2016 CVEs (page 14)
Page 14 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0872 | Critical | 9.8 | 2017-11-07 | A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in p… |
CVE-2016-3048 | Medium | 5.4 | 2017-11-01 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2016-10699 | Medium | 6.1 | 2017-10-31 | D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logi… |
CVE-2016-3090 | High | 8.8 | 2017-10-30 | The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression… |
CVE-2016-5003 | Critical | 9.8 | 2017-10-27 | The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java ob… |
CVE-2016-5002 | High | 7.8 | 2017-10-27 | XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct serv… |
CVE-2016-3049 | Medium | 5.4 | 2017-10-24 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be e… |
CVE-2016-10517 | High | 7.4 | 2017-10-24 | networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis prot… |
CVE-2016-10516 | Medium | 6.1 | 2017-10-23 | Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets… |
CVE-2016-8748 | Medium | 5.4 | 2017-10-19 | In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized u… |
CVE-2016-5714 | High | 7.2 | 2017-10-18 | Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechan… |
CVE-2016-10515 | Medium | 6.1 | 2017-10-18 | In Redmine before 3.2.3, there are stored XSS vulnerabilities affecting Textile and Markdown text formatting, and project homepages. |
CVE-2016-4461 | High | 8.8 | 2017-10-16 | Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation… |
CVE-2016-8734 | Medium | 6.5 | 2017-10-16 | Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by… |
CVE-2016-4925 | High | 7.5 | 2017-10-13 | Receipt of a specifically malformed IPv6 packet processed by the router may trigger a line card reset: processor exception 0x68616c74 (halt) in task: scheduler… |
CVE-2016-4924 | High | 8.4 | 2017-10-13 | An incorrect permissions vulnerability in Juniper Networks Junos OS on vMX may allow local unprivileged users on a host system read access to vMX or vPFE image… |
CVE-2016-4923 | High | 8.0 | 2017-10-13 | Insufficient cross site scripting protection in J-Web component in Juniper Networks Junos OS may potentially allow a remote unauthenticated user to inject web… |
CVE-2016-4922 | High | 8.4 | 2017-10-13 | Certain combinations of Junos OS CLI commands and arguments have been found to be exploitable in a way that can allow unauthorized access to the operating syst… |
CVE-2016-4921 | High | 7.5 | 2017-10-13 | By flooding a Juniper Networks router running Junos OS with specially crafted IPv6 traffic, all available resources can be consumed, leading to the inability t… |
CVE-2016-1265 | Critical | 9.8 | 2017-10-13 | A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos… |
CVE-2016-1261 | High | 7.1 | 2017-10-13 | J-Web does not validate certain input that may lead to cross-site request forgery (CSRF) issues or cause a denial of J-Web service (DoS). |
CVE-2016-6815 | Medium | 6.5 | 2017-10-13 | In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role. |
CVE-2016-5791 | Critical | 9.8 | 2017-10-13 | An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell… |
CVE-2016-5789 | High | 8.0 | 2017-10-13 | A Cross-site Request Forgery issue was discovered in JanTek JTC-200, all versions. An attacker could perform actions with the same permissions as a victim user… |
CVE-2016-8736 | Critical | 9.8 | 2017-10-12 | Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. |
CVE-2016-9263 | Medium | 4.7 | 2017-10-12 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF)… |
CVE-2016-10514 | Medium | 6.5 | 2017-10-10 | url_check_format in include/functions.inc.php in Piwigo before 2.8.3 allows remote attackers to bypass intended access restrictions via a URL that contains a "… |
CVE-2016-10513 | Medium | 6.1 | 2017-10-10 | Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php. |
CVE-2016-8937 | Critical | 9.8 | 2017-10-05 | The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too m… |
CVE-2016-6806 | High | 8.8 | 2017-10-03 | Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitiga… |
CVE-2016-4434 | High | 7.8 | 2017-09-30 | Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE)… |
CVE-2016-10512 | Critical | 9.8 | 2017-09-30 | MultiTech FaxFinder before 4.1.2 stores Passwords unencrypted for maintaining the test connectivity function of its LDAP configuration. These credentials are r… |
CVE-2016-5868 | High | 7.0 | 2017-09-25 | drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application c… |
CVE-2016-8738 | Medium | 5.9 | 2017-09-20 | In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a… |
CVE-2016-6795 | Critical | 9.8 | 2017-09-20 | In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path trav… |
CVE-2016-10511 | Medium | 5.9 | 2017-09-18 | The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitti… |
CVE-2016-8744 | High | 8.8 | 2017-09-13 | Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a… |
CVE-2016-8737 | High | 8.8 | 2017-09-13 | In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link… |
CVE-2016-5759 | High | 7.8 | 2017-09-08 | The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root. |
CVE-2016-10405 | Critical | 9.8 | 2017-09-07 | Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecif… |
CVE-2016-0732 | High | 8.8 | 2017-09-07 | The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple… |
CVE-2016-3086 | Critical | 9.8 | 2017-09-05 | The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to… |
CVE-2016-1895 | Medium | 6.5 | 2017-09-01 | NetApp Data ONTAP before 8.2.5 and 8.3.x before 8.3.2P12 allow remote authenticated users to cause a denial of service via vectors related to unsafe user input… |
CVE-2016-5795 | High | 7.3 | 2017-08-31 | An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-V… |
CVE-2016-10510 | Medium | 6.1 | 2017-08-31 | Cross-site scripting (XSS) vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by byp… |
CVE-2016-10509 | High | 7.2 | 2017-08-31 | SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote… |
CVE-2016-10508 | Medium | 6.1 | 2017-08-31 | Multiple cross-site scripting (XSS) vulnerabilities in phpThumb() before 1.7.14 allow remote attackers to inject arbitrary web script or HTML via parameters in… |
CVE-2016-0713 | Medium | 4.7 | 2017-08-31 | Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to… |
CVE-2016-5001 | Medium | 5.5 | 2017-08-30 | This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user o… |
