2016 CVEs (page 36)
Page 36 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6271 | High | 7.5 | 2017-01-18 | The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2… |
CVE-2016-4019 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 104477. |
CVE-2016-3999 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3415 | Critical | 9.1 | 2017-01-18 | Zimbra Collaboration before 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors, aka bug 102276. |
CVE-2016-3414 | Medium | 6.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.6.0 Patch 7 allows remote authenticated users to affect availability via unknown vectors, aka bug 10… |
CVE-2016-3413 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103996. |
CVE-2016-3412 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3411 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3410 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3409 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3408 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2016-3407 | Medium | 6.1 | 2017-01-18 | Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unsp… |
CVE-2016-3406 | High | 8.8 | 2017-01-18 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to hijack the authentication of unspecif… |
CVE-2016-3405 | High | 7.5 | 2017-01-18 | Multiple unspecified vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to affect integrity via unknown vectors, aka bugs 103961 and 1… |
CVE-2016-3404 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect integrity via unknown vectors, aka bug 103959. |
CVE-2016-3402 | High | 7.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote attackers to affect confidentiality via unknown vectors, aka bug 99167. |
CVE-2016-3401 | Medium | 6.5 | 2017-01-18 | Unspecified vulnerability in Zimbra Collaboration before 8.7.0 allows remote authenticated users to affect integrity via unknown vectors, aka bug 99810. |
CVE-2016-10086 | High | 8.1 | 2017-01-18 | RESTful web services in CA Service Desk Manager 12.9 and CA Service Desk Management 14.1 might allow remote authenticated users to read or modify task informat… |
CVE-2016-6897 | Medium | 6.5 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remo… |
CVE-2016-6896 | High | 7.1 | 2017-01-18 | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated us… |
CVE-2016-10148 | Medium | 4.3 | 2017-01-18 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugin… |
CVE-2016-10147 | Medium | 5.5 | 2017-01-18 | crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AF_A… |
CVE-2016-9844 | Medium | 4.0 | 2017-01-18 | Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compressio… |
CVE-2016-9584 | Critical | 9.1 | 2017-01-18 | libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file. |
CVE-2016-9297 | High | 7.5 | 2017-01-18 | The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_SETGET_C16ASCII or… |
CVE-2016-9279 | High | 7.5 | 2017-01-18 | Use-after-free vulnerability in the Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows attackers to obtain sensitive info… |
CVE-2016-9278 | Medium | 5.5 | 2017-01-18 | The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service (kernel panic) via a craf… |
CVE-2016-9273 | Medium | 5.5 | 2017-01-18 | tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF… |
CVE-2016-9109 | High | 7.5 | 2017-01-18 | Artifex Software MuJS allows attackers to cause a denial of service (crash) via vectors related to incomplete escape sequences. NOTE: this vulnerability exist… |
CVE-2016-7999 | High | 7.4 | 2017-01-18 | ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery (SSRF) attacks via a URL in the var_url pa… |
CVE-2016-7998 | High | 8.8 | 2017-01-18 | The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a… |
CVE-2016-7997 | High | 7.5 | 2017-01-18 | The WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial of service (assertion failure and crash) via vectors relat… |
CVE-2016-7996 | Critical | 9.8 | 2017-01-18 | Heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with… |
CVE-2016-7982 | High | 7.5 | 2017-01-18 | Directory traversal vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the… |
CVE-2016-7981 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the va… |
CVE-2016-7980 | High | 8.8 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication o… |
CVE-2016-7906 | Medium | 5.5 | 2017-01-18 | magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file. |
CVE-2016-7799 | Medium | 6.5 | 2017-01-18 | MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. |
CVE-2016-7564 | High | 7.5 | 2017-01-18 | Heap-based buffer overflow in the Fp_toString function in jsfunction.c in Artifex Software MuJS allows attackers to cause a denial of service (crash) via craft… |
CVE-2016-7563 | High | 7.5 | 2017-01-18 | The chartorune function in Artifex Software MuJS allows attackers to cause a denial of service (out-of-bounds read) via a * (asterisk) at the end of the input. |
CVE-2016-7150 | Medium | 5.4 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site… |
CVE-2016-7149 | Medium | 6.1 | 2017-01-18 | Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to… |
CVE-2016-7144 | High | 8.1 | 2017-01-18 | The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints an… |
CVE-2016-7101 | Medium | 6.5 | 2017-01-18 | The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file. |
CVE-2016-6823 | High | 7.5 | 2017-01-18 | Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width valu… |
CVE-2016-6527 | High | 7.8 | 2017-01-18 | The SmartCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and r… |
CVE-2016-6526 | High | 7.8 | 2017-01-18 | The SpamCall Activity component in Telecom application on Samsung Note device L(5.0/5.1) and M(6.0) allows attackers to cause a denial of service (crash and re… |
CVE-2016-2233 | High | 7.5 | 2017-01-18 | Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash)… |
CVE-2016-2087 | High | 7.4 | 2017-01-18 | Directory traversal vulnerability in the client in HexChat 2.11.0 allows remote IRC servers to read or modify arbitrary files via a .. (dot dot) in the server… |
CVE-2016-7904 | High | 8.0 | 2017-01-16 | Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requ… |
