2016 CVEs (page 19)
Page 19 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-3114 | Medium | 6.5 | 2017-04-24 | Kallithea before 0.3.2 allows remote authenticated users to edit or delete open pull requests or delete comments by leveraging read access. |
CVE-2016-3076 | Medium | 5.5 | 2017-04-24 | Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service (memory corrupti… |
CVE-2016-2564 | Medium | 5.9 | 2017-04-23 | Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Att… |
CVE-2016-9954 | High | 7.5 | 2017-04-21 | The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a denial of service… |
CVE-2016-5399 | High | 7.8 | 2017-04-21 | The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-… |
CVE-2016-5168 | High | 7.5 | 2017-04-21 | Skia, as used in Google Chrome before 50.0.2661.94, allows remote attackers to bypass the Same Origin Policy and obtain sensitive information. |
CVE-2016-3702 | Medium | 5.3 | 2017-04-21 | Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information. |
CVE-2016-3109 | Critical | 9.8 | 2017-04-21 | The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. |
CVE-2016-3067 | Critical | 9.8 | 2017-04-21 | Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges. |
CVE-2016-2433 | High | 8.8 | 2017-04-21 | The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context… |
CVE-2016-2347 | High | 7.8 | 2017-04-21 | Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a c… |
CVE-2016-2173 | Critical | 9.8 | 2017-04-21 | org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. |
CVE-2016-1561 | High | 7.5 | 2017-04-21 | ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH… |
CVE-2016-1560 | Critical | 9.8 | 2017-04-21 | ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in… |
CVE-2016-1520 | High | 7.8 | 2017-04-21 | The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers… |
CVE-2016-1519 | Medium | 5.9 | 2017-04-21 | The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-… |
CVE-2016-1518 | High | 8.1 | 2017-04-21 | The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers… |
CVE-2016-1221 | Medium | 5.9 | 2017-04-21 | Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2016-1210 | Medium | 5.9 | 2017-04-21 | The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof… |
CVE-2016-1198 | Medium | 5.9 | 2017-04-21 | Photopt for Android before 2.0.1 does not verify SSL certificates. |
CVE-2016-1187 | Medium | 6.8 | 2017-04-21 | Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates. |
CVE-2016-1186 | Medium | 5.9 | 2017-04-21 | Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates. |
CVE-2016-6519 | Medium | 5.4 | 2017-04-21 | Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web sc… |
CVE-2016-1559 | High | 8.1 | 2017-04-21 | D-Link DAP-1353 H/W vers. B1 3.15 and earlier, D-Link DAP-2553 H/W ver. A1 1.31 and earlier, and D-Link DAP-3520 H/W ver. A1 1.16 and earlier reveal wireless p… |
CVE-2016-1558 | Critical | 9.8 | 2017-04-21 | Buffer overflow in D-Link DAP-2310 2.06 and earlier, DAP-2330 1.06 and earlier, DAP-2360 2.06 and earlier, DAP-2553 H/W ver. B1 3.05 and earlier, DAP-2660 1.11… |
CVE-2016-1557 | Critical | 9.8 | 2017-04-21 | Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. |
CVE-2016-1556 | High | 7.5 | 2017-04-21 | Information disclosure in Netgear WN604 before 3.3.3; WNAP210, WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0; and WND930 before 2.0.11 allows remote attackers… |
CVE-2016-1555 | Critical | 9.8 | 2017-04-21 | (1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP2… |
CVE-2016-10091 | High | 7.5 | 2017-04-21 | Multiple stack-based buffer overflows in unrtf 0.21.9 allow remote attackers to cause a denial-of-service by writing a negative integer to the (1) cmd_expand f… |
CVE-2016-0721 | High | 8.1 | 2017-04-21 | Session fixation vulnerability in pcsd in pcs before 0.9.157. |
CVE-2016-0720 | High | 8.8 | 2017-04-21 | Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149. |
CVE-2016-4846 | High | 7.8 | 2017-04-21 | Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2. |
CVE-2016-4841 | Medium | 4.3 | 2017-04-21 | Cybozu Mailwise before 5.4.0 allows remote attackers to inject arbitrary email headers. |
CVE-2016-4840 | Medium | 5.9 | 2017-04-21 | Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates. |
CVE-2016-4832 | Medium | 5.9 | 2017-04-21 | WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates. |
CVE-2016-4830 | Medium | 5.9 | 2017-04-21 | Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates. |
CVE-2016-4829 | Medium | 5.9 | 2017-04-21 | DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates. |
CVE-2016-1194 | Medium | 6.5 | 2017-04-21 | Cybozu Garoon before 4.2.1 allows remote attackers to cause a denial of service. |
CVE-2016-1184 | Medium | 5.9 | 2017-04-21 | Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates. |
CVE-2016-1148 | High | 8.1 | 2017-04-21 | Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates. |
CVE-2016-0833 | High | 7.5 | 2017-04-21 | Android allows users to cause a denial of service. |
CVE-2016-4075 | Medium | 6.1 | 2017-04-21 | Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL. |
CVE-2016-6368 | High | 8.6 | 2017-04-20 | A vulnerability in the detection engine parsing of Pragmatic General Multicast (PGM) protocol packets for Cisco Firepower System Software could allow an unauth… |
CVE-2016-9980 | Medium | 5.4 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-9979 | Medium | 5.4 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-9978 | Medium | 4.3 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 could allow an authenticated attacker to disclose sensitive information. IBM X-Force ID: 120254. |
CVE-2016-8923 | Medium | 4.3 | 2017-04-20 | IBM Curam Social Program Management 5.2, 6.0, and 7.0 contains a vulnerability that would allow an authorized user to obtain sensitive information from the pro… |
CVE-2016-5401 | High | 8.8 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests tha… |
CVE-2016-3734 | High | 8.8 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and ear… |
CVE-2016-3733 | Medium | 4.3 | 2017-04-20 | The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated u… |
CVE-2016-3732 | Medium | 4.3 | 2017-04-20 | The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote a… |
CVE-2016-3731 | Medium | 5.3 | 2017-04-20 | Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions. |
CVE-2016-3729 | Medium | 6.5 | 2017-04-20 | The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to… |
CVE-2016-1161 | High | 8.0 | 2017-04-20 | Cross-site request forgery (CSRF) vulnerability in ManageEngine Password Manager Pro before 8.5 (Build 8500). |
CVE-2016-8721 | Critical | 9.1 | 2017-04-20 | An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware… |
CVE-2016-7540 | Medium | 6.5 | 2017-04-20 | coders/rgf.c in ImageMagick before 6.9.4-10 allows remote attackers to cause a denial of service (assertion failure) by converting an image to rgf format. |
CVE-2016-7538 | Medium | 6.5 | 2017-04-20 | coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. |
CVE-2016-7536 | Medium | 6.5 | 2017-04-20 | magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile. |
CVE-2016-7535 | Medium | 6.5 | 2017-04-20 | coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted PSD file. |
CVE-2016-7534 | Medium | 6.5 | 2017-04-20 | The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file. |
CVE-2016-7532 | Medium | 6.5 | 2017-04-20 | coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. |
CVE-2016-7530 | Medium | 6.5 | 2017-04-20 | The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file. |
CVE-2016-7527 | Medium | 6.5 | 2017-04-20 | coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. |
CVE-2016-7526 | Medium | 6.5 | 2017-04-20 | coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file. |
CVE-2016-7525 | Medium | 6.5 | 2017-04-20 | Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. |
CVE-2016-7521 | Medium | 6.5 | 2017-04-20 | Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file. |
CVE-2016-7520 | Medium | 6.5 | 2017-04-20 | Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file. |
CVE-2016-7518 | Medium | 6.5 | 2017-04-20 | The ReadSUNImage function in coders/sun.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted SUN file. |
CVE-2016-7517 | Medium | 6.5 | 2017-04-20 | The EncodeImage function in coders/pict.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PICT file. |
CVE-2016-7516 | Medium | 6.5 | 2017-04-20 | The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted VIFF file. |
CVE-2016-7514 | Medium | 6.5 | 2017-04-20 | The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD fi… |
CVE-2016-7513 | Medium | 6.5 | 2017-04-20 | Off-by-one error in magick/cache.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via unspecified vectors. |
CVE-2016-5010 | Medium | 6.5 | 2017-04-20 | coders/tiff.c in ImageMagick before 6.9.5-3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF file. |
CVE-2016-4862 | High | 8.8 | 2017-04-20 | Twigmo bundled with CS-Cart 4.3.9 and earlier and Twigmo bundled with CS-Cart Multi-Vendor 4.3.9 and earlier allow remote authenticated users to execute arbitr… |
CVE-2016-4850 | High | 8.1 | 2017-04-20 | LINE for Windows before 4.8.3 allows man-in-the-middle attackers to execute arbitrary code. |
CVE-2016-4844 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to conduct clickjacking attacks. |
CVE-2016-4843 | Medium | 6.5 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain sensitive cookie information. |
CVE-2016-4842 | Medium | 4.3 | 2017-04-20 | Cybozu Mailwise before 5.4.0 allows remote attackers to obtain information on when an email is read. |
CVE-2016-4818 | Medium | 5.9 | 2017-04-20 | DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verif… |
CVE-2016-1220 | Medium | 4.3 | 2017-04-20 | Cybozu Garoon before 4.2.2 does not properly restrict access. |
CVE-2016-1218 | High | 8.8 | 2017-04-20 | SQL injection vulnerability in Cybozu Garoon before 4.2.2. |
CVE-2016-1217 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1216 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1215 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1214 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2. |
CVE-2016-1213 | Medium | 6.1 | 2017-04-20 | The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites. |
CVE-2016-6347 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspec… |
CVE-2016-6341 | Medium | 5.5 | 2017-04-20 | oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password info… |
CVE-2016-6338 | Medium | 6.8 | 2017-04-20 | ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to b… |
CVE-2016-6337 | High | 7.5 | 2017-04-20 | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function a… |
CVE-2016-6336 | Medium | 6.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppres… |
CVE-2016-6335 | High | 7.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote atta… |
CVE-2016-6334 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27… |
CVE-2016-6333 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 al… |
CVE-2016-6332 | High | 7.5 | 2017-04-20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive… |
CVE-2016-6331 | High | 7.5 | 2017-04-20 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via… |
CVE-2016-5762 | Critical | 9.8 | 2017-04-20 | Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code… |
CVE-2016-5761 | Medium | 6.1 | 2017-04-20 | Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script o… |
CVE-2016-5760 | Medium | 6.1 | 2017-04-20 | Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote att… |
CVE-2016-5409 | High | 7.5 | 2017-04-20 | Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to o… |