2016 CVEs (page 2)
Page 2 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-15036 | Medium | 4.6 | 2023-12-23 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Deis Workflow Manager up to 2.3.2. It has been classified as problematic. This affects an unknown… |
CVE-2016-1203 | High | 8.1 | 2023-10-31 | Improper file verification vulnerability in SaAT Netizen installer ver.1.2.0.424 and earlier, and SaAT Netizen ver.1.2.0.8 (Build427) and earlier allows a remo… |
CVE-2016-15035 | Low | 3.5 | 2023-08-28 | A vulnerability was found in Doc2k RE-Chat 1.0. It has been classified as problematic. This affects an unknown part of the file js_on_radio-emergency.de_/re_ch… |
CVE-2016-15034 | Medium | 5.5 | 2023-07-10 | A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_searc… |
CVE-2016-15033 | Critical | 9.8 | 2023-06-07 | The Delete All Comments plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the via the delete-all-comments.php… |
CVE-2016-15032 | Low | 3.5 | 2023-06-02 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the… |
CVE-2016-15031 | High | 7.3 | 2023-05-06 | A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/clas… |
CVE-2016-15030 | Low | 3.5 | 2023-03-25 | A vulnerability classified as problematic has been found in Arno0x TwoFactorAuth. This affects an unknown part of the file login/login.php. The manipulation of… |
CVE-2016-15029 | Low | 3.5 | 2023-03-21 | A vulnerability has been found in Ydalb mapicoin up to 1.9.0 and classified as problematic. This vulnerability affects unknown code of the file webroot/stats.p… |
CVE-2016-15028 | Medium | 4.8 | 2023-03-12 | A vulnerability was found in ICEPAY REST-API-NET 0.9. It has been declared as problematic. Affected by this vulnerability is the function RestClient of the fil… |
CVE-2016-15027 | Low | 3.5 | 2023-02-20 | A vulnerability was found in meta4creations Post Duplicator Plugin 2.18 on WordPress. It has been classified as problematic. Affected is the function mtphr_pos… |
CVE-2016-15026 | Medium | 5.3 | 2023-02-20 | A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads… |
CVE-2016-15025 | Low | 3.5 | 2023-02-20 | A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/ser… |
CVE-2016-15024 | Low | 2.5 | 2023-02-19 | A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of serv… |
CVE-2016-15023 | Low | 3.5 | 2023-01-31 | A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getexten… |
CVE-2016-15022 | Low | 2.0 | 2023-01-29 | A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2016-15021 | Medium | 5.5 | 2023-01-17 | A vulnerability was found in nickzren alsdb. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection… |
CVE-2016-15020 | Medium | 5.5 | 2023-01-16 | A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/… |
CVE-2016-15019 | Medium | 4.3 | 2023-01-15 | A vulnerability was found in tombh jekbox. It has been rated as problematic. This issue affects some unknown processing of the file lib/server.rb. The manipula… |
CVE-2016-15018 | Medium | 5.5 | 2023-01-15 | A vulnerability was found in krail-jpa up to 0.9.1. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection… |
CVE-2016-15017 | Medium | 5.5 | 2023-01-10 | A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the… |
CVE-2016-15016 | Medium | 5.5 | 2023-01-08 | A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the f… |
CVE-2016-15015 | Low | 2.6 | 2023-01-08 | A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of… |
CVE-2016-15014 | Low | 3.3 | 2023-01-07 | A vulnerability has been found in CESNET theme-cesnet up to 1.x on ownCloud and classified as problematic. Affected by this vulnerability is an unknown functio… |
CVE-2016-15013 | Medium | 5.5 | 2023-01-07 | A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/lis… |
CVE-2016-15012 | Medium | 5.5 | 2023-01-07 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affec… |
CVE-2016-15011 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the fil… |
CVE-2016-15010 | Low | 3.5 | 2023-01-05 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in University of Cambridge django-ucamlookup up to 1.9.1. Affected by this… |
CVE-2016-15009 | Low | 3.5 | 2023-01-05 | A vulnerability classified as problematic has been found in OpenACS bug-tracker. Affected is an unknown function of the file lib/nav-bar.adp of the component S… |
CVE-2016-15008 | Low | 3.5 | 2023-01-04 | A vulnerability was found in oxguy3 coebot-www and classified as problematic. This issue affects the function displayChannelCommands/displayChannelQuotes/displ… |
CVE-2016-15007 | Medium | 5.5 | 2023-01-02 | A vulnerability was found in Centralized-Salesforce-Dev-Framework. It has been declared as problematic. Affected by this vulnerability is the function SObjectS… |
CVE-2016-15006 | Low | 3.7 | 2023-01-02 | A vulnerability, which was classified as problematic, has been found in enigmaX up to 2.2. This issue affects the function getSeed of the file main.c of the co… |
CVE-2016-15005 | High | 8.8 | 2022-12-27 | CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass C… |
CVE-2016-20018 | High | 7.5 | 2022-12-19 | Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. |
CVE-2016-20017 | Critical | 9.8 | 2022-10-19 | D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2… |
CVE-2016-20016 | Critical | 9.8 | 2022-10-19 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated att… |
CVE-2016-2338 | Critical | 9.8 | 2022-09-29 | An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer… |
CVE-2016-20015 | High | 7.5 | 2022-09-20 | In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any file, allowing for… |
