2016 CVEs (page 13)
Page 13 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10714 | Critical | 9.8 | 2018-02-27 | In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATH_MAX characters. |
CVE-2016-0369 | Low | 2.7 | 2018-02-21 | XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information v… |
CVE-2016-0367 | Medium | 4.3 | 2018-02-21 | IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive information by readin… |
CVE-2016-0366 | Low | 3.7 | 2018-02-21 | IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive information by leveraging… |
CVE-2016-0351 | Low | 3.7 | 2018-02-21 | IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, wh… |
CVE-2016-0348 | High | 8.0 | 2018-02-21 | Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentica… |
CVE-2016-0345 | Medium | 4.3 | 2018-02-21 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain the installation pa… |
CVE-2016-0344 | Medium | 5.4 | 2018-02-21 | Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before… |
CVE-2016-0343 | Medium | 4.3 | 2018-02-21 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain sensitive informati… |
CVE-2016-6272 | High | 7.5 | 2018-02-20 | XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field la… |
CVE-2016-10008 | High | 7.2 | 2018-02-19 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrator… |
CVE-2016-10007 | High | 7.2 | 2018-02-19 | SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute… |
CVE-2016-9568 | Critical | 9.8 | 2018-02-19 | A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions. |
CVE-2016-8750 | Medium | 6.5 | 2018-02-19 | Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence w… |
CVE-2016-8535 | Low | 3.5 | 2018-02-15 | A remote HTTP parameter Pollution vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8534 | High | 8.8 | 2018-02-15 | A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8533 | High | 8.8 | 2018-02-15 | A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8532 | Medium | 5.4 | 2018-02-15 | A cross site scripting vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8531 | Medium | 5.3 | 2018-02-15 | A remote information disclosure vulnerability in HPE Matrix Operating Environment version 7.6 was found. |
CVE-2016-8530 | High | 7.5 | 2018-02-15 | A remote denial of service vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or subsequ… |
CVE-2016-8529 | High | 7.6 | 2018-02-15 | A Remote Arbitrary Command Execution vulnerability in HPE StoreVirtual 4000 Storage and StoreVirtual VSA Software running LeftHand OS version v12.5 and earlier… |
CVE-2016-8528 | High | 8.8 | 2018-02-15 | A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found. |
CVE-2016-8525 | High | 7.5 | 2018-02-15 | A Remote Disclosure of Information vulnerability in HPE iMC PLAT version v7.2 E0403P06 and earlier was found. The problem was resolved in iMC PLAT 7.3 E0504 or… |
CVE-2016-8523 | High | 8.8 | 2018-02-15 | A Remote Arbitrary Code Execution vulnerability in HPE Smart Storage Administrator version before v2.60.18.0 was found. |
CVE-2016-8522 | Medium | 5.4 | 2018-02-15 | A cross-site scripting vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found. |
CVE-2016-8521 | Medium | 6.5 | 2018-02-15 | A Remote click jacking vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found. |
CVE-2016-8520 | High | 8.8 | 2018-02-15 | HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated… |
CVE-2016-8519 | Critical | 9.8 | 2018-02-15 | A remote code execution vulnerability in HPE Operations Orchestration Community edition and Enterprise edition prior to v10.70 was found. |
CVE-2016-8518 | High | 7.5 | 2018-02-15 | A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. |
CVE-2016-8517 | Medium | 6.1 | 2018-02-15 | A cross site scripting vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. |
CVE-2016-8516 | High | 7.5 | 2018-02-15 | A remote denial of service vulnerability in HPE Systems Insight Manager in all versions prior to 7.6 was found. |
CVE-2016-8515 | High | 8.8 | 2018-02-15 | A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2016-8514 | Medium | 6.5 | 2018-02-15 | A remote information disclosure in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2016-8513 | High | 8.0 | 2018-02-15 | A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6. |
CVE-2016-8512 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in all versions of HPE LoadRunner and Performance Center was found. |
CVE-2016-8511 | Critical | 9.8 | 2018-02-15 | A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.00.01, v10.00.02, v… |
CVE-2016-10713 | Medium | 5.5 | 2018-02-13 | An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file. |
CVE-2016-9570 | High | 7.5 | 2018-02-12 | cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and application crash) by le… |
CVE-2016-9569 | Medium | 4.4 | 2018-02-12 | The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash)… |
CVE-2016-8742 | High | 7.8 | 2018-02-12 | The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions… |
CVE-2016-5397 | High | 8.8 | 2018-02-12 | The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apach… |
CVE-2016-10712 | High | 7.5 | 2018-02-09 | In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be control… |
CVE-2016-6169 | High | 7.8 | 2018-02-07 | Heap-based buffer overflow in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (memory corrupt… |
CVE-2016-6168 | High | 7.8 | 2018-02-07 | Use-after-free vulnerability in Foxit Reader and PhantomPDF 7.3.4.311 and earlier on Windows allows remote attackers to cause a denial of service (application… |
CVE-2016-2541 | Medium | 5.5 | 2018-02-07 | Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP2 file. |
CVE-2016-2540 | Medium | 5.5 | 2018-02-07 | Audacity before 2.1.2 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted FORMATCHUNK structure. |
CVE-2016-3957 | Critical | 9.8 | 2018-02-06 | The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow re… |
CVE-2016-3954 | Medium | 5.5 | 2018-02-06 | web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue… |
CVE-2016-3953 | Critical | 9.8 | 2018-02-06 | The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption k… |