CVE-2016-8207 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in CliMonitorReportServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remot… |
CVE-2016-8206 | High | 7.5 | 2017-01-14 | A Directory Traversal vulnerability in servlet SoftwareImageUpload in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow r… |
CVE-2016-8205 | Critical | 9.8 | 2017-01-14 | A Directory Traversal vulnerability in DashboardFileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow r… |
CVE-2016-8204 | Critical | 9.8 | 2017-01-14 | A Directory Traversal vulnerability in FileReceiveServlet in the Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote att… |
CVE-2016-8201 | High | 8.0 | 2017-01-14 | A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a logged-in user into ma… |
CVE-2016-10142 | High | 8.6 | 2017-01-14 | An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all affected IPv6 implemen… |
CVE-2016-9813 | Medium | 5.5 | 2017-01-13 | The _parse_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and cras… |
CVE-2016-9812 | High | 7.5 | 2017-01-13 | The gst_mpegts_section_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds read)… |
CVE-2016-9811 | Medium | 4.7 | 2017-01-13 | The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a den… |
CVE-2016-9810 | Medium | 5.5 | 2017-01-13 | The gst_decode_chain_free_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to cause a denial of s… |
CVE-2016-9809 | High | 7.8 | 2017-01-13 | Off-by-one error in the gst_h264_parse_set_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a crafted file, whic… |
CVE-2016-9808 | High | 7.5 | 2017-01-13 | The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip a… |
CVE-2016-9807 | Medium | 5.5 | 2017-01-13 | The flx_decode_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (invalid memory read and… |
CVE-2016-9312 | High | 7.5 | 2017-01-13 | ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet. |
CVE-2016-9311 | Medium | 5.9 | 2017-01-13 | ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a c… |
CVE-2016-9310 | Medium | 6.5 | 2017-01-13 | The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet. |
CVE-2016-9107 | High | 7.5 | 2017-01-13 | The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensitive information via unspecified vectors. |
CVE-2016-8883 | Medium | 5.5 | 2017-01-13 | The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted fi… |
CVE-2016-8882 | Medium | 5.5 | 2017-01-13 | The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereferenc… |
CVE-2016-8671 | Medium | 5.9 | 2017-01-13 | The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the se… |
CVE-2016-8467 | Medium | 5.5 | 2017-01-13 | An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. This issue is rated… |
CVE-2016-7434 | High | 7.5 | 2017-01-13 | The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. |
CVE-2016-7433 | Medium | 5.3 | 2017-01-13 | NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to… |
CVE-2016-7431 | Medium | 5.3 | 2017-01-13 | NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exist… |
CVE-2016-7429 | Low | 3.7 | 2017-01-13 | NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of servi… |
CVE-2016-7428 | Medium | 4.3 | 2017-01-13 | ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet. |
CVE-2016-7427 | Medium | 4.3 | 2017-01-13 | The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode pa… |
CVE-2016-7426 | High | 7.5 | 2017-01-13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers… |
CVE-2016-6887 | Medium | 5.9 | 2017-01-13 | The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the se… |
CVE-2016-6886 | High | 7.5 | 2017-01-13 | The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value o… |
CVE-2016-6885 | High | 7.5 | 2017-01-13 | The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the… |
CVE-2016-2090 | Critical | 9.8 | 2017-01-13 | Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, which trigger a heap-b… |
CVE-2016-9882 | High | 7.5 | 2017-01-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the creden… |
CVE-2016-3130 | High | 8.1 | 2017-01-13 | An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to o… |
CVE-2016-3128 | High | 8.2 | 2017-01-13 | A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BE… |
CVE-2016-10141 | Critical | 9.8 | 2017-01-13 | An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1f3858fb860f4fcd4b20… |
CVE-2016-10140 | High | 7.5 | 2017-01-13 | Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which al… |
CVE-2016-10139 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.fota and com.adups… |
CVE-2016-10138 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and… |
CVE-2016-10137 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app w… |
CVE-2016-10136 | High | 7.8 | 2017-01-13 | An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoProvider in the app w… |
CVE-2016-10135 | Medium | 5.5 | 2017-01-13 | An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU Advance 5.0, and BL… |
CVE-2016-9299 | Critical | 9.8 | 2017-01-12 | The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which… |
CVE-2016-6492 | High | 7.8 | 2017-01-12 | The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes a… |
CVE-2016-5737 | Medium | 6.1 | 2017-01-12 | The Gerrit configuration in the Openstack Puppet module for Gerrit (aka puppet-gerrit) improperly marks text/html as a safe mimetype, which might allow remote… |
CVE-2016-5715 | Medium | 6.1 | 2017-01-12 | Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web si… |
CVE-2016-3152 | Critical | 9.8 | 2017-01-12 | Barco ClickShare CSC-1 devices with firmware before 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firmware imag… |
CVE-2016-3151 | High | 7.5 | 2017-01-12 | Directory traversal vulnerability in the wallpaper parsing functionality in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with fi… |
CVE-2016-3150 | Medium | 6.1 | 2017-01-12 | Cross-site scripting (XSS) vulnerability in wallpaper.php in the Base Unit in Barco ClickShare CSC-1 devices with firmware before 01.09.03, CSM-1 devices with… |
CVE-2016-3149 | Critical | 9.8 | 2017-01-12 | Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code v… |