2016 CVEs (page 24)
Page 24 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5754 | High | 7.5 | 2017-03-23 | Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. |
CVE-2016-5752 | High | 7.5 | 2017-03-23 | The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly… |
CVE-2016-5751 | Medium | 6.1 | 2017-03-23 | An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be… |
CVE-2016-5750 | High | 8.8 | 2017-03-23 | The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would… |
CVE-2016-5749 | Medium | 5.5 | 2017-03-23 | NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to… |
CVE-2016-5748 | Medium | 5.5 | 2017-03-23 | External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be… |
CVE-2016-5747 | High | 7.5 | 2017-03-23 | A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intend… |
CVE-2016-1603 | Medium | 6.5 | 2017-03-23 | An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users. |
CVE-2016-1602 | High | 7.8 | 2017-03-23 | A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 a… |
CVE-2016-1597 | High | 8.8 | 2017-03-23 | A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator. |
CVE-2016-6650 | High | 7.5 | 2017-03-21 | EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Stripping Vulnerability that may potentially… |
CVE-2016-4504 | High | 8.8 | 2017-03-21 | A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, Pro all versions, and Pro Unlimited all v… |
CVE-2016-4931 | Medium | 6.5 | 2017-03-20 | XML entity injection in Junos Space before 15.2R2 allows attackers to cause a denial of service. |
CVE-2016-4930 | Medium | 6.1 | 2017-03-20 | Cross-site scripting (XSS) vulnerability in Junos Space before 15.2R2 allows remote attackers to steal sensitive information or perform certain administrative… |
CVE-2016-4929 | High | 8.8 | 2017-03-20 | Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user. |
CVE-2016-4928 | High | 8.8 | 2017-03-20 | Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space. |
CVE-2016-4927 | High | 8.1 | 2017-03-20 | Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with man… |
CVE-2016-4926 | Critical | 9.8 | 2017-03-20 | Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform ce… |
CVE-2016-6816 | High | 7.1 | 2017-03-20 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line pe… |
CVE-2016-9697 | Low | 3.1 | 2017-03-20 | An unspecified vulnerability in IBM Rhapsody DM 4.0, 5.0, and 6.0 could allow an attacker to perform a JSON Hijacking Attack. A JSON Hijacking Attack may expos… |
CVE-2016-9696 | Medium | 5.4 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in… |
CVE-2016-9694 | Medium | 5.4 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus… |
CVE-2016-9165 | High | 7.5 | 2017-03-20 | The get_sessions servlet in CA Unified Infrastructure Management (formerly CA Nimsoft Monitor) before 8.5 and CA Unified Infrastructure Management Snap (former… |
CVE-2016-8973 | Medium | 4.3 | 2017-03-20 | IBM Rhapsody DM 4.0, 5.0 and 6.0 contains an undisclosed vulnerability that may allow an authenticated user to upload infected malicious files to the server. I… |
CVE-2016-5857 | High | 7.8 | 2017-03-20 | The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application, aka An… |
CVE-2016-2981 | Medium | 6.8 | 2017-03-20 | An undisclosed vulnerability in the CLM applications in IBM Jazz Team Server may allow unauthorized access to user credentials. IBM Reference #: 1999965. |
CVE-2016-2406 | Medium | 4.3 | 2017-03-20 | The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive i… |
CVE-2016-10214 | Medium | 6.5 | 2017-03-20 | Memory leak in the virgl_resource_attach_backing function in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (memory consum… |
CVE-2016-8855 | Medium | 6.1 | 2017-03-19 | Cross-Site Scripting (XSS) in "/sitecore/client/Applications/List Manager/Taskpages/Contact list" in Sitecore Experience Platform 8.1 rev. 160519 (8.1 Update-3… |
CVE-2016-10253 | Critical | 9.8 | 2017-03-18 | An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a m… |
CVE-2016-10187 | Medium | 5.5 | 2017-03-16 | The E-book viewer in calibre before 2.75 allows remote attackers to read arbitrary files via a crafted epub file with JavaScript. |
CVE-2016-0770 | Medium | 6.1 | 2017-03-16 | Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remo… |
CVE-2016-10247 | Medium | 5.5 | 2017-03-16 | Buffer overflow in the my_getline function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial o… |
CVE-2016-10246 | Medium | 5.5 | 2017-03-16 | Buffer overflow in the main function in jstest_main.c in Mujstest in Artifex Software, Inc. MuPDF before 1.10 allows remote attackers to cause a denial of serv… |
CVE-2016-5239 | Critical | 9.8 | 2017-03-15 | The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vecto… |
CVE-2016-7955 | Critical | 9.8 | 2017-03-15 | The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote attackers to bypass… |
CVE-2016-7103 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText param… |
CVE-2016-10197 | High | 7.5 | 2017-03-15 | The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. |
CVE-2016-10196 | High | 7.5 | 2017-03-15 | Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service… |
CVE-2016-10195 | Critical | 9.8 | 2017-03-15 | The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variabl… |
CVE-2016-10168 | High | 7.8 | 2017-03-15 | Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the nu… |
CVE-2016-10167 | Medium | 5.5 | 2017-03-15 | The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (appl… |
CVE-2016-10166 | Critical | 9.8 | 2017-03-15 | Integer underflow in the _gdContributionsAlloc function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to ha… |
CVE-2016-10163 | Medium | 6.5 | 2017-03-15 | Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denia… |
CVE-2016-10155 | Medium | 6.0 | 2017-03-15 | Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consump… |
CVE-2016-6906 | Medium | 5.5 | 2017-03-15 | The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2016-10251 | High | 7.8 | 2017-03-15 | Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file… |
CVE-2016-10250 | High | 7.5 | 2017-03-15 | The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leverag… |
