2016 CVEs (page 3)
Page 3 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-11061 | Critical | 9.8 | 2020-04-29 | Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly… |
CVE-2016-11060 | High | 7.5 | 2020-04-28 | Certain NETGEAR devices are affected by insecure renegotiation. This affects SRX5308 before 2017-02-10, FVS336Gv3 before 2017-02-10, FVS318N before 2017-02-10… |
CVE-2016-11059 | High | 7.5 | 2020-04-28 | Certain NETGEAR devices are affected by password exposure. This affects AC1450 before 2017-01-06, C6300 before 2017-01-06, D500 before 2017-01-06, D1500 before… |
CVE-2016-11058 | High | 7.5 | 2020-04-28 | The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs. |
CVE-2016-11057 | High | 7.5 | 2020-04-28 | Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 20… |
CVE-2016-11056 | High | 8.8 | 2020-04-28 | Certain NETGEAR devices are affected by anonymous root access. This affects ReadyNAS Surveillance 1.1.1-3-armel and earlier and ReadyNAS Surveillance 1.4.1-3-a… |
CVE-2016-11055 | Medium | 4.3 | 2020-04-28 | Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, D… |
CVE-2016-11054 | High | 7.2 | 2020-04-28 | NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory. |
CVE-2016-11040 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software. There is a Factory Reset Protection (FRP) b… |
CVE-2016-11039 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (AP + CP MDM9x35, or Qualcomm Onechip) software. There is a NULL pointer… |
CVE-2016-11038 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service d… |
CVE-2016-11036 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (Augu… |
CVE-2016-11035 | Medium | 5.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-05-27 (Exynos AP chipsets). A local graphics user can cause a Kernel Crash via the… |
CVE-2016-11034 | Medium | 6.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. The decode function in Qjpeg in Qt 5.7 allows attackers to trigger a sys… |
CVE-2016-11033 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. There is a heap-based buffer overflow in tlc_server. The Samsung IDs are SVE-2016-7220… |
CVE-2016-11032 | Medium | 5.3 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. An attacker can disable all Sound functionality by broadcasting an unprotected intent… |
CVE-2016-11031 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. AntService allows a system_server crash and reboot. The Samsun… |
CVE-2016-11030 | High | 8.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (with Hrm sensor support) software. The sysfs of the MAX86902 sensor dri… |
CVE-2016-11029 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the lo… |
CVE-2016-11028 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a stack-based buffer overflow in the OTP Trus… |
CVE-2016-11027 | Low | 2.4 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on th… |
CVE-2016-11026 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash becaus… |
CVE-2016-11025 | Critical | 9.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a memcpy heap-based buffer overflow in the OT… |
CVE-2016-11053 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL). There is a Factory Reset Protection (FRP) bypass. The S… |
CVE-2016-11052 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed… |
CVE-2016-11050 | Medium | 4.3 | 2020-04-07 | An issue was discovered on Samsung mobile devices with S3(KK), Note2(KK), S4(L), Note3(L), and S5(L) software. An attacker can rewrite the IMEI by flashing cra… |
CVE-2016-11049 | Critical | 9.1 | 2020-04-07 | An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets). The IMEI may be retrieved and modified becaus… |
CVE-2016-11048 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software. There is a Factory Reset Protection (FRP) bypass… |
CVE-2016-11047 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with JBP(4.2) and KK(4.4) (Marvell chipsets) software. The ACIPC-MSOCKET driver allows local privilege escala… |
CVE-2016-11046 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software. Because of a misused whitelist, attackers can reach the radi… |
CVE-2016-11045 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. The Gallery library allow memory corruption via a malformed image. The Samsung ID i… |
CVE-2016-11044 | High | 7.8 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can b… |
CVE-2016-11043 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with M(6.0) software. The S/MIME implementation in EAS uses DES (where 3DES is intended). The Samsung ID is S… |
CVE-2016-11042 | High | 7.5 | 2020-04-07 | An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016). |
CVE-2016-11041 | Medium | 4.6 | 2020-04-07 | An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID… |
CVE-2016-11024 | Critical | 9.8 | 2020-03-30 | odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. |
CVE-2016-11023 | Critical | 9.8 | 2020-03-30 | odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued. |
CVE-2016-11022 | High | 7.2 | 2020-03-23 | NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharac… |
CVE-2016-1000111 | Medium | 5.3 | 2020-03-11 | Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence… |
CVE-2016-1487 | High | 8.8 | 2020-03-09 | Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library, leading to remote code execution because of Java deserialization. |
CVE-2016-6918 | Critical | 9.8 | 2020-03-09 | Lexmark Markvision Enterprise (MVE) before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files. ( |
CVE-2016-1159 | Medium | 6.5 | 2020-03-09 | In ZOHO Password Manager Pro (PMP) 8.3.0 (Build 8303) and 8.4.0 (Build 8400,8401,8402), underprivileged users can obtain sensitive information (entry password… |
CVE-2016-11021 | High | 7.2 | 2020-03-09 | setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter. |
CVE-2016-11020 | Critical | 9.8 | 2020-02-25 | Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution. |
CVE-2016-4606 | Critical | 9.8 | 2020-02-21 | Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cau… |
CVE-2016-3182 | Medium | 5.5 | 2020-02-20 | The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted… |
CVE-2016-1000109 | Medium | 5.3 | 2020-02-19 | HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted cli… |
