2016 CVEs (page 41)
Page 41 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9997 | Medium | 6.1 | 2016-12-17 | SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecr… |
CVE-2016-9951 | Medium | 6.5 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This… |
CVE-2016-9950 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields ar… |
CVE-2016-9949 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins wi… |
CVE-2016-9160 | High | 8.1 | 2016-12-17 | A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a re… |
CVE-2016-9159 | Medium | 5.9 | 2016-12-17 | A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All… |
CVE-2016-9158 | High | 7.5 | 2016-12-17 | A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All… |
CVE-2016-7454 | High | 8.0 | 2016-12-17 | CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST allows an attacker to… |
CVE-2016-8827 | Medium | 6.5 | 2016-12-16 | NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks p… |
CVE-2016-8826 | Medium | 5.5 | 2016-12-16 | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can c… |
CVE-2016-8825 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an… |
CVE-2016-8824 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where improper acces… |
CVE-2016-8823 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer i… |
CVE-2016-8822 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000E, 0x6000… |
CVE-2016-8821 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may… |
CVE-2016-8820 | Medium | 6.1 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a f… |
CVE-2016-8819 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a… |
CVE-2016-8818 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a pointer passed from… |
CVE-2016-8817 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed… |
CVE-2016-8816 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed… |
CVE-2016-8815 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed… |
CVE-2016-8814 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple point… |
CVE-2016-8813 | High | 7.8 | 2016-12-16 | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple point… |
CVE-2016-9967 | Critical | 9.8 | 2016-12-16 | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows… |
CVE-2016-9966 | Critical | 9.8 | 2016-12-16 | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows… |
CVE-2016-9965 | Critical | 9.8 | 2016-12-16 | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows… |
CVE-2016-9964 | Medium | 6.5 | 2016-12-16 | redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: nam… |
CVE-2016-9838 | High | 7.5 | 2016-12-16 | An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the se… |
CVE-2016-9837 | High | 7.5 | 2016-12-16 | An issue was discovered in templates/beez3/html/com_content/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout over… |
CVE-2016-6657 | High | 7.4 | 2016-12-16 | An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the follow… |
CVE-2016-6656 | High | 7.2 | 2016-12-16 | An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands… |
CVE-2016-3129 | Medium | 6.6 | 2016-12-16 | A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versio… |
CVE-2016-9566 | High | 7.8 | 2016-12-15 | base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the… |
CVE-2016-9565 | Critical | 9.8 | 2016-12-15 | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafte… |
CVE-2016-7892 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successfu… |
CVE-2016-7891 | Medium | 6.1 | 2016-12-15 | Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks. |
CVE-2016-7890 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have security bypass vulnerability in the implementation of the same origin policy. |
CVE-2016-7889 | High | 7.5 | 2016-12-15 | Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure. |
CVE-2016-7888 | Medium | 5.3 | 2016-12-15 | Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak. |
CVE-2016-7887 | High | 7.5 | 2016-12-15 | Adobe ColdFusion Builder versions 2016 update 2 and earlier, 3.0.3 and earlier have an important vulnerability that could lead to information disclosure. |
CVE-2016-7886 | Critical | 9.8 | 2016-12-15 | Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitatio… |
CVE-2016-7885 | High | 8.8 | 2016-12-15 | Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks. |
CVE-2016-7884 | Medium | 6.1 | 2016-12-15 | Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks. |
CVE-2016-7883 | Medium | 6.1 | 2016-12-15 | Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks. |
CVE-2016-7882 | Medium | 6.1 | 2016-12-15 | Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks. |
CVE-2016-7881 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handl… |
CVE-2016-7880 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property… |
CVE-2016-7879 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when h… |
CVE-2016-7878 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the PSDK's MediaPlayer class… |
CVE-2016-7877 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the Action Message Format seri… |
CVE-2016-7876 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Clipboard class related… |
CVE-2016-7875 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable integer overflow vulnerability in the BitmapData class. Succes… |
CVE-2016-7874 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the NetConnection class whe… |
CVE-2016-7873 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the PSDK class related to a… |
CVE-2016-7872 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to… |
CVE-2016-7871 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Worker class. Successfu… |
CVE-2016-7870 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class… |
CVE-2016-7869 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class… |
CVE-2016-7868 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class… |
CVE-2016-7867 | High | 8.8 | 2016-12-15 | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class… |
CVE-2016-7866 | Critical | 9.8 | 2016-12-15 | Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code executio… |
CVE-2016-7856 | Critical | 9.8 | 2016-12-15 | Adobe DNG Converter versions 9.7 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code executio… |
CVE-2016-6934 | Medium | 6.1 | 2016-12-15 | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be… |
CVE-2016-6933 | Medium | 6.1 | 2016-12-15 | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be us… |
CVE-2016-6854 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verif… |
CVE-2016-6853 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public… |
CVE-2016-6852 | Medium | 4.3 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give… |
CVE-2016-6851 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This… |
CVE-2016-6850 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes… |
CVE-2016-6848 | Medium | 5.5 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the clien… |
CVE-2016-6847 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script… |
CVE-2016-6845 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when u… |
CVE-2016-6844 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based o… |
CVE-2016-6843 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code can be injected to contact names. When adding those contacts to a group, th… |
CVE-2016-6842 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "… |
CVE-2016-5740 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This… |
CVE-2016-5124 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead… |
CVE-2016-4048 | Medium | 4.3 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues… |
CVE-2016-4047 | Medium | 4.3 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be place… |
CVE-2016-4046 | Medium | 5.8 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network co… |
CVE-2016-4045 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks t… |
CVE-2016-4028 | High | 7.5 | 2016-12-15 | An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users' credentials. T… |
CVE-2016-4027 | Low | 3.5 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed… |
CVE-2016-4026 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case… |
CVE-2016-3174 | High | 7.4 | 2016-12-15 | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks w… |
CVE-2016-3173 | Medium | 5.4 | 2016-12-15 | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Thos… |
CVE-2016-2840 | Medium | 6.1 | 2016-12-15 | An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject scr… |
CVE-2016-3685 | Medium | 4.7 | 2016-12-14 | SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attacker… |
CVE-2016-3684 | Medium | 4.7 | 2016-12-14 | SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive c… |
CVE-2016-4443 | Medium | 5.5 | 2016-12-14 | Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the… |
CVE-2016-1000156 | Critical | 9.8 | 2016-12-14 | Mailcwp remote file upload vulnerability incomplete fix v1.100 |
CVE-2016-9035 | High | 7.0 | 2016-12-14 | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with t… |
CVE-2016-9034 | High | 7.0 | 2016-12-14 | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with t… |
CVE-2016-9033 | High | 7.0 | 2016-12-14 | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with t… |
CVE-2016-9032 | High | 7.0 | 2016-12-14 | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with t… |
CVE-2016-9031 | High | 7.8 | 2016-12-14 | An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with… |
CVE-2016-8733 | High | 8.8 | 2016-12-14 | An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with… |
CVE-2016-6277 | High | 8.8 | 2016-12-14 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R730… |
CVE-2016-9215 | High | 7.8 | 2016-12-14 | A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the root user. More Inform… |
CVE-2016-9214 | Medium | 6.1 | 2016-12-14 | Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |