2016 CVEs (page 34)
Page 34 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-8308 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8307 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8306 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-8305 | Low | 2.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8304 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8303 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8302 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8301 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8300 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8299 | Medium | 6.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8298 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-8297 | High | 8.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Universal Banking component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are af… |
CVE-2016-8282 | Medium | 6.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-7569 | Medium | 5.5 | 2017-01-27 | Directory traversal vulnerability in docker2aci before 0.13.0 allows remote attackers to write to arbitrary files via a .. (dot dot) in the embedded layer data… |
CVE-2016-6264 | High | 7.5 | 2017-01-27 | Integer signedness error in libc/string/arm/memset.S in uClibc and uClibc-ng before 1.0.16 allows context-dependent attackers to cause a denial of service (cra… |
CVE-2016-5827 | High | 7.5 | 2017-01-27 | The icaltime_from_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted string t… |
CVE-2016-5826 | High | 7.5 | 2017-01-27 | The parser_get_next_char function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) by crafting a string t… |
CVE-2016-5825 | Medium | 5.5 | 2017-01-27 | The icalparser_parse_string function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted ics f… |
CVE-2016-5824 | Medium | 5.5 | 2017-01-27 | libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. |
CVE-2016-5823 | Medium | 5.5 | 2017-01-27 | The icalproperty_new_clone function in libical 0.47 and 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. |
CVE-2016-5623 | Medium | 5.4 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-5614 | Medium | 4.3 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Private Banking component of Oracle Financial Services Applications (subcomponent: Product / Instrument Search). Supported… |
CVE-2016-5590 | High | 7.2 | 2017-01-27 | Vulnerability in the MySQL Enterprise Monitor component of Oracle MySQL (subcomponent: Monitoring: Agent). Supported versions that are affected are 3.1.3.7856… |
CVE-2016-5552 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java S… |
CVE-2016-5549 | Medium | 6.5 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u121 a… |
CVE-2016-5548 | Medium | 6.5 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u131… |
CVE-2016-5547 | Medium | 5.3 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2016-5546 | High | 7.5 | 2017-01-27 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE… |
CVE-2016-5545 | Medium | 6.3 | 2017-01-27 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: GUI). Supported versions that are affected are VirtualBox prior to… |
CVE-2016-5541 | Medium | 4.8 | 2017-01-27 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: NDBAPI). Supported versions that are affected are 7.2.26 and earlier, 7.3… |
CVE-2016-5528 | Critical | 9.0 | 2017-01-27 | Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security). Supported versions that are affected are 2.1.1, 3… |
CVE-2016-5509 | Low | 3.1 | 2017-01-27 | Vulnerability in the Oracle FLEXCUBE Investor Servicing component of Oracle Financial Services Applications (subcomponent: Core). Supported versions that are a… |
CVE-2016-5822 | High | 7.5 | 2017-01-27 | Huawei Oceanstor 5800 before V300R002C10SPC100 allows remote attackers to cause a denial of service (CPU consumption) via a large number of crafted HTTP packet… |
CVE-2016-3996 | Medium | 5.5 | 2017-01-27 | ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted applica… |
CVE-2016-1920 | Medium | 5.5 | 2017-01-27 | Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certif… |
CVE-2016-1919 | Medium | 4.7 | 2017-01-27 | Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge o… |
CVE-2016-9453 | High | 7.8 | 2017-01-27 | The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute a… |
CVE-2016-9448 | High | 7.5 | 2017-01-27 | The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by setting the tags… |
CVE-2016-8411 | Critical | 9.8 | 2017-01-27 | Buffer overflow vulnerability while processing QMI QOS TLVs. Product: Android. Versions: versions that have qmi_qos_srvc.c. Android ID: 31805216. References: Q… |
CVE-2016-1551 | Low | 3.7 | 2017-01-27 | ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate… |
CVE-2016-10003 | High | 7.5 | 2017-01-27 | Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenl… |
CVE-2016-10002 | High | 7.5 | 2017-01-27 | Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 th… |
CVE-2016-9054 | Critical | 9.8 | 2017-01-26 | An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet… |
CVE-2016-9052 | Critical | 9.8 | 2017-01-26 | An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet… |
CVE-2016-9050 | High | 8.2 | 2017-01-26 | An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. A specially crafted p… |
CVE-2016-8710 | High | 7.8 | 2017-01-26 | An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. A crafted BPG image decoded by libbpg can cause a… |
CVE-2016-8227 | High | 7.8 | 2017-01-26 | Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute co… |
CVE-2016-8226 | Medium | 4.9 | 2017-01-26 | The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. |
CVE-2016-8225 | High | 7.8 | 2017-01-26 | Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with eleva… |
CVE-2016-9932 | Low | 3.3 | 2017-01-26 | CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "sup… |
CVE-2016-9317 | Medium | 5.5 | 2017-01-26 | The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system hang) via an oversi… |
