2016 CVEs (page 48)
Page 48 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-8203 | High | 7.5 | 2016-10-31 | A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00, and 6.0.00a images co… |
CVE-2016-8879 | Medium | 6.5 | 2016-10-31 | The thumbnail shell extension plugin (FoxitThumbnailHndlr_x86.dll) in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to cause a deni… |
CVE-2016-8878 | High | 8.8 | 2016-10-31 | Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbit… |
CVE-2016-8877 | High | 8.8 | 2016-10-31 | Heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to execute arbitrary code… |
CVE-2016-8876 | High | 7.5 | 2016-10-31 | Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbit… |
CVE-2016-8875 | Medium | 5.3 | 2016-10-31 | The ConvertToPDF plugin in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of serv… |
CVE-2016-8856 | High | 7.8 | 2016-10-31 | Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file permissions could b… |
CVE-2016-7991 | High | 7.5 | 2016-10-31 | On Samsung Galaxy S4 through S7 devices, the "omacp" app ignores security information embedded in the OMACP messages resulting in remote unsolicited WAP Push S… |
CVE-2016-7990 | Critical | 9.8 | 2016-10-31 | On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages (within WAP Push SMS messages) lea… |
CVE-2016-7989 | High | 7.5 | 2016-10-31 | On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message sent remotely triggers an unhandled ArrayIndexOutOfBoundsExce… |
CVE-2016-7988 | High | 7.5 | 2016-10-31 | On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_W… |
CVE-2016-7965 | Medium | 6.5 | 2016-10-31 | DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A… |
CVE-2016-7964 | High | 8.6 | 2016-10-31 | The sendRequest method in HTTPClient Class in file /inc/HTTPClient.php in DokuWiki 2016-06-26a and older, when media file fetching is enabled, has no way to re… |
CVE-2016-9118 | Medium | 5.3 | 2016-10-30 | Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2. |
CVE-2016-9117 | Medium | 6.5 | 2016-10-30 | NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. |
CVE-2016-9116 | Medium | 6.5 | 2016-10-30 | NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. |
CVE-2016-9115 | Medium | 6.5 | 2016-10-30 | Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. |
CVE-2016-9114 | High | 7.5 | 2016-10-30 | There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initial… |
CVE-2016-9113 | High | 7.5 | 2016-10-30 | There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initializa… |
CVE-2016-9112 | High | 7.5 | 2016-10-29 | Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2. |
CVE-2016-7506 | High | 7.5 | 2016-10-29 | An out-of-bounds read vulnerability was observed in Sp_replace_regexp function of Artifex Software, Inc. MuJS before 5000749f5afe3b956fc916e407309de840997f4a… |
CVE-2016-7505 | Critical | 9.8 | 2016-10-29 | A buffer overflow vulnerability was observed in divby function of Artifex Software, Inc. MuJS before 8c805b4eb19cf2af689c860b77e6111d2ee439d5. A successful exp… |
CVE-2016-7504 | Critical | 9.8 | 2016-10-29 | A use-after-free vulnerability was observed in Rp_toString function of Artifex Software, Inc. MuJS before 5c337af4b3df80cf967e4f9f6a21522de84b392a. A successfu… |
CVE-2016-5920 | Medium | 5.4 | 2016-10-29 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Financial Transaction Manager (FTM) for ACH Services 3.0.0.x before fp0015 and 3.0.1.0 before iFi… |
CVE-2016-3060 | Medium | 5.7 | 2016-10-29 | Payments Director in IBM Financial Transaction Manager (FTM) for ACH Services, Check Services, and Corporate Payment Services (CPS) 3.0.0.x before fp0015 and 3… |
CVE-2016-4396 | High | 7.5 | 2016-10-28 | HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer Overflow" issue. |
CVE-2016-4395 | High | 7.5 | 2016-10-28 | HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer Overflow" issue. |
CVE-2016-4394 | Medium | 6.5 | 2016-10-28 | HPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive information via unspecified vectors, related to an "HSTS" issue. |
CVE-2016-4393 | Medium | 5.4 | 2016-10-28 | HPE System Management Homepage before v7.6 allows "remote authenticated" attackers to obtain sensitive information via unspecified vectors, related to an "XSS"… |
CVE-2016-8335 | High | 8.8 | 2016-10-28 | An exploitable stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus Version 6.6.04 (Sep 7 2012) NK - Linux x64 and Ve… |