CVE-2016-6800 | Medium | 6.1 | 2017-08-30 | The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific pa… |
CVE-2016-4462 | High | 8.8 | 2017-08-30 | By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflecte… |
CVE-2016-10507 | Medium | 6.5 | 2017-08-30 | Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap… |
CVE-2016-10506 | Medium | 6.5 | 2017-08-30 | Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attack… |
CVE-2016-10505 | Medium | 6.5 | 2017-08-30 | NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, a… |
CVE-2016-10504 | Medium | 6.5 | 2017-08-30 | Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service… |
CVE-2016-2980 | Medium | 6.3 | 2017-08-29 | The Sametime WebPlayer 8.5.2 and 9.0 is vulnerable to a script injection where a malicious site can inject their own script by exploiting a vulnerability in th… |
CVE-2016-2978 | Low | 3.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could store potentially sensitive information from the browser cache locally that could be available to a local user. IBM X-Force ID… |
CVE-2016-2976 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting invitee to obtain previously cleared sensitive information by viewing the meeting report histor… |
CVE-2016-2975 | Medium | 5.4 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… |
CVE-2016-2974 | Low | 3.3 | 2017-08-29 | IBM Sametime Connect 8.5.2 and 9.0, after uninstalling the Sametime Rich Client, could disclose potentially sensitive information related to the Sametime envir… |
CVE-2016-2967 | Medium | 5.4 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Sametime away messa… |
CVE-2016-2966 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.1 and 9.0 could allow an authenticated user to enumerate meeting rooms by guessing the meeting room id. IBM X-Force ID: 113847. |
CVE-2016-2964 | Medium | 5.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 under certain conditions provides an error message to a user that is too detailed and may reveal details about the application. IBM… |
CVE-2016-0358 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM… |
CVE-2016-8752 | High | 7.5 | 2017-08-29 | Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js… |
CVE-2016-2979 | Medium | 5.4 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2977 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a malicious user to lower other users hands in the meeting. IBM X-Force ID: 113937. |
CVE-2016-2973 | Medium | 5.4 | 2017-08-29 | IBM Sametime Media Services 8.5.2 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2972 | High | 7.8 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could store credentials of the Sametime Meetings user in the local cache of their browser which could be accessed by… |
CVE-2016-2971 | Medium | 5.3 | 2017-08-29 | IBM Sametime Media Services 8.5.2 and 9.0 can disclose sensitive information in stack trace error logs that could aid an attacker in future attacks. IBM X-Forc… |
CVE-2016-2969 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850. |
CVE-2016-2965 | Medium | 6.5 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a us… |
CVE-2016-2959 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow a meeting room manager to remove the primary managers privileges. IBM X-Force ID: 113804. |
CVE-2016-10503 | Medium | 4.3 | 2017-08-29 | IBM Sametime Meeting Server 8.5.2 and 9.0 could allow an authenticated and invited user of Sametime meeting to lower any or all hands in an e-meeting, thus spo… |
CVE-2016-0356 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0355 | Medium | 6.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sh… |
CVE-2016-0354 | Medium | 5.5 | 2017-08-29 | IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be dow… |
CVE-2016-9732 | Medium | 5.4 | 2017-08-29 | IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2016-2970 | Medium | 4.3 | 2017-08-29 | IBM Sametime 8.5 and 9.0 meetings server may provide detailed information in an error message that may provide details about the application to possible attack… |
CVE-2016-7030 | High | 7.5 | 2017-08-28 | FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of s… |
CVE-2016-0634 | High | 7.5 | 2017-08-28 | The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname… |
CVE-2016-5816 | High | 7.5 | 2017-08-25 | A Use of Hard-Coded Cryptographic Key issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5… |
CVE-2016-6311 | Medium | 5.3 | 2017-08-22 | Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers. |
CVE-2016-6310 | Medium | 5.5 | 2017-08-22 | oVirt Engine discloses the ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0. |
CVE-2016-4460 | Critical | 9.8 | 2017-08-22 | Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. |
CVE-2016-2102 | Medium | 5.3 | 2017-08-22 | HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. |
CVE-2016-5872 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validated. |
CVE-2016-5871 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an ima… |
CVE-2016-10392 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a driver can potentially leak kernel memory. |
CVE-2016-10391 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for validity. |
CVE-2016-10390 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, when downloading a file, an excessive amount of memory may be consumed. |
CVE-2016-10389 | High | 7.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in the… |
CVE-2016-10388 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a configuration vulnerability exists when loading a 3rd-party QTEE application. |
CVE-2016-10387 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a handover scenario. |
CVE-2016-10386 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an array index out of bounds vulnerability exists in LPP. |
CVE-2016-10385 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, a use-after-free vulnerability exists in IMS RCS. |
CVE-2016-10384 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a WLAN driver ioctl. |
CVE-2016-10383 | High | 8.1 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, there is a TOCTOU race condition in Secure UI. |
CVE-2016-10382 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, access control to the I2C bus is not sufficient. |
CVE-2016-10381 | Critical | 9.8 | 2017-08-18 | In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send unprotected MeasurementReports revealing UE location. |