2016 CVEs (page 35)
Page 35 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6521 | High | 8.8 | 2017-01-23 | Cross-site request forgery (CSRF) vulnerability in Grails console (aka Grails Debug Console and Grails Web Console) 2.0.7, 1.5.10, and earlier allows remote at… |
CVE-2016-6517 | Critical | 9.8 | 2017-01-23 | Directory traversal vulnerability in Liferay 5.1.0 allows remote attackers to have unspecified impact via a %2E%2E (encoded dot dot) in the minifierBundleDir p… |
CVE-2016-6484 | Medium | 6.1 | 2017-01-23 | CRLF injection vulnerability in Infoblox Network Automation NetMRI before 7.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP respo… |
CVE-2016-6223 | Critical | 9.1 | 2017-01-23 | The TIFFReadRawStrip1 and TIFFReadRawTile1 functions in tif_read.c in libtiff before 4.0.7 allows remote attackers to cause a denial of service (crash) or poss… |
CVE-2016-6164 | Critical | 9.8 | 2017-01-23 | Integer overflow in the mov_build_index function in libavformat/mov.c in FFmpeg before 2.8.8, 3.0.x before 3.0.3 and 3.1.x before 3.1.1 allows remote attackers… |
CVE-2016-6160 | High | 7.5 | 2017-01-23 | tcprewrite in tcpreplay before 4.1.2 allows remote attackers to cause a denial of service (segmentation fault) via a large frame, a related issue to CVE-2017-1… |
CVE-2016-5876 | Medium | 5.9 | 2017-01-23 | ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via a direct request. |
CVE-2016-5873 | Critical | 9.8 | 2017-01-23 | Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters… |
CVE-2016-5742 | Critical | 9.8 | 2017-01-23 | SQL injection vulnerability in the XML-RPC interface in Movable Type Pro and Advanced 6.x before 6.1.3 and 6.2.x before 6.2.6 and Movable Type Open Source 5.2… |
CVE-2016-5720 | High | 7.8 | 2017-01-23 | Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan ho… |
CVE-2016-5697 | High | 7.5 | 2017-01-23 | Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors. |
CVE-2016-5237 | Medium | 4.8 | 2017-01-23 | Valve Steam 3.42.16.13 uses weak permissions for the files in the Steam program directory, which allows local users to modify the files and possibly gain privi… |
CVE-2016-5119 | High | 7.5 | 2017-01-23 | The automatic update feature in KeePass 2.33 and earlier allows man-in-the-middle attackers to execute arbitrary code by spoofing the version check response an… |
CVE-2016-5091 | High | 8.1 | 2017-01-23 | Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code vi… |
CVE-2016-4793 | High | 7.5 | 2017-01-23 | The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
CVE-2016-4484 | Medium | 6.8 | 2017-01-23 | The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts w… |
CVE-2016-4340 | High | 8.8 | 2017-01-23 | The impersonate feature in Gitlab 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows re… |
CVE-2016-4338 | High | 8.1 | 2017-01-23 | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, whe… |
CVE-2016-4056 | Medium | 6.1 | 2017-01-23 | Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2016-4055 | Medium | 6.5 | 2017-01-23 | The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string… |
CVE-2016-4010 | Critical | 9.8 | 2017-01-23 | Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shoppin… |
CVE-2016-3177 | Critical | 9.8 | 2017-01-23 | Multiple use-after-free and double-free vulnerabilities in gifcolor.c in GIFLIB 5.1.2 have unspecified impact and attack vectors. |
CVE-2016-3147 | Critical | 9.8 | 2017-01-23 | Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of service and p… |
CVE-2016-2783 | Critical | 9.8 | 2017-01-23 | Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I… |
CVE-2016-2242 | Critical | 9.8 | 2017-01-23 | Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php. |
CVE-2016-1925 | Critical | 9.8 | 2017-01-23 | Integer underflow in header.c in lha allows remote attackers to have unspecified impact via a large header size value for the (1) level0 or (2) level1 header i… |
CVE-2016-1417 | High | 8.8 | 2017-01-23 | Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan hor… |
CVE-2016-1281 | High | 7.8 | 2017-01-23 | Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to… |
CVE-2016-0769 | High | 8.8 | 2017-01-23 | Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL co… |
CVE-2016-0765 | Medium | 6.1 | 2017-01-23 | Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web… |
CVE-2016-9870 | Medium | 6.7 | 2017-01-23 | EMC Isilon OneFS 8.0.0.0, EMC Isilon OneFS 7.2.1.0 - 7.2.1.2, EMC Isilon OneFS 7.2.0.x, EMC Isilon OneFS 7.1.1.0 - 7.1.1.10, and EMC Isilon OneFS 7.1.0.x is af… |
CVE-2016-8213 | Medium | 6.1 | 2017-01-23 | EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum… |
CVE-2016-10157 | Critical | 9.8 | 2017-01-23 | Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because th… |
CVE-2016-10156 | High | 7.8 | 2017-01-23 | A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers… |
CVE-2016-10104 | Medium | 5.9 | 2017-01-23 | Information Disclosure can occur in sshProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attacker to… |
CVE-2016-10103 | High | 8.1 | 2017-01-23 | Information Disclosure can occur in encryptionProfiles.jsd in Hitek Software's Automize because of the Read attribute being set for Users. This allows an attac… |
CVE-2016-10102 | High | 8.1 | 2017-01-23 | hitek.jar in Hitek Software's Automize uses weak encryption when encrypting SSH/SFTP and Encryption profile passwords. This allows an attacker to retrieve the… |
CVE-2016-10101 | High | 8.1 | 2017-01-23 | Information Disclosure can occur in Hitek Software's Automize 10.x and 11.x passManager.jsd. Users have the Read attribute, which allows an attacker to recover… |
CVE-2016-9436 | Medium | 6.5 | 2017-01-20 | parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file… |
CVE-2016-9435 | Medium | 6.5 | 2017-01-20 | The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application… |
CVE-2016-6253 | High | 7.8 | 2017-01-20 | mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the… |
CVE-2016-5323 | High | 7.5 | 2017-01-20 | The _TIFFFax3fillruns function in libtiff before 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a… |
CVE-2016-5321 | Medium | 6.5 | 2017-01-20 | The DumpModeDecode function in libtiff 4.0.6 and earlier allows attackers to cause a denial of service (invalid read and crash) via a crafted tiff image. |
CVE-2016-5319 | Medium | 6.5 | 2017-01-20 | Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted bmp file. |
CVE-2016-5318 | Medium | 6.5 | 2017-01-20 | Stack-based buffer overflow in the _TIFFVGetField function in libtiff 4.0.6 and earlier allows remote attackers to crash the application via a crafted tiff. |
CVE-2016-5317 | Medium | 6.5 | 2017-01-20 | Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows att… |
CVE-2016-5316 | Medium | 6.5 | 2017-01-20 | Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a… |
CVE-2016-8644 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. |
CVE-2016-8643 | Medium | 4.3 | 2017-01-20 | In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. |
CVE-2016-8642 | Medium | 5.3 | 2017-01-20 | In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. |
CVE-2016-7038 | High | 7.3 | 2017-01-20 | In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. |
CVE-2016-5014 | Medium | 5.4 | 2017-01-20 | In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. |
CVE-2016-5013 | Medium | 5.4 | 2017-01-20 | In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam. |
CVE-2016-5012 | Medium | 5.3 | 2017-01-20 | In Moodle 3.x, glossary search displays entries without checking user permissions to view them. |
CVE-2016-10143 | High | 7.5 | 2017-01-20 | A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field. |
CVE-2016-5725 | Medium | 5.9 | 2017-01-19 | Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbit… |
CVE-2016-9016 | High | 8.8 | 2017-01-19 | Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. |
CVE-2016-7794 | Critical | 9.8 | 2017-01-19 | sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name. |
CVE-2016-7793 | High | 8.8 | 2017-01-19 | sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL. |
CVE-2016-7545 | High | 8.8 | 2017-01-19 | SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. |
CVE-2016-7543 | High | 8.4 | 2017-01-19 | Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. |
CVE-2016-10075 | High | 7.8 | 2017-01-19 | The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the curren… |
CVE-2016-9650 | Medium | 4.3 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which allowed a remote attac… |
