2016 CVEs (page 32)
Page 32 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6045 | High | 8.8 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2016-6044 | Medium | 4.3 | 2017-02-01 | IBM Tivoli Storage Manager Operations Center could allow an authenticated attacker to enable or disable the application's REST API, which may let the attacker… |
CVE-2016-6043 | High | 7.0 | 2017-02-01 | Tivoli Storage Manager Operations Center could allow a local user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6042 | High | 7.3 | 2017-02-01 | IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By pers… |
CVE-2016-6040 | Medium | 5.0 | 2017-02-01 | IBM Jazz Foundation could allow an authenticated user to take over a previously logged in user due to session expiration not being enforced. |
CVE-2016-6039 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-6034 | Medium | 6.8 | 2017-02-01 | IBM Tivoli Storage Manager for Virtual Environments (VMware) could disclose the Windows domain credentials to a user with a high level of privileges. |
CVE-2016-6030 | Medium | 5.4 | 2017-02-01 | IBM Jazz Foundation is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the i… |
CVE-2016-6028 | Medium | 4.3 | 2017-02-01 | IBM Jazz technology based products might allow an attacker to view work item titles that they do not have privilege to view. |
CVE-2016-6020 | Medium | 6.1 | 2017-02-01 | IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim t… |
CVE-2016-6000 | Medium | 6.1 | 2017-02-01 | IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5994 | Medium | 6.5 | 2017-02-01 | IBM InfoSphere Information Server contains a vulnerability that would allow an authenticated user to browse any file on the engine tier, and examine its conten… |
CVE-2016-5990 | Medium | 6.3 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the s… |
CVE-2016-5988 | Medium | 6.5 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authe… |
CVE-2016-5985 | High | 7.8 | 2017-02-01 | The IBM Tivoli Storage Manager (IBM Spectrum Protect) AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled. A local attacker coul… |
CVE-2016-5984 | Medium | 6.1 | 2017-02-01 | IBM InfoSphere Information Server is vulnerable to cross-frame scripting, caused by insufficient HTML iframe protection. A remote attacker could exploit this v… |
CVE-2016-5980 | Medium | 5.4 | 2017-02-01 | IBM TRIRIGA Application Platform is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5966 | Medium | 5.9 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly ena… |
CVE-2016-5964 | Critical | 9.8 | 2017-02-01 | IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute… |
CVE-2016-5958 | High | 7.5 | 2017-02-01 | IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the se… |
CVE-2016-5952 | High | 8.8 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker… |
CVE-2016-5951 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5950 | Medium | 6.5 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud stores user credentials in plain in clear text which can be read by an authenticated user. |
CVE-2016-5949 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud could allow an authenticated user to obtain sensitive user data with a specially crafted HTTP request. |
CVE-2016-5948 | Medium | 5.4 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5939 | Medium | 6.3 | 2017-02-01 | IBM Kenexa LMS on Cloud is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view… |
CVE-2016-5937 | High | 8.8 | 2017-02-01 | IBM Kenexa LCMS Premier on Cloud is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transm… |
CVE-2016-5899 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2016-5898 | Medium | 4.3 | 2017-02-01 | IBM Jazz Reporting Service (JRS) could allow a remote attacker to obtain sensitive information, caused by not restricting JSON serialization. By sending a dire… |
CVE-2016-5897 | Medium | 5.4 | 2017-02-01 | IBM Jazz Reporting Service (JRS) is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in t… |
CVE-2016-5896 | Medium | 5.3 | 2017-02-01 | IBM Maximo Asset Management could disclose sensitive information from a stack trace after submitting incorrect login onto Cognos browser. |
CVE-2016-5884 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-5882 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-5880 | Medium | 5.4 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-3053 | High | 7.8 | 2017-02-01 | IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privileges. |
CVE-2016-3046 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacke… |
CVE-2016-3045 | Low | 3.7 | 2017-02-01 | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access… |
CVE-2016-3043 | Medium | 5.9 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2016-3035 | Medium | 5.3 | 2017-02-01 | IBM AppScan Source could reveal some sensitive information through the browsing of testlinks on the server. |
CVE-2016-3034 | Medium | 4.4 | 2017-02-01 | IBM AppScan Source uses a one-way hash without salt to encrypt highly sensitive information, which could allow a local attacker to decrypt information more eas… |
CVE-2016-3029 | High | 8.8 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tra… |
CVE-2016-3027 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A re… |
CVE-2016-3024 | Medium | 4.0 | 2017-02-01 | IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system. |
CVE-2016-3023 | Medium | 5.3 | 2017-02-01 | IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names. |
CVE-2016-3022 | Medium | 6.5 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions. |
