2016 CVEs (page 5)
Page 5 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10921 | Critical | 9.8 | 2019-08-22 | The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection. |
CVE-2016-10920 | Medium | 6.1 | 2019-08-22 | The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS. |
CVE-2016-10919 | Medium | 6.1 | 2019-08-22 | The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-263… |
CVE-2016-10918 | High | 8.8 | 2019-08-22 | The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF. |
CVE-2016-10917 | Critical | 9.8 | 2019-08-22 | The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316. |
CVE-2016-10916 | Critical | 9.8 | 2019-08-22 | The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319. |
CVE-2016-10891 | Medium | 6.1 | 2019-08-21 | The aryo-activity-log plugin before 2.3.3 for WordPress has XSS. |
CVE-2016-10890 | Medium | 6.1 | 2019-08-21 | The aryo-activity-log plugin before 2.3.2 for WordPress has XSS. |
CVE-2016-10912 | Medium | 6.1 | 2019-08-21 | The universal-analytics plugin before 1.3.1 for WordPress has XSS. |
CVE-2016-10911 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. |
CVE-2016-10910 | Medium | 6.1 | 2019-08-21 | The formbuilder plugin before 1.06 for WordPress has multiple XSS issues. |
CVE-2016-10909 | Critical | 9.8 | 2019-08-21 | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection. |
CVE-2016-10908 | Medium | 6.1 | 2019-08-21 | The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS. |
CVE-2016-10903 | High | 8.8 | 2019-08-21 | The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF. |
CVE-2016-10902 | High | 8.8 | 2019-08-21 | The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools. |
CVE-2016-10901 | Medium | 6.1 | 2019-08-21 | The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools. |
CVE-2016-10900 | Medium | 6.1 | 2019-08-21 | The uji-countdown plugin before 2.0.7 for WordPress has XSS. |
CVE-2016-10899 | Medium | 5.3 | 2019-08-21 | The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability. |
CVE-2016-10898 | Medium | 6.1 | 2019-08-21 | The total-security plugin before 3.4.1 for WordPress has XSS. |
CVE-2016-10897 | Medium | 6.1 | 2019-08-21 | The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. |
CVE-2016-10896 | Medium | 6.1 | 2019-08-21 | The seo-redirection plugin before 4.3 for WordPress has stored XSS. |
CVE-2016-10895 | Medium | 6.1 | 2019-08-20 | The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request. |
CVE-2016-10892 | Medium | 6.1 | 2019-08-20 | The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues. |
CVE-2016-10915 | High | 8.8 | 2019-08-20 | The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF. |
CVE-2016-10914 | High | 8.8 | 2019-08-20 | The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file. |
CVE-2016-10913 | Medium | 6.1 | 2019-08-20 | The wp-latest-posts plugin before 3.7.5 for WordPress has XSS. |
CVE-2016-10893 | Medium | 6.1 | 2019-08-20 | The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests. |
CVE-2016-10907 | High | 7.8 | 2019-08-19 | An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt. |
CVE-2016-10906 | High | 7.0 | 2019-08-19 | An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the func… |
CVE-2016-10905 | High | 7.8 | 2019-08-19 | An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry. |
CVE-2016-10904 | Critical | 9.8 | 2019-08-16 | The olimometer plugin before 2.57 for WordPress has SQL injection. |
CVE-2016-10894 | Medium | 4.6 | 2019-08-16 | xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such… |
CVE-2016-10888 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues. |
CVE-2016-10887 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues. |
CVE-2016-10886 | Critical | 9.8 | 2019-08-14 | The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions. |
CVE-2016-10885 | High | 8.8 | 2019-08-14 | The wp-editor plugin before 1.2.6 for WordPress has CSRF. |
CVE-2016-10884 | High | 8.8 | 2019-08-14 | The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. |
CVE-2016-10883 | Medium | 6.5 | 2019-08-14 | The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users. |
CVE-2016-10882 | High | 8.8 | 2019-08-14 | The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. |
CVE-2016-10881 | Medium | 6.1 | 2019-08-14 | The google-document-embedder plugin before 2.6.2 for WordPress has XSS. |
CVE-2016-10880 | Medium | 6.1 | 2019-08-14 | The google-document-embedder plugin before 2.6.1 for WordPress has XSS. |
CVE-2016-10889 | Critical | 9.8 | 2019-08-14 | The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. |
CVE-2016-10867 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages. |
CVE-2016-10866 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues. |
CVE-2016-10871 | Medium | 6.1 | 2019-08-13 | The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page. |
CVE-2016-10870 | Medium | 6.1 | 2019-08-13 | The google-language-translator plugin before 5.0.06 for WordPress has XSS. |
CVE-2016-10869 | Medium | 6.1 | 2019-08-13 | The contact-form-plugin plugin before 4.0.2 for WordPress has XSS. |
CVE-2016-10868 | Medium | 6.1 | 2019-08-13 | The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages. |