CVE-2016-5226 | Medium | 6.1 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of the current tab, whi… |
CVE-2016-5225 | Medium | 4.3 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote… |
CVE-2016-5224 | Medium | 4.3 | 2017-01-19 | A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2… |
CVE-2016-5223 | Medium | 6.5 | 2017-01-19 | Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potenti… |
CVE-2016-5222 | Medium | 6.5 | 2017-01-19 | Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to… |
CVE-2016-5221 | Medium | 6.3 | 2017-01-19 | Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibly allowed a remote… |
CVE-2016-5220 | Medium | 6.5 | 2017-01-19 | PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs, which allowe… |
CVE-2016-5219 | Medium | 6.3 | 2017-01-19 | A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potent… |
CVE-2016-5218 | Medium | 6.5 | 2017-01-19 | The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within PDFs… |
CVE-2016-5217 | Medium | 6.5 | 2017-01-19 | The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted access to privileged p… |
CVE-2016-5216 | Medium | 6.3 | 2017-01-19 | A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perform… |
CVE-2016-5215 | Medium | 6.3 | 2017-01-19 | A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to perfo… |
CVE-2016-5214 | Medium | 4.3 | 2017-01-19 | Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file from receiving the… |
CVE-2016-5213 | High | 8.8 | 2017-01-19 | A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially… |
CVE-2016-5212 | Medium | 6.5 | 2017-01-19 | Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which allowed a remote att… |
CVE-2016-5211 | High | 8.8 | 2017-01-19 | A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potenti… |
CVE-2016-5210 | High | 8.8 | 2017-01-19 | Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowe… |
CVE-2016-5209 | High | 8.8 | 2017-01-19 | Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote at… |
CVE-2016-5208 | Medium | 6.1 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous… |
CVE-2016-5207 | Medium | 6.1 | 2017-01-19 | In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could occur during the rem… |
CVE-2016-5206 | High | 8.8 | 2017-01-19 | The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirects, which allowed a… |
CVE-2016-5205 | Medium | 6.1 | 2017-01-19 | Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote attacker to inject arb… |
CVE-2016-5204 | Medium | 6.1 | 2017-01-19 | Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.8… |
CVE-2016-5203 | High | 8.8 | 2017-01-19 | A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potenti… |
CVE-2016-5201 | Medium | 6.5 | 2017-01-19 | A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840.98 for Mac allowed… |
CVE-2016-5200 | High | 8.8 | 2017-01-19 | V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android incorrectly applied… |
CVE-2016-5199 | High | 8.8 | 2017-01-19 | An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.28… |
CVE-2016-5198 | High | 8.8 | 2017-01-19 | V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumpt… |
CVE-2016-5197 | High | 8.8 | 2017-01-19 | The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote attacker who had compro… |
CVE-2016-5196 | High | 8.8 | 2017-01-19 | The content renderer client in Google Chrome prior to 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downloaded files, which a… |
CVE-2016-9680 | High | 7.5 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors. |
CVE-2016-9679 | Critical | 9.8 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer. |
CVE-2016-9678 | Critical | 9.8 | 2017-01-18 | Use-after-free vulnerability in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-9677 | Medium | 5.3 | 2017-01-18 | Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors. |
CVE-2016-9676 | Critical | 9.8 | 2017-01-18 | Buffer overflow in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-6497 | High | 7.5 | 2017-01-18 | main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging set… |
CVE-2016-6283 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.10.6 allows remote attackers to inject arbitrary web script or HTML via the newFileNa… |