CVE-2016-6912 | Critical | 9.8 | 2017-01-26 | Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact… |
CVE-2016-6911 | Medium | 5.5 | 2017-01-26 | The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a… |
CVE-2016-6908 | Medium | 6.1 | 2017-01-26 | Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due to mishandling of… |
CVE-2016-10025 | Medium | 5.5 | 2017-01-26 | VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of s… |
CVE-2016-10024 | Medium | 6.0 | 2017-01-26 | Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asyn… |
CVE-2016-10013 | High | 7.8 | 2017-01-26 | Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation. |
CVE-2016-9222 | Medium | 6.1 | 2017-01-26 | A vulnerability in the web-based management interface of Cisco NetFlow Generation Appliance could allow an unauthenticated, remote attacker to conduct a cross-… |
CVE-2016-9221 | Medium | 4.3 | 2017-01-26 | A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access Points (APs) could a… |
CVE-2016-9220 | Medium | 4.3 | 2017-01-26 | A Denial of Service Vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could allow an unauthenti… |
CVE-2016-9218 | High | 8.8 | 2017-01-26 | A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against th… |
CVE-2016-9216 | Medium | 5.3 | 2017-01-26 | An IKE Packet Parsing Denial of Service Vulnerability in the ipsecmgr process of Cisco ASR 5000 Software could allow an unauthenticated, remote attacker to cau… |
CVE-2016-9307 | Critical | 9.8 | 2017-01-25 | Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format f… |
CVE-2016-9306 | Critical | 9.8 | 2017-01-25 | Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format f… |
CVE-2016-9305 | Critical | 9.8 | 2017-01-25 | Improper handling in the Autodesk FBX-SDK before 2017.1 of type mismatches and previously deleted objects related to reading and converting malformed FBX forma… |
CVE-2016-9304 | High | 8.8 | 2017-01-25 | Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format f… |
CVE-2016-9303 | Critical | 9.8 | 2017-01-25 | Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading… |
CVE-2016-8215 | Medium | 6.1 | 2017-01-25 | EMC RSA Security Analytics 10.5.3 and 10.6.2 contains fixes for a Reflected Cross-Site Scripting vulnerability that could potentially be exploited by malicious… |
CVE-2016-8214 | Medium | 6.7 | 2017-01-25 | EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3.0 and 7.3.1 contain a vulnerability that may allow malicious administrators to compro… |
CVE-2016-10162 | High | 7.5 | 2017-01-24 | The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NU… |
CVE-2016-10161 | High | 7.5 | 2017-01-24 | The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cau… |
CVE-2016-10160 | Critical | 9.8 | 2017-01-24 | Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial… |
CVE-2016-10159 | High | 7.5 | 2017-01-24 | Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial… |
CVE-2016-10158 | High | 7.5 | 2017-01-24 | The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a de… |
CVE-2016-9447 | High | 7.8 | 2017-01-23 | The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute… |
CVE-2016-9446 | High | 7.5 | 2017-01-23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumb… |
CVE-2016-9445 | High | 7.5 | 2017-01-23 | Integer overflow in the vmnc decoder in the gstreamer allows remote attackers to cause a denial of service (crash) via large width and height values, which tri… |
CVE-2016-9401 | Medium | 5.5 | 2017-01-23 | popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. |
CVE-2016-9386 | High | 7.8 | 2017-01-23 | The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges… |
CVE-2016-9385 | Medium | 6.0 | 2017-01-23 | The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host cr… |
CVE-2016-9383 | High | 8.8 | 2017-01-23 | Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a den… |
CVE-2016-9382 | High | 7.8 | 2017-01-23 | Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of serv… |
CVE-2016-9381 | High | 7.5 | 2017-01-23 | Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vu… |
CVE-2016-9380 | High | 7.5 | 2017-01-23 | The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbi… |
CVE-2016-9379 | High | 7.9 | 2017-01-23 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbit… |
CVE-2016-9081 | Critical | 9.8 | 2017-01-23 | Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via… |
CVE-2016-9012 | High | 8.8 | 2017-01-23 | CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane… |
CVE-2016-7792 | High | 8.8 | 2017-01-23 | Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it. |
CVE-2016-7567 | Critical | 9.8 | 2017-01-23 | Buffer overflow in the SLPFoldWhiteSpace function in common/slp_compare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted strin… |
CVE-2016-7410 | Medium | 5.5 | 2017-01-23 | The _dwarf_read_loc_section function in dwarf_loc.c in libdwarf 20160613 allows attackers to cause a denial of service (buffer over-read) via a crafted file. |
CVE-2016-7102 | High | 8.4 | 2017-01-23 | ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a "special path" in the C: driv… |
CVE-2016-7037 | High | 7.5 | 2017-01-23 | The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attacker… |
CVE-2016-7036 | Critical | 9.8 | 2017-01-23 | python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys. |
CVE-2016-6920 | High | 7.5 | 2017-01-23 | Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause a denial of service (applic… |
CVE-2016-6668 | High | 7.5 | 2017-01-23 | The Atlassian Hipchat Integration Plugin for Bitbucket Server 6.26.0 before 6.27.5, 6.28.0 before 7.3.7, and 7.4.0 before 7.8.17; Confluence HipChat plugin 6.2… |
CVE-2016-6603 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. |
CVE-2016-6602 | Critical | 9.8 | 2017-01-23 | ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwor… |
CVE-2016-6601 | High | 7.5 | 2017-01-23 | Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files v… |
CVE-2016-6600 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbit… |
CVE-2016-6582 | Critical | 9.1 | 2017-01-23 | The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement t… |