CVE-2016-10249 | High | 7.8 | 2017-03-15 | Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted ima… |
CVE-2016-10248 | High | 7.5 | 2017-03-15 | The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vec… |
CVE-2016-8027 | Critical | 10.0 | 2017-03-14 | SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to al… |
CVE-2016-8026 | High | 7.8 | 2017-03-14 | Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated pr… |
CVE-2016-8025 | Medium | 6.2 | 2017-03-14 | SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product informa… |
CVE-2016-8024 | High | 8.1 | 2017-03-14 | Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote u… |
CVE-2016-8023 | High | 8.1 | 2017-03-14 | Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthentic… |
CVE-2016-8022 | High | 7.5 | 2017-03-14 | Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker… |
CVE-2016-8021 | Medium | 5.0 | 2017-03-14 | Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authentica… |
CVE-2016-8020 | High | 8.0 | 2017-03-14 | Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users… |
CVE-2016-8019 | Medium | 6.1 | 2017-03-14 | Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote at… |
CVE-2016-8018 | Medium | 4.3 | 2017-03-14 | Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers t… |
CVE-2016-8017 | Medium | 4.1 | 2017-03-14 | Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read f… |
CVE-2016-8016 | Low | 3.4 | 2017-03-14 | Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of u… |
CVE-2016-8012 | High | 7.8 | 2017-03-14 | Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute perm… |
CVE-2016-8011 | Medium | 6.1 | 2017-03-14 | Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web s… |
CVE-2016-8010 | High | 7.8 | 2017-03-14 | Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier al… |
CVE-2016-8009 | High | 7.8 | 2017-03-14 | Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior… |
CVE-2016-8008 | High | 8.8 | 2017-03-14 | Privilege escalation vulnerability in Windows 7 and Windows 10 in McAfee Security Scan Plus (SSP) 3.11.376 allows attackers to load a replacement of the versio… |
CVE-2016-8007 | Medium | 6.3 | 2017-03-14 | Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the pr… |
CVE-2016-8005 | Medium | 6.5 | 2017-03-14 | File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name p… |
CVE-2016-10252 | High | 7.5 | 2017-03-14 | Memory leak in the IsOptionMember function in MagickCore/option.c in ImageMagick before 6.9.2-2, as used in ODR-PadEnc and other products, allows attackers to… |
CVE-2016-10189 | High | 7.5 | 2017-03-14 | BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file tra… |
CVE-2016-10188 | Critical | 9.8 | 2017-03-14 | Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by c… |
CVE-2016-10172 | Medium | 5.5 | 2017-03-14 | The read_new_config_info function in open_utils.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a craft… |
CVE-2016-10171 | Medium | 5.5 | 2017-03-14 | The unreorder_channels function in cli/wvunpack.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a craft… |
CVE-2016-10170 | Medium | 5.5 | 2017-03-14 | The WriteCaffHeader function in cli/caff.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV f… |
CVE-2016-10169 | Medium | 5.5 | 2017-03-14 | The read_code function in read_words.c in Wavpack before 5.1.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WV file. |
CVE-2016-9368 | High | 7.5 | 2017-03-14 | An issue was discovered in Eaton xComfort Ethernet Communication Interface (ECI) Versions 1.07 and prior. By accessing a specific uniform resource locator (URL… |
CVE-2016-8747 | High | 7.5 | 2017-03-14 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.ja… |
CVE-2016-8714 | High | 8.8 | 2017-03-10 | An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script… |
CVE-2016-9985 | Medium | 5.5 | 2017-03-08 | IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671. |
CVE-2016-9006 | Medium | 5.4 | 2017-03-08 | IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5933 | Medium | 4.6 | 2017-03-08 | IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Refere… |
CVE-2016-5894 | Medium | 5.1 | 2017-03-08 | IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could v… |
CVE-2016-8483 | Medium | 5.5 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-8479 | High | 7.8 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-8478 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-8477 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2016-8417 | High | 7.0 | 2017-03-08 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-8416 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-8413 | Medium | 4.7 | 2017-03-08 | An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission level… |
CVE-2016-9245 | Medium | 5.9 | 2017-03-07 | In F5 BIG-IP systems 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP profile can cause the TMM to restart. The issue is exposed with B… |
CVE-2016-10200 | High | 7.0 | 2017-03-07 | Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use… |
CVE-2016-9740 | High | 7.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote attacker to consume all resources on the server due to not properly restricting the size or amount of resources requested b… |
CVE-2016-9730 | Medium | 4.3 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions trans… |
CVE-2016-9729 | Medium | 6.5 | 2017-03-07 | IBM QRadar 7.2 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM Refere… |
CVE-2016-9728 | High | 7.5 | 2017-03-07 | IBM Qradar 7.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, informati… |
CVE-2016-9727 | High | 8.5 | 2017-03-07 | IBM QRadar 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker cou… |
CVE-2016-9726 | High | 8.8 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted reque… |
CVE-2016-9725 | Medium | 5.3 | 2017-03-07 | IBM QRadar Incident Forensics 7.2 allows for Cross-Origin Resource Sharing (CORS), which is a mechanism that allows web sites to request resources from externa… |
CVE-2016-9724 | High | 8.1 | 2017-03-07 | IBM QRadar 7.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could e… |