CVE-2016-1000005 | Critical | 9.8 | 2020-02-19 | mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This… |
CVE-2016-1000004 | Critical | 9.8 | 2020-02-19 | Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions pr… |
CVE-2016-5710 | Medium | 4.6 | 2020-02-11 | NetApp Snap Creator Framework before 4.3P1 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. |
CVE-2016-1544 | Low | 3.3 | 2020-02-06 | nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). |
CVE-2016-9928 | High | 7.4 | 2020-02-06 | MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd p… |
CVE-2016-7524 | Medium | 6.5 | 2020-02-06 | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. |
CVE-2016-7523 | Medium | 6.5 | 2020-02-06 | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. |
CVE-2016-4676 | High | 7.5 | 2020-02-03 | A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain… |
CVE-2016-2032 | High | 7.5 | 2020-01-31 | A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an underlying system component called RabbitMQ… |
CVE-2016-2031 | Critical | 9.8 | 2020-01-31 | Multiple vulnerabilities exists in Aruba Instate before 4.1.3.0 and 4.2.3.1 due to insufficient validation of user-supplied input and insufficient checking of… |
CVE-2016-1000237 | Medium | 6.1 | 2020-01-23 | sanitize-html before 1.4.3 has XSS. |
CVE-2016-4761 | High | 8.8 | 2020-01-22 | WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS |
CVE-2016-11018 | Critical | 9.8 | 2020-01-21 | An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated… |
CVE-2016-6592 | High | 7.8 | 2020-01-14 | A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on… |
CVE-2016-5311 | High | 7.8 | 2020-01-09 | A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton In… |
CVE-2016-6585 | Medium | 5.3 | 2020-01-08 | A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious user conduct a man-in… |
CVE-2016-5346 | Medium | 5.5 | 2020-01-08 | An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointer dereference when processing an accept… |
CVE-2016-6587 | Medium | 5.5 | 2020-01-08 | An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which coul… |
CVE-2016-6588 | Medium | 5.4 | 2020-01-08 | A Cross-Site Scripting (XSS) vulnerability exists in the ITMS workflow process manager console in Symantec IT Management Suite 8.0. |
CVE-2016-6586 | Low | 3.7 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16, which could let a malicious user conduct a man-in-the-middle… |
CVE-2016-6593 | High | 7.8 | 2020-01-08 | A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2, which could let local malicious use… |
CVE-2016-6591 | High | 7.1 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let a local malicious u… |
CVE-2016-6590 | High | 7.8 | 2020-01-08 | A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prio… |
CVE-2016-6589 | Medium | 6.5 | 2020-01-08 | A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0. |
CVE-2016-11017 | Critical | 9.8 | 2020-01-06 | The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell meta… |
CVE-2016-1000027 | Critical | 9.8 | 2020-01-02 | Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Dependin… |
CVE-2016-1000029 | Medium | 4.8 | 2019-12-27 | Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable… |
CVE-2016-1000028 | Medium | 4.8 | 2019-12-27 | Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Te… |
CVE-2016-1000229 | Medium | 6.1 | 2019-12-20 | swagger-ui has XSS in key names |
CVE-2016-1000107 | Medium | 6.1 | 2019-12-10 | inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client dat… |
CVE-2016-1000108 | Medium | 6.1 | 2019-12-10 | yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of… |
CVE-2016-1000104 | High | 8.8 | 2019-12-03 | A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07. |
CVE-2016-1000110 | Medium | 6.1 | 2019-11-27 | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker t… |
CVE-2016-4980 | Low | 2.5 | 2019-11-27 | A password generation weakness exists in xquest through 2016-06-13. |
CVE-2016-9271 | Medium | 5.4 | 2019-11-26 | Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and 5.9.x before 5.9.1 allows XSS in the help search feature. |
CVE-2016-6353 | Medium | 6.5 | 2019-11-26 | Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level security via the R… |
CVE-2016-5724 | High | 7.5 | 2019-11-26 | Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles. |
CVE-2016-4572 | High | 8.8 | 2019-11-26 | In Cloudera CDH before 5.7.1, Impala REVOKE ALL ON SERVER commands do not revoke all privileges. |
CVE-2016-3192 | Medium | 6.5 | 2019-11-26 | Cloudera Manager 5.x before 5.7.1 places Sensitive Data in cleartext Readable Files. |
CVE-2016-3131 | Medium | 6.5 | 2019-11-26 | Cloudera CDH before 5.6.1 allows authorization bypass via direct internal API calls. |
CVE-2016-9652 | Critical | 9.8 | 2019-11-20 | Multiple unspecified vulnerabilities in Google Chrome before 55.0.2883.75. |
CVE-2016-5194 | Critical | 9.8 | 2019-11-20 | Unspecified vulnerabilities in Google Chrome before 54.0.2840.59. |
CVE-2016-1000236 | Medium | 4.4 | 2019-11-19 | Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used. |
CVE-2016-1000006 | Critical | 9.8 | 2019-11-19 | hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions. |
CVE-2016-5285 | High | 7.5 | 2019-11-15 | A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMAC… |
CVE-2016-1000037 | Medium | 6.1 | 2019-11-06 | Pagure: XSS possible in file attachment endpoint |
CVE-2016-4401 | Critical | 9.8 | 2019-11-06 | Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. |
CVE-2016-4983 | Low | 3.3 | 2019-11-05 | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. |
CVE-2016-1000002 | Low | 2.4 | 2019-11-05 | gdm3 3.14.2 and possibly later has an information leak before screen lock |
CVE-2016-4289 | Medium | 5.5 | 2019-10-29 | A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2.1.19357 application. A specially creat… |
CVE-2016-5202 | Critical | 9.1 | 2019-10-25 | browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux n… |
CVE-2016-2360 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations. |
CVE-2016-2359 | Critical | 9.8 | 2019-10-25 | Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a req… |