2016 CVEs (page 30)
Page 30 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4988 | Medium | 6.1 | 2017-02-09 | Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbitrary web script o… |
CVE-2016-4987 | Medium | 6.5 | 2017-02-09 | Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories and read arbitrary fi… |
CVE-2016-4986 | High | 7.5 | 2017-02-09 | Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecified parameter. |
CVE-2016-3102 | High | 7.3 | 2017-02-09 | The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugin that performs (1)… |
CVE-2016-3101 | Medium | 5.4 | 2017-02-09 | Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by l… |
CVE-2016-2148 | Critical | 9.8 | 2017-02-09 | Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION… |
CVE-2016-2147 | High | 7.5 | 2017-02-09 | Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a malformed RFC1035-enco… |
CVE-2016-10199 | High | 7.5 | 2017-02-09 | The qtdemux_tag_add_str_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a denial of servi… |
CVE-2016-10198 | Medium | 5.5 | 2017-02-09 | The gst_aac_parse_sink_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a den… |
CVE-2016-10192 | Critical | 9.8 | 2017-02-09 | Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to exe… |
CVE-2016-10191 | Critical | 9.8 | 2017-02-09 | Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attac… |
CVE-2016-10190 | Critical | 9.8 | 2017-02-09 | Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web serv… |
CVE-2016-9686 | Medium | 5.3 | 2017-02-08 | The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing comm… |
CVE-2016-9005 | Critical | 9.8 | 2017-02-08 | IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remo… |
CVE-2016-8954 | Critical | 9.8 | 2017-02-08 | IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database. |
CVE-2016-5934 | High | 7.3 | 2017-02-08 | IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the… |
CVE-2016-5918 | Medium | 4.7 | 2017-02-08 | IBM Tivoli Storage Manager HSM for Windows displays the encrypted Tivoli Storage Manager password in application trace output if the password access option is… |
CVE-2016-5902 | Medium | 6.1 | 2017-02-08 | IBM Maximo Asset Management is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2016-5900 | Medium | 5.9 | 2017-02-08 | IBM Tealeaf Customer Experience on Cloud Network Capture Add-On could allow a remote attacker to obtain sensitive information, caused by the failure to properl… |
CVE-2016-0310 | Medium | 5.4 | 2017-02-08 | IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain. |
CVE-2016-0308 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images. |
CVE-2016-0307 | Medium | 4.3 | 2017-02-08 | IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses. |
CVE-2016-0305 | Medium | 5.4 | 2017-02-08 | IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability… |
CVE-2016-0214 | High | 7.8 | 2017-02-08 | IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious f… |
CVE-2016-0210 | Medium | 5.3 | 2017-02-08 | IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker… |
CVE-2016-0206 | Low | 3.3 | 2017-02-08 | IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and… |
CVE-2016-0203 | Medium | 5.5 | 2017-02-08 | A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information assoc… |
CVE-2016-0202 | Low | 3.3 | 2017-02-08 | A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is po… |
CVE-2016-9748 | Medium | 4.3 | 2017-02-08 | IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive information in error response messages that could be used for further attacks against the sy… |
CVE-2016-6032 | Medium | 5.4 | 2017-02-08 | IBM Rational Team Concert 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2016-2866 | Medium | 4.3 | 2017-02-08 | An unspecified vulnerability in IBM Jazz Team Server may disclose some deployment information to an authenticated user. |
CVE-2016-8492 | Medium | 5.9 | 2017-02-08 | The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS dec… |
CVE-2016-10213 | Medium | 5.9 | 2017-02-08 | A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the… |
CVE-2016-10212 | Medium | 5.9 | 2017-02-08 | Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden… |
CVE-2016-0270 | Medium | 5.9 | 2017-02-08 | IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easi… |
CVE-2016-8481 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8480 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute… |
CVE-2016-8476 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8421 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8420 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8419 | High | 7.0 | 2017-02-08 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-8418 | Critical | 9.8 | 2017-02-08 | A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel… |
CVE-2016-8414 | Medium | 4.7 | 2017-02-08 | An information disclosure vulnerability in the Qualcomm Secure Execution Environment Communicator could enable a local malicious application to access data out… |
CVE-2016-9639 | Critical | 9.1 | 2017-02-07 | Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. |
CVE-2016-6667 | Critical | 9.8 | 2017-02-07 | NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbi… |
CVE-2016-6495 | Medium | 5.9 | 2017-02-07 | NetApp Data ONTAP before 8.2.4P5, when operating in 7-Mode, allows remote attackers to obtain information about the volumes configured for HTTP access. |
CVE-2016-5711 | Critical | 9.8 | 2017-02-07 | NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate, which allows remote attackers to conduct man-in-the-middle attack… |
CVE-2016-5372 | Medium | 6.3 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in NetApp Snap Creator Framework before 4.3.0P1 allows remote attackers to hijack the authentication of users f… |
CVE-2016-4341 | High | 7.5 | 2017-02-07 | NetApp Clustered Data ONTAP before 8.3.2P7 allows remote attackers to obtain SMB share information via unspecified vectors. |
CVE-2016-3180 | High | 8.1 | 2017-02-07 | Tor Browser Launcher (aka torbrowser-launcher) before 0.2.4, during the initial run, allows man-in-the-middle attackers to bypass the PGP signature verificatio… |
CVE-2016-3124 | Medium | 5.3 | 2017-02-07 | The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors. |
CVE-2016-3063 | High | 7.5 | 2017-02-07 | Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execut… |
