2016 CVEs (page 26)
Page 26 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9819 | Medium | 5.5 | 2017-03-01 | libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. |
CVE-2016-9559 | Medium | 6.5 | 2017-03-01 | coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted image. |
CVE-2016-8508 | Medium | 6.5 | 2017-03-01 | Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special content-type, which… |
CVE-2016-8507 | Medium | 6.5 | 2017-03-01 | Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initiate facetime-call w… |
CVE-2016-10095 | Medium | 5.5 | 2017-03-01 | Stack-based buffer overflow in the _TIFFVGetField function in tif_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2, 4.0… |
CVE-2016-10094 | High | 7.8 | 2017-03-01 | Off-by-one error in the t2p_readwrite_pdf_image_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecified impact via a cra… |
CVE-2016-10093 | High | 7.8 | 2017-03-01 | Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, 4.0.1, 4.0.2… |
CVE-2016-10092 | High | 7.8 | 2017-03-01 | Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alph… |
CVE-2016-9558 | Critical | 9.8 | 2017-02-28 | (1) libdwarf/dwarf_leb.c and (2) dwarfdump/print_frames.c in libdwarf before 20161124 allow remote attackers to have unspecified impact via a crafted bit patte… |
CVE-2016-9261 | Medium | 5.4 | 2017-02-28 | Cross-site scripting (XSS) vulnerability in Tenable Log Correlation Engine (aka LCE) before 4.8.1 allows remote authenticated users to inject arbitrary web scr… |
CVE-2016-9259 | Medium | 5.4 | 2017-02-28 | Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecifie… |
CVE-2016-10207 | High | 7.5 | 2017-02-28 | The Xvnc server in TigerVNC allows remote attackers to cause a denial of service (invalid memory access and crash) by terminating a TLS handshake early. |
CVE-2016-8715 | High | 7.8 | 2017-02-28 | An exploitable heap corruption vulnerability exists in the loadTrailer functionality of Iceni Argus version 6.6.05. A specially crafted PDF file can cause a he… |
CVE-2016-8389 | High | 7.8 | 2017-02-28 | An exploitable integer-overflow vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will attempt to convert each ch… |
CVE-2016-8388 | High | 7.8 | 2017-02-28 | An exploitable arbitrary heap-overwrite vulnerability exists within Iceni Argus. When it attempts to convert a malformed PDF to XML, it will explicitly trust a… |
CVE-2016-9818 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP. |
CVE-2016-9817 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR… |
CVE-2016-9816 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2. |
CVE-2016-9815 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort. |
CVE-2016-7553 | Low | 3.3 | 2017-02-27 | The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which might allow local use… |
CVE-2016-5240 | Medium | 5.5 | 2017-02-27 | The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers to cause a denial of… |
CVE-2016-10029 | Medium | 5.5 | 2017-02-27 | The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of… |
CVE-2016-10028 | Medium | 5.5 | 2017-02-27 | The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest O… |
CVE-2016-8387 | High | 7.8 | 2017-02-27 | An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed PDF with an object encoded w/ multiple encoding types… |
CVE-2016-8386 | High | 7.8 | 2017-02-27 | An exploitable heap-based buffer overflow exists in Iceni Argus. When it attempts to convert a PDF containing a malformed font to XML, the tool will attempt to… |
CVE-2016-8385 | High | 7.8 | 2017-02-27 | An exploitable uninitialized variable vulnerability which leads to a stack-based buffer overflow exists in Iceni Argus. When it attempts to convert a malformed… |
CVE-2016-8105 | Medium | 6.5 | 2017-02-27 | Drivers for the Intel Ethernet Controller X710 and Intel Ethernet Controller XL710 families before version 22.0 are vulnerable to a denial of service in certai… |
CVE-2016-5027 | Medium | 5.5 | 2017-02-24 | dwarf_form.c in libdwarf 20160115 allows remote attackers to cause a denial of service (crash) via a crafted elf file. |
CVE-2016-4493 | Medium | 5.5 | 2017-02-24 | The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-o… |
CVE-2016-4492 | Medium | 4.4 | 2017-02-24 | Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a c… |
CVE-2016-4491 | Medium | 5.5 | 2017-02-24 | The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binar… |
CVE-2016-4490 | Medium | 5.5 | 2017-02-24 | Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, relate… |
CVE-2016-4489 | Medium | 5.5 | 2017-02-24 | Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted bin… |
CVE-2016-4488 | Medium | 5.5 | 2017-02-24 | Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to… |
CVE-2016-4487 | Medium | 5.5 | 2017-02-24 | Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to… |
CVE-2016-4043 | Medium | 4.9 | 2017-02-24 | Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit tem… |
CVE-2016-4042 | Medium | 5.3 | 2017-02-24 | Plone 3.3 through 5.1a1 allows remote attackers to obtain information about the ID of sensitive content via unspecified vectors. |
CVE-2016-4041 | High | 7.3 | 2017-02-24 | Plone 4.0 through 5.1a1 does not have security declarations for Dexterity content-related WebDAV requests, which allows remote attackers to gain webdav access… |
CVE-2016-2226 | High | 7.8 | 2017-02-24 | Integer overflow in the string_appends function in cplus-dem.c in libiberty allows remote attackers to execute arbitrary code via a crafted executable, which t… |
CVE-2016-9975 | High | 8.8 | 2017-02-24 | IBM Jazz for Service Management 1.1.2.1 and 1.1.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2016-9009 | Low | 3.1 | 2017-02-24 | IBM WebSphere MQ 8.0 could allow an authenticated user with authority to create a cluster object to cause a denial of service to MQ clustering. IBM Reference #… |
CVE-2016-8998 | High | 7.2 | 2017-02-24 | IBM Tivoli Storage Manager Server 7.1 could allow an authenticated user with TSM administrator privileges to cause a buffer overflow using a specially crafted… |
CVE-2016-10109 | High | 7.5 | 2017-02-23 | Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause denial of service (crash) via a command that uses "cardsList" after… |
CVE-2016-8974 | High | 8.1 | 2017-02-23 | IBM Rhapsody DM 4.0, 5.0 and 6.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remot… |
CVE-2016-6055 | Medium | 5.4 | 2017-02-23 | IBM Rational DOORS Next Generation 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-5883 | Medium | 6.1 | 2017-02-23 | IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering th… |
