2016 CVEs (page 44)
Page 44 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9157 | Critical | 9.8 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to u… |
CVE-2016-9156 | High | 7.3 | 2016-12-05 | A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to upload, download, or delete files in certain parts of the fil… |
CVE-2016-9804 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer overflow was observed in "commands_dump" function in "tools/parser/csr.c" source file. The issue exists because "commands" array is ove… |
CVE-2016-9803 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, an out-of-bounds read was observed in "le_meta_ev_dump" function in "tools/parser/hci.c" source file. This issue exists because 'subevent' (whic… |
CVE-2016-9802 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer over-read was identified in "l2cap_packet" function in "monitor/packet.c" source file. This issue can be triggered by processing a corr… |
CVE-2016-9801 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer overflow was observed in "set_ext_ctrl" function in "tools/parser/l2cap.c" source file when processing corrupted dump file. |
CVE-2016-9800 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer overflow was observed in "pin_code_reply_dump" function in "tools/parser/hci.c" source file. The issue exists because "pin" array is ov… |
CVE-2016-9799 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer overflow was observed in "pklg_read_hci" function in "btsnoop.c" source file. This issue can be triggered by processing a corrupted dum… |
CVE-2016-9798 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a use-after-free was identified in "conf_opt" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corrup… |
CVE-2016-9797 | Medium | 5.3 | 2016-12-03 | In BlueZ 5.42, a buffer over-read was observed in "l2cap_dump" function in "tools/parser/l2cap.c" source file. This issue can be triggered by processing a corr… |
CVE-2016-9796 | Critical | 9.8 | 2016-12-03 | Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker ca… |
CVE-2016-9638 | High | 7.8 | 2016-12-02 | In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virs… |
CVE-2016-9479 | High | 7.5 | 2016-12-02 | The "lost password" functionality in b2evolution before 6.7.9 allows remote attackers to reset arbitrary user passwords via a crafted request. |
CVE-2016-9752 | High | 8.6 | 2016-12-01 | In Serendipity before 2.0.5, an attacker can bypass SSRF protection by using a malformed IP address (e.g., http://127.1) or a 30x (aka Redirection) HTTP status… |
CVE-2016-9751 | Medium | 6.1 | 2016-12-01 | Cross-site scripting (XSS) vulnerability in the search results front end in Piwigo 2.8.3 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2016-3055 | High | 8.1 | 2016-12-01 | IBM FileNet Workplace 4.0.2 before 4.0.2.14 LA012 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) v… |
CVE-2016-3047 | Medium | 6.8 | 2016-12-01 | Open redirect vulnerability in IBM FileNet Workplace 4.0.2 through 4.0.2.14 IF001 allows remote authenticated users to redirect users to arbitrary web sites an… |
CVE-2016-3044 | Medium | 6.5 | 2016-12-01 | The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite… |
CVE-2016-3033 | High | 8.1 | 2016-12-01 | IBM AppScan Source 8.7 through 9.0.3.3 allows remote authenticated users to read arbitrary files or cause a denial of service (memory consumption) via an XML d… |
CVE-2016-3012 | High | 7.5 | 2016-12-01 | IBM API Connect (aka APIConnect) before 5.0.3.0 with NPM before 2.2.8 includes certain internal server credentials in the software package, which might allow r… |
CVE-2016-2994 | Medium | 5.4 | 2016-12-01 | Cross-site scripting (XSS) vulnerability in IBM UrbanCode Deploy 6.2.x before 6.2.1.2 allows remote authenticated users to inject arbitrary web script or HTML… |
CVE-2016-2991 | Medium | 5.4 | 2016-12-01 | Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus Protector for Mail Security 2.8.0.0 through 2.8.1.0 before 2.8.1.0-22115 allow remote authenti… |
CVE-2016-2955 | Medium | 5.4 | 2016-12-01 | Cross-site scripting (XSS) vulnerability in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script… |
CVE-2016-2946 | High | 7.8 | 2016-12-01 | Stack-based buffer overflow in the ax Shared Libraries in the Agent in IBM Tivoli Monitoring (ITM) 6.2.2 before FP9, 6.2.3 before FP5, and 6.3.0 before FP2 on… |
CVE-2016-2917 | High | 8.8 | 2016-11-30 | The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive password information… |
CVE-2016-2887 | High | 8.1 | 2016-11-30 | IBM IMS Enterprise Suite Data Provider before 3.2.0.1 for Microsoft .NET allows remote authenticated users to obtain sensitive information or modify data via u… |