CVE-2016-2403 | Critical | 9.8 | 2017-02-07 | Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which trigg… |
CVE-2016-1894 | High | 8.1 | 2017-02-07 | NetApp OnCommand Workflow Automation before 3.1P2 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-1502 | High | 7.3 | 2017-02-07 | NetApp SnapCenter Server 1.0 and 1.0P1 allows remote attackers to partially bypass authentication and then list and delete backups via unspecified vectors. |
CVE-2016-6104 | High | 7.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, wh… |
CVE-2016-6097 | Medium | 4.0 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-6096 | Medium | 6.1 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2016-6094 | Medium | 4.3 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 generates an error message that includes sensitive information about its environment, users, or associated… |
CVE-2016-6092 | Medium | 6.2 | 2017-02-07 | IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 stores user credentials in plain in clear text which can be read by a local user. |
CVE-2016-3020 | Medium | 5.5 | 2017-02-07 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validatio… |
CVE-2016-7400 | Critical | 9.8 | 2017-02-07 | Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an act… |
CVE-2016-7164 | High | 7.5 | 2017-02-07 | The construct function in puff.cpp in Libtorrent 1.1.0 allows remote torrent trackers to cause a denial of service (segmentation fault and crash) via a crafted… |
CVE-2016-6199 | Critical | 9.8 | 2017-02-07 | ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object. |
CVE-2016-6175 | Critical | 9.8 | 2017-02-07 | Eval injection vulnerability in php-gettext 1.0.12 and earlier allows remote attackers to execute arbitrary PHP code via a crafted plural forms header. |
CVE-2016-6131 | High | 7.5 | 2017-02-07 | The demangler in GNU Libiberty allows remote attackers to cause a denial of service (infinite loop, stack overflow, and crash) via a cycle in the references of… |
CVE-2016-2781 | Medium | 4.6 | 2017-02-07 | chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes character… |
CVE-2016-2779 | High | 7.8 | 2017-02-07 | runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buff… |
CVE-2016-2539 | High | 8.8 | 2017-02-07 | Cross-site request forgery (CSRF) vulnerability in install_modules.php in ATutor before 2.2.2 allows remote attackers to hijack the authentication of users for… |
CVE-2016-1504 | High | 7.5 | 2017-02-07 | dhcpcd before 6.10.0 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to the option length. |
CVE-2016-10044 | High | 7.8 | 2017-02-07 | The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass… |
CVE-2016-9772 | Medium | 5.3 | 2017-02-06 | OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache partition, (2) fileserv… |
CVE-2016-9532 | Medium | 5.5 | 2017-02-06 | Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial of service (out-of… |
CVE-2016-7800 | High | 7.5 | 2017-02-06 | Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (applica… |
CVE-2016-7449 | High | 7.5 | 2017-02-06 | The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a file c… |
CVE-2016-7448 | High | 7.5 | 2017-02-06 | The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vect… |
CVE-2016-7447 | Critical | 9.8 | 2017-02-06 | Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified impact via unknown vec… |
CVE-2016-7446 | Critical | 9.8 | 2017-02-06 | Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown vectors. Note: This v… |
CVE-2016-5102 | Medium | 5.5 | 2017-02-06 | Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (segmenta… |
CVE-2016-10208 | Medium | 4.3 | 2017-02-06 | The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows physically proxima… |
CVE-2016-10154 | Medium | 5.5 | 2017-02-06 | The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local… |
CVE-2016-10153 | High | 7.8 | 2017-02-06 | The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a… |
CVE-2016-10150 | Critical | 9.8 | 2017-02-06 | Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS users to cause a d… |
CVE-2016-10098 | Critical | 9.8 | 2017-02-05 | An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary sys… |
CVE-2016-7147 | Medium | 6.1 | 2017-02-04 | Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allow… |
CVE-2016-6500 | High | 8.1 | 2017-02-03 | Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnO… |
CVE-2016-10165 | High | 7.1 | 2017-02-03 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an… |
CVE-2016-6188 | Medium | 6.5 | 2017-02-03 | Memory leak in SOGo 2.3.7 allows remote attackers to cause a denial of service (memory consumption) via a large number of attempts to upload a large attachment… |
CVE-2016-4797 | Medium | 5.5 | 2017-02-03 | Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (applicat… |
CVE-2016-4796 | Medium | 5.5 | 2017-02-03 | Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via… |
CVE-2016-3183 | Medium | 5.5 | 2017-02-03 | The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted j… |
CVE-2016-9642 | Medium | 5.5 | 2017-02-03 | JavaScriptCore in WebKit allows attackers to cause a denial of service (out-of-bounds heap read) via a crafted Javascript file. |
CVE-2016-9108 | High | 7.5 | 2017-02-03 | Integer overflow in the js_regcomp function in regexp.c in Artifex Software, Inc. MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers… |
CVE-2016-9085 | Low | 3.3 | 2017-02-03 | Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors. |
CVE-2016-9082 | Medium | 5.5 | 2017-02-03 | Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference) via a large svg f… |
CVE-2016-8569 | Medium | 5.5 | 2017-02-03 | The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file c… |
CVE-2016-8568 | Medium | 5.5 | 2017-02-03 | The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file comm… |
CVE-2016-6163 | Medium | 5.5 | 2017-02-03 | The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via… |
CVE-2016-5241 | Medium | 5.5 | 2017-02-03 | magick/render.c in GraphicsMagick before 1.3.24 allows remote attackers to cause a denial of service (arithmetic exception and application crash) via a crafted… |
CVE-2016-5115 | Medium | 5.5 | 2017-02-03 | The avcodec_decode_audio4 function in libavcodec in libavformat 57.34.103, as used in MPlayer, allows remote attackers to cause a denial of service (out-of-bou… |