CVE-2016-3952 | High | 7.8 | 2018-02-06 | web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templat… |
CVE-2016-7394 | Medium | 6.1 | 2018-02-06 | tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie. |
CVE-2016-6813 | Critical | 9.8 | 2018-02-06 | Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to det… |
CVE-2016-0342 | Medium | 5.4 | 2018-02-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary r… |
CVE-2016-0329 | Medium | 5.4 | 2018-02-02 | Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 b… |
CVE-2016-0312 | High | 7.5 | 2018-02-02 | IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to… |
CVE-2016-0311 | Medium | 5.4 | 2018-02-02 | Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows… |
CVE-2016-0303 | Medium | 5.4 | 2018-02-02 | Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2016-0300 | Medium | 5.4 | 2018-02-02 | IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via… |
CVE-2016-6599 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a… |
CVE-2016-6598 | Critical | 9.8 | 2018-01-30 | BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting file storage service (FileStorageService) on port 9010. This service contains a met… |
CVE-2016-10711 | Critical | 9.8 | 2018-01-29 | Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. |
CVE-2016-2983 | High | 8.1 | 2018-01-26 | IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read operational data or TLS session state for… |
CVE-2016-6217 | Medium | 6.1 | 2018-01-26 | Cross-site scripting (XSS) vulnerability in Sophos PureMessage for UNIX before 6.3.2 allows remote attackers to inject arbitrary web script or HTML via unspeci… |
CVE-2016-10710 | High | 8.1 | 2018-01-25 | Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authentic… |
CVE-2016-5345 | High | 7.0 | 2018-01-23 | Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a crafted applicatio… |
CVE-2016-10709 | High | 8.8 | 2018-01-22 | pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, rela… |
CVE-2016-10708 | High | 7.5 | 2018-01-21 | sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS mess… |
CVE-2016-10707 | High | 7.5 | 2018-01-18 | jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased na… |
CVE-2016-6814 | Critical | 9.8 | 2018-01-18 | When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serializatio… |
CVE-2016-0219 | Medium | 6.5 | 2018-01-16 | XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15… |
CVE-2016-0215 | Medium | 6.5 | 2018-01-16 | IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon… |
CVE-2016-0207 | Medium | 5.4 | 2018-01-16 | IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors… |
CVE-2016-10706 | Medium | 6.1 | 2018-01-12 | The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link. |
CVE-2016-10705 | Medium | 6.1 | 2018-01-12 | The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module. |
CVE-2016-0336 | Medium | 5.4 | 2018-01-12 | Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows r… |
CVE-2016-0335 | High | 8.8 | 2018-01-12 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 a… |
CVE-2016-0332 | Critical | 9.8 | 2018-01-12 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, whic… |
CVE-2016-0327 | High | 7.8 | 2018-01-12 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges… |
CVE-2016-0324 | High | 8.8 | 2018-01-12 | IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitra… |
CVE-2016-9722 | Medium | 4.2 | 2018-01-10 | IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. I… |
CVE-2016-6810 | Medium | 6.1 | 2018-01-10 | In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console… |
CVE-2016-10257 | Medium | 6.1 | 2018-01-10 | The Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 (prior to 6.7.2.1), ProxySG 6.5 (prior to 6.5.10.6), ProxySG 6.6, and ProxySG 6.7 (prior to 6.7.2.1) ma… |
CVE-2016-10256 | Medium | 6.1 | 2018-01-10 | The Symantec ProxySG 6.5 (prior to 6.5.10.6), 6.6, and 6.7 (prior to 6.7.2.1) management console is susceptible to a reflected XSS vulnerability. A remote atta… |
CVE-2016-10704 | Medium | 6.1 | 2017-12-30 | Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview, aka A… |
CVE-2016-3695 | Medium | 5.5 | 2017-12-29 | The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial o… |
CVE-2016-6914 | High | 7.8 | 2017-12-27 | Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Tr… |
CVE-2016-10703 | High | 7.5 | 2017-12-14 | A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attac… |
CVE-2016-6904 | High | 8.1 | 2017-12-11 | Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthentica… |
CVE-2016-5713 | Critical | 9.8 | 2017-12-06 | Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet run… |
CVE-2016-1255 | High | 7.8 | 2017-12-05 | The pg_ctlcluster script in postgresql-common package in Debian wheezy before 134wheezy5, in Debian jessie before 165+deb8u2, in Debian unstable before 178, in… |
CVE-2016-1254 | High | 7.5 | 2017-12-05 | Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor. |
CVE-2016-1253 | Critical | 9.8 | 2017-12-05 | The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers… |
CVE-2016-1252 | Medium | 5.9 | 2017-12-05 | The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before… |
CVE-2016-10702 | Medium | 6.1 | 2017-11-28 | Pebble Smartwatch devices through 4.3 mishandle UUID storage, which allows attackers to read an arbitrary application's flash storage, and access an arbitrary… |
CVE-2016-10701 | High | 8.8 | 2017-11-28 | In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists in the Business Analytics application. |
CVE-2016-6024 | Medium | 4.3 | 2017-11-27 | IBM Jazz technology based products might divulge information that might be useful in helping attackers through error messages. IBM X-Force ID: 116868. |
CVE-2016-10700 | High | 8.8 | 2017-11-24 | auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a use… |
CVE-2016-6804 | High | 7.8 | 2017-11-20 | The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows exec… |
CVE-2016-8610 | High | 7.5 | 2017-11-13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets… |
CVE-2016-6803 | High | 7.8 | 2017-11-13 | An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must ha… |