CVE-2016-2884 | High | 8.0 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3.1, in an unspecified non-default configuration, al… |
CVE-2016-2881 | Medium | 6.5 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 and QRadar Incident Forensics 7.2 before 7.2.7 allow remote attackers to bypass intended access re… |
CVE-2016-2878 | High | 8.0 | 2016-11-30 | Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the… |
CVE-2016-2877 | Low | 3.3 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to… |
CVE-2016-2876 | High | 7.5 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it easier for remote a… |
CVE-2016-2874 | Low | 3.1 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information… |
CVE-2016-2873 | High | 8.8 | 2016-11-30 | SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands… |
CVE-2016-2871 | High | 7.8 | 2016-11-30 | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive inf… |
CVE-2016-2869 | Medium | 5.4 | 2016-11-30 | Multiple cross-site scripting (XSS) vulnerabilities in the UI in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote authenticated users… |
CVE-2016-8222 | Medium | 4.4 | 2016-11-30 | A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level… |
CVE-2016-9564 | High | 7.5 | 2016-11-30 | Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET request requesting a long URI with only '/' and '.' ch… |
CVE-2016-5987 | Medium | 5.3 | 2016-11-30 | IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.10 IF4, and 7.6 before 7.6.0.5 IF3 allows remote attackers to obtain sensitive information v… |
CVE-2016-5905 | Medium | 5.4 | 2016-11-30 | Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.10 IF3 and 7.6 before 7.6.0.5 IF2 allows remote authenticated users to… |
CVE-2016-5890 | Medium | 5.3 | 2016-11-30 | IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote authenticated users to change arbitrary passwords via unspecified v… |
CVE-2016-3057 | Medium | 6.1 | 2016-11-30 | Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.2 before 5020500_14 and 5.2 06 before 5020602_1 allows remote attackers to inject arb… |
CVE-2016-3014 | Medium | 5.4 | 2016-11-30 | Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11 and 5.0 before 5.0.2 iFix17, Rational Quali… |
CVE-2016-3009 | Low | 3.5 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hi… |
CVE-2016-3004 | Medium | 4.6 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to hi… |
CVE-2016-3002 | Low | 2.1 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows physically proximate attackers to obtain sensitive information by reading cached da… |
CVE-2016-2963 | High | 8.8 | 2016-11-30 | Cross-site request forgery (CSRF) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to hijack the authentication of arbitrary use… |
CVE-2016-2958 | Medium | 4.3 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading an "archaic"… |
CVE-2016-2957 | Medium | 4.3 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 allows remote authenticated users to obtain sensitive information by reading a stack trace… |
CVE-2016-2953 | Low | 3.7 | 2016-11-30 | IBM Connections 4.0 through CR4, 4.5 through CR5, and 5.0 before CR4 does not require SSL, which allows remote attackers to obtain sensitive cleartext informat… |
CVE-2016-2952 | Low | 3.7 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive informatio… |
CVE-2016-2951 | Low | 3.7 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not properly set the default encryption strength, which makes it easier for remote attackers to defeat cryptographi… |
CVE-2016-2950 | Medium | 6.5 | 2016-11-30 | SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vecto… |
CVE-2016-2949 | Low | 3.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by reading cached web pages from a different user's session. |
CVE-2016-2948 | High | 7.8 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to discover hardcoded credentials via unspecified vectors. |
CVE-2016-2944 | Critical | 9.8 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brut… |
CVE-2016-2943 | Low | 1.9 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file. |
CVE-2016-2940 | Medium | 5.3 | 2016-11-30 | Multiple unspecified vulnerabilities in IBM BigFix Remote Control before 9.1.3 allow remote attackers to obtain sensitive information via unknown vectors. |
CVE-2016-2937 | Medium | 6.5 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related… |
CVE-2016-2936 | High | 7.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 uses cleartext storage for unspecified passwords, which allows local users to obtain sensitive information via unknown v… |
CVE-2016-2935 | Medium | 5.3 | 2016-11-30 | The broker application in IBM BigFix Remote Control before 9.1.3 allows remote attackers to cause a denial of service via an invalid HTTP request. |