CVE-2016-3021 | Low | 2.7 | 2017-02-01 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP req… |
CVE-2016-3018 | Medium | 6.1 | 2017-02-01 | IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2016-3017 | High | 7.5 | 2017-02-01 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations. |
CVE-2016-3016 | Medium | 4.4 | 2017-02-01 | IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, whi… |
CVE-2016-2987 | Medium | 4.3 | 2017-02-01 | An undisclosed vulnerability in CLM applications may result in some administrative deployment parameters being shown to an attacker. |
CVE-2016-2939 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-2938 | Medium | 6.1 | 2017-02-01 | IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended f… |
CVE-2016-2908 | Critical | 9.1 | 2017-02-01 | IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML d… |
CVE-2016-0396 | High | 8.1 | 2017-02-01 | IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than ex… |
CVE-2016-0394 | Low | 3.3 | 2017-02-01 | IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files. |
CVE-2016-0297 | Low | 3.7 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transpo… |
CVE-2016-0296 | Low | 3.3 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user. |
CVE-2016-0265 | Medium | 5.4 | 2017-02-01 | IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability us… |
CVE-2016-9225 | High | 8.6 | 2017-02-01 | A vulnerability in the data plane IP fragment handler of the Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security module could allow an unauthenti… |
CVE-2016-10079 | High | 7.5 | 2017-02-01 | SAPlpd through 7400.3.11.33 in SAP GUI 7.40 on Windows has a Denial of Service vulnerability (service crash) with a long string to TCP port 515. |
CVE-2016-8491 | Critical | 9.1 | 2017-02-01 | The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2016-9963 | Medium | 5.9 | 2017-02-01 | Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. |
CVE-2016-4038 | High | 7.8 | 2017-02-01 | Array index error in the msm_sensor_config function in kernel/SM-G9008V_CHN_KK_Opensource/Kernel/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c in Sa… |
CVE-2016-10173 | High | 7.5 | 2017-02-01 | Directory traversal vulnerability in the minitar before 0.6 and archive-tar-minitar 0.5.2 gems for Ruby allows remote attackers to write to arbitrary files via… |
CVE-2016-10164 | Critical | 9.8 | 2017-02-01 | Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attackers to cause a deni… |
CVE-2016-9962 | Medium | 6.4 | 2017-01-31 | RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if r… |
CVE-2016-9421 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before… |
CVE-2016-9420 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comp… |
CVE-2016-9419 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote… |
CVE-2016-9418 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information f… |
CVE-2016-9417 | High | 7.4 | 2017-01-31 | The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side req… |
CVE-2016-9416 | Critical | 9.8 | 2017-01-31 | SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to… |
CVE-2016-9415 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via ve… |
CVE-2016-9414 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directo… |
CVE-2016-9413 | Medium | 6.5 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks v… |
CVE-2016-9412 | Critical | 9.8 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and s… |
CVE-2016-9411 | Medium | 5.3 | 2017-01-31 | The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path v… |
CVE-2016-9410 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors in… |
CVE-2016-9409 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow r… |
CVE-2016-9408 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow rem… |
CVE-2016-9407 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject a… |
CVE-2016-9406 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow re… |
CVE-2016-9405 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote… |
CVE-2016-9404 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject a… |
CVE-2016-9403 | Critical | 9.8 | 2017-01-31 | newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a m… |
CVE-2016-9402 | Critical | 9.8 | 2017-01-31 | SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers t… |
CVE-2016-9260 | Medium | 5.4 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors rela… |
CVE-2016-8703 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8702 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8701 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8700 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8699 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8698 | High | 7.8 | 2017-01-31 | Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a craft… |
CVE-2016-8697 | Medium | 5.5 | 2017-01-31 | The bm_new function in bitmap.h in potrace before 1.13 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a crafted BMP… |
CVE-2016-8696 | Medium | 5.5 | 2017-01-31 | The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) vi… |
CVE-2016-8695 | Medium | 5.5 | 2017-01-31 | The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) vi… |
CVE-2016-8694 | Medium | 5.5 | 2017-01-31 | The bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) vi… |
CVE-2016-8686 | High | 7.8 | 2017-01-31 | The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation fail… |
CVE-2016-8685 | Medium | 5.5 | 2017-01-31 | The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP i… |
CVE-2016-6329 | Medium | 5.9 | 2017-01-31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypte… |