CVE-2016-8333 | High | 8.8 | 2016-10-28 | An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus version 6.6.04 A specially crafted pdf f… |
CVE-2016-8331 | High | 8.1 | 2016-10-28 | An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type c… |
CVE-2016-9028 | High | 8.8 | 2016-10-28 | Unauthorized redirect vulnerability in Citrix NetScaler ADC before 10.1 135.8, 10.5 61.11, 11.0 65.31/65.35F and 11.1 47.14 allows a remote attacker to steal s… |
CVE-2016-9018 | Medium | 5.5 | 2016-10-28 | Improper handling of a repeating VRAT chunk in qcpfformat.dll allows attackers to cause a Null pointer dereference and crash in RealNetworks RealPlayer 18.1.5… |
CVE-2016-9017 | High | 7.5 | 2016-10-28 | Artifex Software, Inc. MuJS before a5c747f1d40e8d6659a37a8d25f13fb5acf8e767 allows context-dependent attackers to obtain sensitive information by using the "op… |
CVE-2016-8889 | Medium | 6.2 | 2016-10-28 | In Bitcoin Knots v0.11.0.ljr20150711 through v0.13.0.knots20160814 (fixed in v0.13.1.knots20161027), the debug console stores sensitive information including p… |
CVE-2016-8871 | Medium | 6.2 | 2016-10-28 | In Botan 1.11.29 through 1.11.32, RSA decryption with certain padding options had a detectable timing channel which could given sufficient queries be used to r… |
CVE-2016-8867 | High | 7.5 | 2016-10-28 | Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access fi… |
CVE-2016-8600 | High | 7.5 | 2016-10-28 | In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later. |
CVE-2016-8598 | Critical | 9.8 | 2016-10-28 | Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execut… |
CVE-2016-8597 | Critical | 9.8 | 2016-10-28 | Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying… |
CVE-2016-8596 | Critical | 9.8 | 2016-10-28 | Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execut… |
CVE-2016-8583 | Medium | 6.1 | 2016-10-28 | Multiple GET parameters in the vulnerability scan scheduler of AlienVault OSSIM and USM before 5.3.2 are vulnerable to reflected XSS. |
CVE-2016-8582 | Critical | 9.8 | 2016-10-28 | A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database in… |
CVE-2016-8581 | Medium | 6.1 | 2016-10-28 | A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal s… |
CVE-2016-8580 | Critical | 9.8 | 2016-10-28 | PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code ex… |
CVE-2016-8579 | Medium | 4.0 | 2016-10-28 | docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain. |
CVE-2016-7919 | High | 7.5 | 2016-10-28 | Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration p… |
CVE-2016-8339 | Critical | 9.8 | 2016-10-28 | A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in… |
CVE-2016-8332 | High | 7.5 | 2016-10-28 | A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpe… |
CVE-2016-6397 | Critical | 9.8 | 2016-10-28 | A vulnerability in the interdevice communications interface of the Cisco IP Interoperability and Collaboration System (IPICS) Universal Media Services (UMS) co… |
CVE-2016-6372 | High | 7.5 | 2016-10-28 | A vulnerability in the email message and content filtering for malformed Multipurpose Internet Mail Extensions (MIME) headers of Cisco AsyncOS Software for Cis… |
CVE-2016-6360 | High | 7.5 | 2016-10-28 | A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow an unauthenticated… |
CVE-2016-6358 | High | 7.5 | 2016-10-28 | A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial denial of service (… |
CVE-2016-6357 | High | 7.5 | 2016-10-28 | A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow an u… |
CVE-2016-6356 | High | 7.5 | 2016-10-28 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote att… |
CVE-2016-1486 | High | 7.5 | 2016-10-28 | A vulnerability in the email attachment scanning functionality of the Advanced Malware Protection (AMP) feature of Cisco AsyncOS Software for Cisco Email Secur… |
CVE-2016-1481 | High | 7.5 | 2016-10-28 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthenticated, remote att… |
CVE-2016-1480 | High | 7.5 | 2016-10-28 | A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) and Web Securit… |
CVE-2016-1423 | Medium | 6.1 | 2016-10-28 | A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Appliance (ESA) could allow… |
CVE-2016-6446 | High | 7.5 | 2016-10-27 | A vulnerability in Web Bridge for Cisco Meeting Server could allow an unauthenticated, remote attacker to retrieve memory from a connected server. More Informa… |
CVE-2016-6445 | Critical | 9.1 | 2016-10-27 | A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18… |
