2016 CVEs (page 33)
Page 33 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6285 | Medium | 6.1 | 2017-01-31 | Cross-site scripting (XSS) vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitr… |
CVE-2016-9039 | Medium | 6.2 | 2017-01-31 | An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with… |
CVE-2016-6621 | High | 8.6 | 2017-01-31 | The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery… |
CVE-2016-5117 | Medium | 5.9 | 2017-01-31 | OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests, which allows remote attackers to bypass the man-in-the-middle mitigations via a c… |
CVE-2016-3176 | Medium | 5.6 | 2017-01-31 | Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication servi… |
CVE-2016-2050 | Medium | 6.5 | 2017-01-31 | The get_abbrev_array_info function in libdwarf-20151114 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted elf file. |
CVE-2016-10043 | Critical | 10.0 | 2017-01-31 | An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command… |
CVE-2016-9249 | High | 7.5 | 2017-01-31 | An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, re… |
CVE-2016-9132 | Critical | 9.8 | 2017-01-30 | In Botan 1.8.0 through 1.11.33, when decoding BER data an integer overflow could occur, which would cause an incorrect length field to be computed. Some API ca… |
CVE-2016-9119 | Medium | 6.1 | 2017-01-30 | Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.8 allows remote attackers to inject arbitrary web script or… |
CVE-2016-7798 | High | 7.5 | 2017-01-30 | The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-… |
CVE-2016-6604 | Critical | 9.8 | 2017-01-30 | NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via unknown vectors. The… |
CVE-2016-6270 | High | 8.8 | 2017-01-30 | The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote… |
CVE-2016-6269 | Critical | 9.1 | 2017-01-30 | Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 all… |
CVE-2016-6268 | High | 7.8 | 2017-01-30 | Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary cod… |
CVE-2016-6267 | High | 8.8 | 2017-01-30 | SnmpUtils in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to e… |
CVE-2016-6266 | High | 8.8 | 2017-01-30 | ccca_ajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated… |
CVE-2016-6167 | High | 7.8 | 2017-01-30 | Multiple untrusted search path vulnerabilities in Putty beta 0.67 allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan ho… |
CVE-2016-5434 | Medium | 5.5 | 2017-01-30 | libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file. |
CVE-2016-5026 | Medium | 5.5 | 2017-01-30 | hs.py in OnionShare before 0.9.1 allows local users to modify the hiddenservice by pre-creating the /tmp/onionshare directory. |
CVE-2016-2402 | Medium | 5.9 | 2017-01-30 | OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate fro… |
CVE-2016-2399 | High | 7.8 | 2017-01-30 | Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have… |
CVE-2016-2217 | Medium | 5.3 | 2017-01-30 | The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain t… |
CVE-2016-10087 | High | 7.5 | 2017-01-30 | The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context… |
CVE-2016-9939 | High | 7.5 | 2017-01-30 | Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bug in its ASN.1 BER decoding routine. The library will allocate a memory block based on the length f… |
CVE-2016-7544 | High | 7.5 | 2017-01-30 | Crypto++ 5.6.4 incorrectly uses Microsoft's stack-based _malloca and _freea functions. The library will request a block of memory to align a table in memory. I… |
CVE-2016-2519 | Medium | 5.9 | 2017-01-30 | ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which trigg… |
CVE-2016-2518 | Medium | 5.3 | 2017-01-30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer reque… |
CVE-2016-2517 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of… |
CVE-2016-2516 | Medium | 5.3 | 2017-01-30 | NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP addre… |
CVE-2016-10186 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. /var/miniupnpd.conf has no deny rules. |
CVE-2016-10185 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf. |
CVE-2016-10184 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows file reading with ..%2f traversal. |
CVE-2016-10183 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows directory listing with ../ traversal. |
CVE-2016-10182 | Critical | 9.8 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters. |
CVE-2016-10181 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb provides sensitive information for CfgType=get_homeCfg requests. |
CVE-2016-10180 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. WPS PIN generation is based on srand(time(0)) seeding. |
CVE-2016-10179 | High | 7.5 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. There is a hardcoded WPS PIN of 28296607. |
CVE-2016-10178 | Critical | 9.8 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. HELODBG on port 39889 (UDP) launches the "/sbin/telnetd -l /bin/sh" command. |
CVE-2016-10177 | Critical | 9.8 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. Undocumented TELNET and SSH services provide logins to admin with the password admin and root with the p… |
CVE-2016-10176 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special U… |
CVE-2016-10175 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI. This serial number allows a user to obtain… |
CVE-2016-10174 | Critical | 9.8 | 2017-01-30 | The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflo… |
CVE-2016-9554 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrati… |
CVE-2016-9553 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vuln… |
CVE-2016-8575 | Critical | 9.8 | 2017-01-28 | The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482. |
CVE-2016-8574 | Critical | 9.8 | 2017-01-28 | The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print(). |
CVE-2016-7993 | Critical | 9.8 | 2017-01-28 | A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight res… |