CVE-2016-1245 | Critical | 9.8 | 2017-02-22 | It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neighbor Discovery messa… |
CVE-2016-8986 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager to bring down MQ channels using specially crafted HTTP requests. IBM Re… |
CVE-2016-8915 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user with access to the queue manager and queue, to deny service to other channels running under the same pro… |
CVE-2016-3052 | Medium | 5.9 | 2017-02-22 | Under non-standard configurations, IBM WebSphere MQ might send password data in clear text over the network. This data could be intercepted using man in the mi… |
CVE-2016-3013 | Medium | 6.5 | 2017-02-22 | IBM WebSphere MQ 8.0 could allow an authenticated user to crash the MQ channel due to improper data conversion handling. IBM Reference #: 1998661. |
CVE-2016-9956 | High | 7.5 | 2017-02-22 | The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script. |
CVE-2016-9910 | Medium | 6.1 | 2017-02-22 | The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special ch… |
CVE-2016-9909 | Medium | 6.1 | 2017-02-22 | The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (les… |
CVE-2016-9400 | Critical | 9.8 | 2017-02-22 | The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locat… |
CVE-2016-9384 | Medium | 6.5 | 2017-02-22 | Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. |
CVE-2016-9378 | Medium | 5.5 | 2017-02-22 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users… |
CVE-2016-9377 | Medium | 5.5 | 2017-02-22 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users… |
CVE-2016-8636 | High | 7.8 | 2017-02-22 | Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial o… |
CVE-2016-9684 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface… |
CVE-2016-9683 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface… |
CVE-2016-9682 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interf… |
CVE-2016-9053 | Critical | 9.8 | 2017-02-21 | An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafte… |
CVE-2016-9051 | Critical | 9.8 | 2017-02-21 | An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospike Database Server 3.10.0.3. A specially… |
CVE-2016-9049 | High | 7.5 | 2017-02-21 | An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0.3. A specially crafted packet can caus… |
CVE-2016-9316 | Medium | 5.4 | 2017-02-21 | Multiple stored Cross-Site-Scripting (XSS) vulnerabilities in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virt… |
CVE-2016-9315 | High | 8.8 | 2017-02-21 | Privilege Escalation Vulnerability in com.trend.iwss.gui.servlet.updateaccountadministration in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) ve… |
CVE-2016-9314 | High | 7.8 | 2017-02-21 | Sensitive Information Disclosure in com.trend.iwss.gui.servlet.ConfigBackup in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Bui… |
CVE-2016-9269 | Critical | 9.9 | 2017-02-21 | Remote Command Execution in com.trend.iwss.gui.servlet.ManagePatches in Trend Micro Interscan Web Security Virtual Appliance (IWSVA) version 6.5-SP2_Build_Linu… |
CVE-2016-10227 | High | 7.5 | 2017-02-21 | Zyxel USG50 Security Appliance and NWA3560-N Access Point allow remote attackers to cause a denial of service (CPU consumption) via a flood of ICMPv4 Port Unre… |
CVE-2016-6249 | Medium | 5.3 | 2017-02-20 | F5 BIG-IP 12.0.0 and 11.5.0 - 11.6.1 REST requests which timeout during user account authentication may log sensitive attributes such as passwords in plaintext… |
CVE-2016-7765 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Clipboard" component, which allows physically proximate… |
CVE-2016-7762 | Medium | 6.1 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "WebKit" component, which allows XSS attacks against Saf… |
CVE-2016-7761 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "WiFi" component, which allows local users to obtai… |
CVE-2016-7759 | Medium | 4.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10 is affected. The issue involves the "Springboard" component, which allows physically proximate… |
CVE-2016-7742 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "xar" component, which allows remote attackers to e… |
CVE-2016-7714 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7667 | High | 7.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "CoreText" component… |
CVE-2016-7666 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. Transporter before 1.9.2 is affected. The issue involves the "iTMSTransporter" component, which allows attac… |
CVE-2016-7665 | Medium | 5.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Graphics Driver" component, which allows remote attacke… |
CVE-2016-7664 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Accessibility" component. which allows physically proxi… |
CVE-2016-7663 | Critical | 9.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7662 | High | 7.5 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7661 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "Power Management" com… |
CVE-2016-7660 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7659 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7658 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7657 | Low | 3.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |
CVE-2016-7656 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7655 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. The issue involves the "CoreMedia External Di… |
CVE-2016-7654 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7653 | Low | 2.4 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Media Player" component, which allows physically proxim… |
CVE-2016-7652 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7651 | Medium | 5.3 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. watchOS before 3.1.1 is affected. The issue involves the "Accounts" component… |
CVE-2016-7650 | Medium | 4.7 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. The issue involves the "Safari Reader" compon… |
CVE-2016-7649 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7648 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7646 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7645 | High | 8.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before… |
CVE-2016-7644 | High | 7.8 | 2017-02-20 | An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue i… |