CVE-2016-6444 | High | 8.8 | 2016-10-27 | A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against a Web Bri… |
CVE-2016-6443 | High | 8.8 | 2016-10-27 | A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker… |
CVE-2016-6442 | High | 8.8 | 2016-10-27 | A vulnerability in Cisco Finesse Agent and Supervisor Desktop Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery… |
CVE-2016-6440 | Medium | 6.5 | 2016-10-27 | The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to… |
CVE-2016-6439 | High | 7.5 | 2016-10-27 | A vulnerability in the detection engine reassembly of HTTP packets for Cisco Firepower System Software before 6.0.1 could allow an unauthenticated, remote atta… |
CVE-2016-6438 | Medium | 5.9 | 2016-10-27 | A vulnerability in Cisco IOS XE Software running on Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause a configur… |
CVE-2016-6437 | Medium | 5.9 | 2016-10-27 | A vulnerability in the SSL session cache management of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a d… |
CVE-2016-6432 | High | 8.1 | 2016-10-27 | A vulnerability in the Identity Firewall feature of Cisco ASA Software before 9.6(2.1) could allow an unauthenticated, remote attacker to cause a reload of the… |
CVE-2016-6431 | High | 7.5 | 2016-10-27 | A vulnerability in the local Certificate Authority (CA) feature of Cisco ASA Software before 9.6(1.5) could allow an unauthenticated, remote attacker to cause… |
CVE-2016-1000122 | High | 7.2 | 2016-10-27 | XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension |
CVE-2016-1000121 | Medium | 4.8 | 2016-10-27 | XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension |
CVE-2016-1000120 | High | 7.2 | 2016-10-27 | SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla |
CVE-2016-5764 | High | 8.8 | 2016-10-27 | Micro Focus Rumba FTP 4.X client buffer overflow makes it possible to corrupt the stack and allow arbitrary code execution. Fixed in: Rumba FTP 4.5 (HF 14668)… |
CVE-2016-1598 | Medium | 5.4 | 2016-10-27 | XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment a… |
CVE-2016-1592 | Medium | 6.1 | 2016-10-27 | XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. |
CVE-2016-8506 | Medium | 6.1 | 2016-10-26 | XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javasc… |
CVE-2016-8505 | Medium | 6.1 | 2016-10-26 | XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arbitrary javascript c… |
CVE-2016-8504 | Medium | 4.3 | 2016-10-26 | CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile. |
CVE-2016-8503 | High | 7.3 | 2016-10-26 | Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forcing passwords from… |
CVE-2016-8502 | High | 7.3 | 2016-10-26 | Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-forcing passwords fr… |
CVE-2016-8501 | Medium | 5.3 | 2016-10-26 | Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi networks despite of s… |
CVE-2016-8296 | High | 7.6 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to a… |
CVE-2016-8295 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidential… |
CVE-2016-8294 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to a… |
CVE-2016-8293 | High | 8.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect conf… |
CVE-2016-8292 | Medium | 4.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidential… |
CVE-2016-8291 | High | 8.2 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect conf… |
CVE-2016-8290 | Medium | 4.4 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Sch… |
CVE-2016-8289 | Medium | 4.7 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB. |
CVE-2016-8288 | Low | 3.1 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related t… |
CVE-2016-8287 | Medium | 4.5 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication. |
CVE-2016-8286 | Low | 3.1 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Securit… |
CVE-2016-8285 | Medium | 4.8 | 2016-10-25 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality a… |
CVE-2016-8284 | Low | 1.8 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Re… |
CVE-2016-8283 | Medium | 4.3 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availabili… |
CVE-2016-8281 | High | 7.6 | 2016-10-25 | Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote a… |
CVE-2016-5635 | Medium | 4.9 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit. |
CVE-2016-5634 | Medium | 4.9 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR. |