04-27 | The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (ho… |
CVE-2016-2847 | Medium | 6.2 | 2016-04-27 | fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consu… |
CVE-2016-2550 | Medium | 5.5 | 2016-04-27 | The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect trac… |
CVE-2015-1339 | Medium | 6.2 | 2016-04-27 | Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consu… |
CVE-2016-1367 | High | 7.5 | 2016-04-21 | The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload)… |
CVE-2016-1363 | Critical | 9.8 | 2016-04-21 | Buffer overflow in the redirection functionality in Cisco Wireless LAN Controller (WLC) Software 7.2 through 7.4 before 7.4.140.0(MD) and 7.5 through 8.0 befor… |
CVE-2016-1362 | High | 7.5 | 2016-04-21 | Cisco AireOS 4.1 through 7.4.120.0, 7.5.x, and 7.6.100.0 on Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device… |
CVE-2016-0741 | High | 7.5 | 2016-04-19 | slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infi… |
CVE-2016-1269 | High | 7.5 | 2016-04-15 | Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R… |
CVE-2015-8677 | Medium | 6.5 | 2016-04-14 | Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200… |
CVE-2015-8676 | High | 7.5 | 2016-04-14 | Memory leak in Huawei S5300EI, S5300SI, S5310HI, S6300EI/ S2350EI, and S5300LI Campus series switches with software V200R001C00 before V200R001SPH018, V200R002… |
CVE-2016-2515 | High | 7.5 | 2016-04-13 | Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI… |
CVE-2016-2116 | Medium | 5.7 | 2016-04-13 | Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) v… |
CVE-2016-1496 | Medium | 5.5 | 2016-04-13 | The graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, G… |
CVE-2016-1346 | Medium | 5.9 | 2016-04-06 | The kernel in Cisco TelePresence Server 3.0 through 4.2(4.18) on Mobility Services Engine (MSE) 8710 devices allows remote attackers to cause a denial of servi… |
CVE-2015-6313 | High | 7.5 | 2016-04-06 | Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM… |
CVE-2016-1351 | High | 7.5 | 2016-03-26 | The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of serv… |
CVE-2016-1350 | High | 7.5 | 2016-03-26 | Cisco IOS 15.3 and 15.4, Cisco IOS XE 3.8 through 3.11, and Cisco Unified Communications Manager allow remote attackers to cause a denial of service (device re… |
CVE-2016-1349 | High | 7.5 | 2016-03-26 | The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (devi… |
CVE-2016-1348 | High | 7.5 | 2016-03-26 | Cisco IOS 15.0 through 15.5 and IOS XE 3.3 through 3.16 allow remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 Relay message… |
CVE-2016-1344 | Medium | 5.9 | 2016-03-26 | The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fr… |
CVE-2016-1347 | High | 7.5 | 2016-03-24 | The Wide Area Application Services (WAAS) Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service (device re… |
CVE-2016-1778 | High | 8.8 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a c… |
CVE-2016-1956 | Medium | 6.5 | 2016-03-13 | Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack mem… |
CVE-2016-1361 | Medium | 5.3 | 2016-03-12 | Cisco IOS XR through 4.3.2 on Gigabit Switch Router (GSR) 12000 devices does not properly check for a Bidirectional Forwarding Detection (BFD) header in a UDP… |
CVE-2016-1338 | Medium | 6.5 | 2016-03-12 | Cisco TelePresence Video Communication Server (VCS) X8.5.1 and X8.5.2 allows remote authenticated users to cause a denial of service (VoIP outage) via a crafte… |
CVE-2016-1326 | High | 7.5 | 2016-03-09 | The administration interface on Cisco DPQ3925 devices with firmware r1 allows remote attackers to cause a denial of service (device restart) via a crafted HTTP… |
CVE-2016-1312 | High | 7.5 | 2016-03-09 | The HTTPS inspection engine in the Content Security and Control Security Services Module (CSC-SSM) 6.6 before 6.6.1164.0 for Cisco ASA 5500 devices allows remo… |
CVE-2015-0718 | High | 7.5 | 2016-03-03 | Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cau… |
CVE-2016-0798 | High | 7.5 | 2016-03-03 | Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of ser… |