CVE-2016-10872 | Medium | 6.1 | 2019-08-12 | The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. |
CVE-2016-10879 | Medium | 6.1 | 2019-08-12 | The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS. |
CVE-2016-10878 | Medium | 6.1 | 2019-08-12 | The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS. |
CVE-2016-10877 | Medium | 6.1 | 2019-08-12 | The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues. |
CVE-2016-10876 | High | 8.8 | 2019-08-12 | The wp-database-backup plugin before 4.3.1 for WordPress has CSRF. |
CVE-2016-10875 | Medium | 6.1 | 2019-08-12 | The wp-database-backup plugin before 4.3.1 for WordPress has XSS. |
CVE-2016-10874 | High | 8.8 | 2019-08-12 | The wp-database-backup plugin before 4.3.3 for WordPress has CSRF. |
CVE-2016-10873 | Medium | 6.1 | 2019-08-12 | The wp-database-backup plugin before 4.3.3 for WordPress has XSS. |
CVE-2016-10865 | Medium | 6.1 | 2019-08-09 | The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated b… |
CVE-2016-10863 | High | 8.8 | 2019-08-08 | Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure. |
CVE-2016-10862 | High | 8.8 | 2019-08-08 | Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page. |
CVE-2016-10864 | Medium | 5.2 | 2019-08-08 | NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID. |
CVE-2016-5431 | High | 7.5 | 2019-08-07 | The PHP JOSE Library by Gree Inc. before version 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the si… |
CVE-2016-10861 | Medium | 6.5 | 2019-08-07 | Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password. |
CVE-2016-10812 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). |
CVE-2016-10811 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). |
CVE-2016-10810 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115). |
CVE-2016-10809 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114). |
CVE-2016-10808 | High | 8.8 | 2019-08-07 | In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113). |
CVE-2016-10807 | Medium | 6.5 | 2019-08-07 | cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112). |
CVE-2016-10806 | Medium | 5.4 | 2019-08-07 | cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110). |
CVE-2016-10805 | High | 8.8 | 2019-08-07 | cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109). |
CVE-2016-10804 | High | 8.1 | 2019-08-07 | The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58). |
CVE-2016-10803 | High | 7.5 | 2019-08-07 | cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). |
CVE-2016-10802 | High | 8.8 | 2019-08-07 | cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142). |
CVE-2016-10801 | High | 8.8 | 2019-08-07 | cPanel before 58.0.4 has improper session handling for shared users (SEC-139). |
CVE-2016-10800 | High | 7.8 | 2019-08-07 | cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138). |
CVE-2016-10799 | Medium | 5.5 | 2019-08-07 | cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137). |
CVE-2016-10798 | Medium | 6.8 | 2019-08-07 | cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134). |
CVE-2016-10797 | Medium | 4.3 | 2019-08-06 | cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133). |
CVE-2016-10796 | Low | 3.3 | 2019-08-06 | cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130). |
CVE-2016-10795 | Medium | 6.1 | 2019-08-06 | cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156). |
CVE-2016-10794 | Medium | 6.5 | 2019-08-06 | cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154). |
CVE-2016-10793 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152). |
CVE-2016-10792 | High | 8.8 | 2019-08-06 | cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141). |
CVE-2016-10791 | Medium | 5.3 | 2019-08-06 | cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559). |
CVE-2016-10790 | High | 7.5 | 2019-08-06 | cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192). |
CVE-2016-10789 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191). |
CVE-2016-10788 | High | 8.8 | 2019-08-06 | cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188). |
CVE-2016-10787 | High | 8.1 | 2019-08-06 | The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187). |
CVE-2016-10786 | Medium | 6.5 | 2019-08-06 | cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186). |
CVE-2016-10785 | Medium | 6.5 | 2019-08-06 | cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185). |
CVE-2016-10784 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184). |
CVE-2016-10783 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182). |
CVE-2016-10782 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181). |
CVE-2016-10781 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180). |
CVE-2016-10780 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180). |
CVE-2016-10779 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179). |
CVE-2016-10778 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178). |
CVE-2016-10777 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177). |
CVE-2016-10776 | Medium | 5.4 | 2019-08-06 | cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174). |
CVE-2016-10775 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173). |