CVE-2016-2934 | Medium | 6.1 | 2016-11-30 | Cross-site scripting (XSS) vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2016-2933 | Medium | 6.8 | 2016-11-30 | Directory traversal vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated administrators to read arbitrary files via a crafted re… |
CVE-2016-2932 | Medium | 5.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to conduct XML injection attacks via unspecified vectors. |
CVE-2016-2931 | Medium | 5.3 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive cleartext information by sniffing the network. |
CVE-2016-9481 | Critical | 9.8 | 2016-11-29 | In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is… |
CVE-2016-9480 | Critical | 9.1 | 2016-11-29 | libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approac… |
CVE-2016-8224 | Medium | 4.4 | 2016-11-29 | A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install… |
CVE-2016-8223 | High | 7.8 | 2016-11-29 | During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on so… |
CVE-2016-1251 | High | 8.1 | 2016-11-29 | There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3.x and 4.x before 4… |
CVE-2016-1247 | High | 7.8 | 2016-11-29 | The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubu… |
CVE-2016-5685 | High | 8.8 | 2016-11-29 | Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection. |
CVE-2016-5765 | Medium | 6.5 | 2016-11-29 | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) a… |
CVE-2016-5393 | High | 8.8 | 2016-11-29 | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with… |
CVE-2016-9644 | High | 7.8 | 2016-11-28 | The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible… |
CVE-2016-9555 | Critical | 9.8 | 2016-11-28 | The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote atta… |
CVE-2016-9313 | High | 7.8 | 2016-11-28 | security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, whic… |
CVE-2016-9191 | Medium | 5.5 | 2016-11-28 | The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service… |
CVE-2016-9178 | Medium | 5.5 | 2016-11-28 | The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows loc… |
CVE-2016-9084 | High | 7.8 | 2016-11-28 | drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integ… |
CVE-2016-9083 | High | 7.8 | 2016-11-28 | drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corr… |
CVE-2016-8650 | Medium | 5.5 | 2016-11-28 | The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users… |
CVE-2016-8646 | Medium | 5.5 | 2016-11-28 | The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigge… |
CVE-2016-8645 | Medium | 5.5 | 2016-11-28 | The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted a… |
CVE-2016-8633 | Medium | 6.8 | 2016-11-28 | drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via craf… |
CVE-2016-8632 | High | 7.8 | 2016-11-28 | The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the… |
CVE-2016-8630 | Medium | 5.5 | 2016-11-28 | The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (… |
CVE-2016-2929 | High | 8.1 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 does not properly restrict password choices, which makes it easier for remote attackers to obtain access via a brute-for… |
CVE-2016-2928 | Medium | 4.3 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs. |
CVE-2016-2927 | Medium | 5.9 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 does not properly restrict the set of available encryption algorithms, which makes it easier for remote attackers to def… |
CVE-2016-2926 | Medium | 5.4 | 2016-11-25 | Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix19, and 6.0 before 6… |
CVE-2016-0319 | High | 7.5 | 2016-11-25 | The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to r… |
CVE-2016-0318 | Medium | 5.0 | 2016-11-25 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows… |
CVE-2016-0317 | Medium | 6.5 | 2016-11-25 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspe… |
CVE-2016-0316 | Medium | 5.4 | 2016-11-25 | Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix… |
CVE-2016-9452 | Medium | 6.5 | 2016-11-25 | The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL. |
CVE-2016-9451 | Medium | 6.8 | 2016-11-25 | Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors. |
CVE-2016-9450 | High | 7.5 | 2016-11-25 | The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct c… |
CVE-2016-9449 | Medium | 4.3 | 2016-11-25 | The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms… |
CVE-2016-6754 | High | 8.8 | 2016-11-25 | A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a remote attacker to… |
CVE-2016-6753 | Medium | 5.5 | 2016-11-25 | An information disclosure vulnerability in kernel components, including the process-grouping subsystem and the networking subsystem, in Android before 2016-11-… |