CVE-2016-3098 | Medium | 5.4 | 2022-08-05 | Cross-site request forgery (CSRF) vulnerability in administrate 0.1.4 and earlier allows remote attackers to hijack the user's OAuth autorization code. |
CVE-2016-4991 | Critical | 9.8 | 2022-07-28 | Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode… |
CVE-2016-4427 | High | 7.5 | 2022-07-28 | In zulip before 1.3.12, deactivated users could access messages if SSO was enabled. |
CVE-2016-4426 | Medium | 4.3 | 2022-07-28 | In zulip before 1.3.12, bot API keys were accessible to other users in the same realm. |
CVE-2016-3709 | Medium | 6.1 | 2022-07-28 | Possible cross-site scripting vulnerability in libxml after commit 960f0e2. |
CVE-2016-0796 | High | 7.5 | 2022-07-28 | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and security bypass vul… |
CVE-2016-2139 | Medium | 6.4 | 2022-07-28 | In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.class.php. |
CVE-2016-2138 | Medium | 6.4 | 2022-07-28 | In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.class.php. |
CVE-2016-15004 | High | 7.3 | 2022-07-23 | A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionali… |
CVE-2016-15003 | Medium | 6.3 | 2022-07-18 | A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files… |
CVE-2016-15002 | High | 7.3 | 2022-06-09 | A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipul… |
CVE-2016-20014 | Critical | 9.8 | 2022-04-21 | In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure. |
CVE-2016-1239 | Critical | 9.8 | 2022-02-19 | duck before 0.10 did not properly handle loading of untrusted code from the current directory. |
CVE-2016-20013 | High | 7.5 | 2022-02-19 | sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the s… |
CVE-2016-2124 | Medium | 5.9 | 2022-02-18 | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even i… |
CVE-2016-3735 | High | 8.1 | 2022-01-28 | Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset toke… |
CVE-2016-6556 | High | 7.1 | 2021-09-24 | OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP '… |
CVE-2016-6555 | High | 7.1 | 2021-09-24 | OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP tr… |
CVE-2016-20012 | Medium | 5.3 | 2021-09-15 | OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whet… |
CVE-2016-20011 | High | 7.5 | 2021-05-25 | libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds witho… |
CVE-2016-20010 | Critical | 10.0 | 2021-05-05 | EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PH… |
CVE-2016-20009 | Critical | 9.8 | 2021-03-11 | A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that… |
CVE-2016-20005 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advis… |
CVE-2016-20004 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory p… |
CVE-2016-20003 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory poli… |
CVE-2016-20002 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2016-20001 | Critical | 9.8 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory po… |
CVE-2016-20008 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory p… |
CVE-2016-20007 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory… |
CVE-2016-20006 | High | 7.5 | 2021-01-01 | The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security adviso… |
CVE-2016-9026 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. |
CVE-2016-9025 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. |
CVE-2016-9023 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. |
CVE-2016-9022 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. |
CVE-2016-9021 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. |
CVE-2016-11086 | High | 7.4 | 2020-09-24 | lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which all… |
CVE-2016-11085 | Medium | 6.5 | 2020-08-16 | php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name param… |
CVE-2016-7064 | High | 7.5 | 2020-07-21 | A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage |
CVE-2016-7063 | Critical | 9.8 | 2020-07-21 | A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation. |
CVE-2016-11084 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. |
CVE-2016-11083 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. |
CVE-2016-11082 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. |
CVE-2016-11081 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. |
CVE-2016-11080 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. |
CVE-2016-11079 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. |
CVE-2016-11078 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.jso… |
CVE-2016-11077 | Low | 2.7 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of… |
CVE-2016-11076 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. |
CVE-2016-11075 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. |
CVE-2016-11074 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. |
CVE-2016-11073 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. |
CVE-2016-11072 | Medium | 6.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. |
CVE-2016-11071 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. |
CVE-2016-11070 | Medium | 5.4 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values. |
CVE-2016-11069 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. |
CVE-2016-11068 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. |
CVE-2016-11067 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. |
CVE-2016-11066 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. |
CVE-2016-11065 | Medium | 4.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appe… |
CVE-2016-11064 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection. |
CVE-2016-11063 | Medium | 6.1 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. |
CVE-2016-11062 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed. |