CVE-2016-7992 | Critical | 9.8 | 2017-01-28 | The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print(). |
CVE-2016-7986 | Critical | 9.8 | 2017-01-28 | The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions. |
CVE-2016-7985 | Critical | 9.8 | 2017-01-28 | The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print(). |
CVE-2016-7984 | Critical | 9.8 | 2017-01-28 | The TFTP parser in tcpdump before 4.9.0 has a buffer overflow in print-tftp.c:tftp_print(). |
CVE-2016-7983 | Critical | 9.8 | 2017-01-28 | The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). |
CVE-2016-7975 | Critical | 9.8 | 2017-01-28 | The TCP parser in tcpdump before 4.9.0 has a buffer overflow in print-tcp.c:tcp_print(). |
CVE-2016-7974 | Critical | 9.8 | 2017-01-28 | The IP parser in tcpdump before 4.9.0 has a buffer overflow in print-ip.c, multiple functions. |
CVE-2016-7973 | Critical | 9.8 | 2017-01-28 | The AppleTalk parser in tcpdump before 4.9.0 has a buffer overflow in print-atalk.c, multiple functions. |
CVE-2016-7940 | Critical | 9.8 | 2017-01-28 | The STP parser in tcpdump before 4.9.0 has a buffer overflow in print-stp.c, multiple functions. |
CVE-2016-7939 | Critical | 9.8 | 2017-01-28 | The GRE parser in tcpdump before 4.9.0 has a buffer overflow in print-gre.c, multiple functions. |
CVE-2016-7938 | Critical | 9.8 | 2017-01-28 | The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame(). |
CVE-2016-7937 | Critical | 9.8 | 2017-01-28 | The VAT parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:vat_print(). |
CVE-2016-7936 | Critical | 9.8 | 2017-01-28 | The UDP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:udp_print(). |
CVE-2016-7935 | Critical | 9.8 | 2017-01-28 | The RTP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtp_print(). |
CVE-2016-7934 | Critical | 9.8 | 2017-01-28 | The RTCP parser in tcpdump before 4.9.0 has a buffer overflow in print-udp.c:rtcp_print(). |
CVE-2016-7933 | Critical | 9.8 | 2017-01-28 | The PPP parser in tcpdump before 4.9.0 has a buffer overflow in print-ppp.c:ppp_hdlc_if_print(). |
CVE-2016-7932 | Critical | 9.8 | 2017-01-28 | The PIM parser in tcpdump before 4.9.0 has a buffer overflow in print-pim.c:pimv2_check_checksum(). |
CVE-2016-7931 | Critical | 9.8 | 2017-01-28 | The MPLS parser in tcpdump before 4.9.0 has a buffer overflow in print-mpls.c:mpls_print(). |
CVE-2016-7930 | Critical | 9.8 | 2017-01-28 | The LLC/SNAP parser in tcpdump before 4.9.0 has a buffer overflow in print-llc.c:llc_print(). |
CVE-2016-7929 | Critical | 9.8 | 2017-01-28 | The Juniper PPPoE ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-juniper.c:juniper_parse_header(). |
CVE-2016-7928 | Critical | 9.8 | 2017-01-28 | The IPComp parser in tcpdump before 4.9.0 has a buffer overflow in print-ipcomp.c:ipcomp_print(). |
CVE-2016-7927 | Critical | 9.8 | 2017-01-28 | The IEEE 802.11 parser in tcpdump before 4.9.0 has a buffer overflow in print-802_11.c:ieee802_11_radio_print(). |
CVE-2016-7926 | Critical | 9.8 | 2017-01-28 | The Ethernet parser in tcpdump before 4.9.0 has a buffer overflow in print-ether.c:ethertype_print(). |
CVE-2016-7925 | Critical | 9.8 | 2017-01-28 | The compressed SLIP parser in tcpdump before 4.9.0 has a buffer overflow in print-sl.c:sl_if_print(). |
CVE-2016-7924 | Critical | 9.8 | 2017-01-28 | The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oam_print(). |
CVE-2016-7923 | Critical | 9.8 | 2017-01-28 | The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print(). |
CVE-2016-7922 | Critical | 9.8 | 2017-01-28 | The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print(). |
CVE-2016-9795 | High | 7.8 | 2017-01-27 | The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Performance for Infrast… |
CVE-2016-9636 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-9635 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-9634 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-9298 | Medium | 5.5 | 2017-01-27 | Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a de… |
CVE-2016-8330 | Low | 3.7 | 2017-01-27 | Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported version that is affected is 11.3. Difficult t… |
CVE-2016-8329 | Medium | 6.1 | 2017-01-27 | Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Mobile Application Platform). Supported versions… |
CVE-2016-8328 | Low | 3.7 | 2017-01-27 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Java Mission Control). The supported version that is affected is Java SE: 8u112. Diffic… |
CVE-2016-8327 | Medium | 4.4 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.34 and earlier an… |
CVE-2016-8325 | Critical | 9.1 | 2017-01-27 | Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: Internal Operations). Supported versions that are affect… |
CVE-2016-8324 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8323 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8322 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8320 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component of Oracle Financial Services Applications (subcomponent: Core). Supp… |
CVE-2016-8319 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8318 | Medium | 6.8 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported versions that are affected are 5.6.34 and e… |
CVE-2016-8317 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Unit Trust). Supported versions that… |
CVE-2016-8316 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8315 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Infrastructure Code). Supported vers… |
CVE-2016-8314 | Low | 3.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Core Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are affecte… |
CVE-2016-8313 | Medium | 4.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8312 | High | 8.2 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8311 | Medium | 6.5 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8310 | High | 7.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8309 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |