2016 CVEs (page 16)
Page 16 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-7062 | High | 7.8 | 2017-06-27 | rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext. |
CVE-2016-6342 | High | 7.5 | 2017-06-27 | elog 3.1.1 allows remote attackers to post data as any username in the logbook. |
CVE-2016-5414 | High | 7.5 | 2017-06-27 | FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. |
CVE-2016-4383 | High | 8.4 | 2017-06-27 | The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause… |
CVE-2016-0959 | Critical | 9.8 | 2017-06-27 | Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flas… |
CVE-2016-9972 | Medium | 5.9 | 2017-06-27 | IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security… |
CVE-2016-9738 | High | 7.5 | 2017-06-27 | IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IB… |
CVE-2016-6083 | Medium | 5.3 | 2017-06-27 | IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. IBM X-Force ID: 117696. |
CVE-2016-8493 | High | 8.8 | 2017-06-26 | In FortiClientWindows 5.4.1 and 5.4.2, an attacker may escalate privilege via a FortiClientNamedPipe vulnerability. |
CVE-2016-5893 | Medium | 5.5 | 2017-06-23 | IBM Sterling B2B Integrator Standard Edition 5.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 115336. |
CVE-2016-9983 | Medium | 5.3 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user with special privileges to view files that they should not have access to. I… |
CVE-2016-9982 | Medium | 6.5 | 2017-06-22 | IBM Sterling B2B Integrator Standard Edition 5.2 could allow an authenticated user to obtain sensitive information such as account lists due to improper access… |
CVE-2016-9747 | Medium | 5.4 | 2017-06-22 | IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2016-7508 | High | 7.5 | 2017-06-21 | Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character whe… |
CVE-2016-8731 | Critical | 9.8 | 2017-06-21 | Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any camer… |
CVE-2016-10366 | Medium | 6.1 | 2017-06-16 | Kibana versions after and including 4.3 and before 4.6.2 are vulnerable to a cross-site scripting (XSS) attack. |
CVE-2016-10365 | Medium | 6.1 | 2017-06-16 | Kibana versions before 4.6.3 and 5.0.1 have an open redirect vulnerability that would enable an attacker to craft a link in the Kibana domain that redirects to… |
CVE-2016-10364 | Medium | 6.5 | 2017-06-16 | With X-Pack installed, Kibana versions 5.0.0 and 5.0.1 were not properly authenticating requests to advanced settings and the short URL service, any authentica… |
CVE-2016-10363 | High | 7.5 | 2017-06-16 | Logstash versions prior to 2.3.3, when using the Netflow Codec plugin, a remote attacker crafting malicious Netflow v5, Netflow v9 or IPFIX packets could perfo… |
CVE-2016-10362 | Medium | 6.5 | 2017-06-16 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. |
CVE-2016-1000222 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data. |
CVE-2016-1000221 | High | 7.5 | 2017-06-16 | Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. |
CVE-2016-1000220 | Medium | 6.1 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. |
CVE-2016-1000219 | High | 7.5 | 2017-06-16 | Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This inf… |
CVE-2016-1000218 | High | 8.8 | 2017-06-16 | Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authentica… |
CVE-2016-10395 | High | 7.8 | 2017-06-15 | In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error related to a named… |
CVE-2016-8751 | Medium | 4.8 | 2017-06-14 | Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javas… |
CVE-2016-8746 | Medium | 5.9 | 2017-06-14 | Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to t… |
CVE-2016-10342 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a syscall handler. |
CVE-2016-10341 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended. |
CVE-2016-10340 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, an integer underflow leading to buffer overflow vulnerability exists in a syscall handler. |
CVE-2016-10339 | High | 7.1 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore. |
CVE-2016-10338 | High | 7.8 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, there was an issue related to RPMB processing. |
CVE-2016-10337 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, some validation of secure applications was not being performed. |
CVE-2016-10336 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, some regions of memory were not protected during boot. |
CVE-2016-10335 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. |
CVE-2016-10334 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. |
CVE-2016-10333 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. |
CVE-2016-10332 | Medium | 5.5 | 2017-06-13 | In all Android releases from CAF using the Linux kernel, stack protection was not enabled for secure applications. |
CVE-2016-9984 | High | 8.8 | 2017-06-13 | IBM Maximo Asset Management 7.5 and 7.6 could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. IBM X-Force I… |
CVE-2016-9973 | Medium | 5.4 | 2017-06-13 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-5391 | High | 7.5 | 2017-06-13 | libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart). |
CVE-2016-3704 | High | 7.5 | 2017-06-13 | Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords. |
CVE-2016-5411 | Critical | 9.8 | 2017-06-13 | /var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root passw… |
CVE-2016-3696 | Medium | 5.5 | 2017-06-13 | The pulp-qpid-ssl-cfg script in Pulp before 2.8.5 allows local users to obtain the CA key. |
CVE-2016-8219 | Medium | 6.5 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor ro… |
CVE-2016-8218 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic i… |
CVE-2016-6655 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injectio… |
CVE-2016-7838 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially crafted executable… |
CVE-2016-7837 | High | 7.8 | 2017-06-09 | Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland utilities. |
CVE-2016-7836 | Critical | 9.8 | 2017-06-09 | SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management con… |
CVE-2016-7835 | Critical | 9.1 | 2017-06-09 | Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other inf… |
CVE-2016-7833 | High | 7.5 | 2017-06-09 | Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary format) file via unspeci… |
CVE-2016-7832 | Medium | 5.3 | 2017-06-09 | Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to obtain an arbitrary DBM (Cybozu Dezie proprietary format) file via unspeci… |
CVE-2016-7831 | Medium | 6.1 | 2017-06-09 | Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to spoof the URL displa… |
CVE-2016-7830 | High | 8.8 | 2017-06-09 | Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices with firmware versi… |
CVE-2016-7826 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files v… |
CVE-2016-7825 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files v… |
CVE-2016-7824 | High | 8.8 | 2017-06-09 | Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the debug option via uns… |
CVE-2016-7823 | Medium | 4.3 | 2017-06-09 | Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to inject arbitrary web… |
CVE-2016-7822 | High | 8.8 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers to hijack the auth… |
CVE-2016-7821 | Medium | 6.5 | 2017-06-09 | Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the management screen via unspeci… |
CVE-2016-7820 | High | 7.2 | 2017-06-09 | Buffer overflow in I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with admini… |
CVE-2016-7819 | High | 7.2 | 2017-06-09 | I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to e… |
CVE-2016-7818 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in Installers for Specification check program (social insurance) Ver. 9.00 and earlier, TODOKESHO print program Ver. 5.00 a… |
CVE-2016-7817 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in Simple keitai chat 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2016-7816 | Medium | 5.9 | 2017-06-09 | The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-7814 | High | 7.5 | 2017-06-09 | I-O DATA DEVICE TS-WRLP firmware version 1.00.01 and earlier and TS-WRLA firmware version 1.00.01 and earlier allow remote attackers to obtain authentication c… |
CVE-2016-7813 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in DERAEMON-CMS version 0.8.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the parameters… |
CVE-2016-7811 | High | 8.8 | 2017-06-09 | Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows an attacker on the same network segment to bypass access restriction to perform arbitrary operations v… |
CVE-2016-7810 | Medium | 4.8 | 2017-06-09 | Cross-site scripting vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows attacker with administrator rights to inject arbitrary web scrip… |
CVE-2016-7809 | High | 8.8 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Corega CG-WLR300NX firmware Ver. 1.20 and earlier allows remote attackers to hijack the authentication of lo… |
CVE-2016-7808 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in Corega CG-WLBARGMH and CG-WLBARGNL allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2016-7807 | High | 7.5 | 2017-06-09 | I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to bypass access restriction to access data on storage devices inserted into… |
CVE-2016-7806 | Critical | 9.8 | 2017-06-09 | I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2016-7805 | Medium | 5.9 | 2017-06-09 | The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers… |
CVE-2016-7803 | High | 8.8 | 2017-06-09 | SQL injection vulnerability in the Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via "MultiReport" funct… |
CVE-2016-7802 | Medium | 6.5 | 2017-06-09 | Directory traversal vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to read arbitrary files via unspecified vectors. |
CVE-2016-7801 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to bypass access restrictions to delete other users' To-Dos via unspecified vectors. |
CVE-2016-4910 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to delete other operational administrators' MultiReport filters… |
CVE-2016-4909 | Medium | 4.3 | 2017-06-09 | Cross-site request forgery (CSRF) vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to hijack the authentication of a logged in user to for… |
CVE-2016-4908 | Medium | 4.3 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allows remote authenticated attackers to bypass access restriction to alter or delete another user's private RSS settings via unsp… |
CVE-2016-4907 | High | 8.8 | 2017-06-09 | Cybozu Garoon 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors. |
CVE-2016-4906 | Medium | 6.1 | 2017-06-09 | Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.2.2 allows remote attackers to inject arbitrary web script or HTML via "Messages" function of Cy… |
CVE-2016-4902 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earli… |
CVE-2016-7469 | Medium | 5.4 | 2017-06-09 | A stored cross-site scripting (XSS) vulnerability in the Configuration utility device name change page in BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge… |
CVE-2016-9991 | High | 8.0 | 2017-06-08 | IBM Sterling Order Management 9.2 through 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized a… |
CVE-2016-9736 | Medium | 5.3 | 2017-06-08 | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. |
CVE-2016-9698 | High | 8.1 | 2017-06-08 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remo… |
CVE-2016-8987 | Medium | 4.3 | 2017-06-08 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow an authenticated user to view incorrect item sets that they should not have access to view. |
CVE-2016-6098 | High | 8.1 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or mo… |
CVE-2016-6093 | Critical | 9.8 | 2017-06-08 | IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user ac… |
CVE-2016-6594 | High | 7.5 | 2017-06-08 | Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, ProxySG 6.5 and 6.6 allows remote attackers to bypass blocked requests, user authentication, and payload… |
CVE-2016-5648 | Medium | 5.3 | 2017-06-08 | Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack… |
CVE-2016-4473 | Critical | 9.8 | 2017-06-08 | /ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-68… |
CVE-2016-7050 | Critical | 9.8 | 2017-06-08 | SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Ent… |
CVE-2016-5416 | High | 7.5 | 2017-06-08 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through… |
CVE-2016-5405 | Critical | 9.8 | 2017-06-08 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through… |
CVE-2016-4992 | High | 7.5 | 2017-06-08 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through… |
CVE-2016-3099 | High | 7.5 | 2017-06-08 | mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation… |