2016 CVEs (page 55)
Page 55 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5976 | Medium | 4.9 | 2016-09-26 | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1… |
CVE-2016-5975 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9… |
CVE-2016-5974 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote… |
CVE-2016-5972 | Medium | 6.8 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspecified resources, which allows remote au… |
CVE-2016-5971 | High | 7.1 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files or cause a de… |
CVE-2016-5970 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users… |
CVE-2016-5963 | High | 8.8 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated u… |
CVE-2016-5957 | High | 7.5 | 2016-09-26 | IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote attackers to defeat cryptographic protection mechanisms a… |
CVE-2016-5947 | Medium | 5.7 | 2016-09-26 | IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to conduct clickjacking attacks via a… |
CVE-2016-5946 | Medium | 6.5 | 2016-09-26 | Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users t… |
CVE-2016-5945 | Medium | 4.3 | 2016-09-26 | IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to upload non-executable files via a c… |
CVE-2016-5944 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote… |
CVE-2016-5943 | Medium | 5.4 | 2016-09-26 | IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to bypass intended access restrictions… |
CVE-2016-3040 | Medium | 6.8 | 2016-09-26 | IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8, allows remo… |
CVE-2016-3007 | High | 8.8 | 2016-09-26 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to… |
CVE-2016-3006 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated u… |
CVE-2016-3003 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated u… |
CVE-2016-3001 | Medium | 5.4 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated u… |
CVE-2016-3000 | Medium | 4.3 | 2016-09-26 | The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to cause a denial of service (ser… |
CVE-2016-2999 | Medium | 6.5 | 2016-09-26 | IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified br… |
CVE-2016-0379 | Low | 3.1 | 2016-09-26 | IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (cha… |
CVE-2016-0248 | Low | 3.7 | 2016-09-26 | IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions vi… |
CVE-2016-7549 | High | 8.8 | 2016-09-25 | Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which allows remote atta… |
CVE-2016-5175 | High | 8.8 | 2016-09-25 | Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have other impact via unkno… |
CVE-2016-5174 | Medium | 6.5 | 2016-09-25 | browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen tra… |
CVE-2016-5173 | High | 7.1 | 2016-09-25 | The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote attackers to load uni… |
CVE-2016-5172 | Medium | 6.5 | 2016-09-25 | The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from a… |
CVE-2016-5171 | High | 8.8 | 2016-09-25 | WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor calls, which allow… |
CVE-2016-5170 | High | 8.8 | 2016-09-25 | WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly consider getter side effec… |
CVE-2016-5169 | High | 8.8 | 2016-09-25 | Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have unspecified other im… |
CVE-2016-4779 | High | 7.8 | 2016-09-25 | Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a c… |
CVE-2016-4778 | High | 7.8 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context o… |
CVE-2016-4777 | High | 7.8 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context o… |
CVE-2016-4776 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-4775 | High | 7.8 | 2016-09-25 | The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of service (memory corrupti… |
CVE-2016-4774 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-4773 | High | 7.1 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layout information or ca… |
CVE-2016-4772 | High | 7.5 | 2016-09-25 | The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to cause a denial of service (unintended loc… |
CVE-2016-4771 | Medium | 5.5 | 2016-09-25 | The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directory pathname. |
CVE-2016-4769 | High | 8.8 | 2016-09-25 | WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory cor… |
CVE-2016-4768 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-4767 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-4766 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-4765 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-4763 | Medium | 6.8 | 2016-09-25 | WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS server… |
CVE-2016-4762 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary… |
CVE-2016-4760 | Medium | 6.5 | 2016-09-25 | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP… |
CVE-2016-4759 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-4758 | Medium | 6.5 | 2016-09-25 | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows r… |
CVE-2016-4755 | Medium | 5.5 | 2016-09-25 | Terminal in Apple OS X before 10.12 uses weak permissions for the .bash_history and .bash_session files, which allows local users to obtain sensitive informati… |
CVE-2016-4754 | High | 7.5 | 2016-09-25 | ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protection mechanisms via… |
CVE-2016-4753 | High | 7.8 | 2016-09-25 | Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in… |
CVE-2016-4752 | Medium | 5.5 | 2016-09-25 | The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF_RETURNS_RETAINED keyword, which allows attackers to obtain sensitive infor… |
CVE-2016-4751 | Low | 3.5 | 2016-09-25 | The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site. |
CVE-2016-4750 | High | 7.8 | 2016-09-25 | S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory… |
CVE-2016-4748 | Medium | 5.3 | 2016-09-25 | Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via a crafted environment variable. |
CVE-2016-4745 | Medium | 5.3 | 2016-09-25 | The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, which makes it easier… |
CVE-2016-4742 | Medium | 5.5 | 2016-09-25 | NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app. |
CVE-2016-4739 | Low | 3.7 | 2016-09-25 | mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to… |
CVE-2016-4738 | High | 8.8 | 2016-09-25 | libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of… |
CVE-2016-4737 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of se… |
CVE-2016-4736 | High | 8.8 | 2016-09-25 | libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a… |
CVE-2016-4735 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr… |
CVE-2016-4734 | Critical | 9.6 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr… |
CVE-2016-4733 | High | 7.8 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr… |
CVE-2016-4731 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cra… |
CVE-2016-4730 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr… |
CVE-2016-4729 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a cra… |
CVE-2016-4728 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers… |
CVE-2016-4727 | High | 7.8 | 2016-09-25 | IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corrupti… |
CVE-2016-4726 | High | 7.8 | 2016-09-25 | IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged… |
CVE-2016-4725 | High | 8.1 | 2016-09-25 | IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive information fro… |
CVE-2016-4724 | High | 7.8 | 2016-09-25 | IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of servic… |
CVE-2016-4723 | High | 7.8 | 2016-09-25 | Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corrup… |
CVE-2016-4722 | Medium | 5.9 | 2016-09-25 | The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoofing attacks and cau… |
CVE-2016-4718 | Medium | 6.5 | 2016-09-25 | Buffer overflow in FontParser in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive infor… |
CVE-2016-4717 | Low | 3.3 | 2016-09-25 | The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial of service via a c… |
CVE-2016-4716 | High | 7.8 | 2016-09-25 | diskutil in DiskArbitration in Apple OS X before 10.12 allows local users to gain privileges via unspecified vectors. |
CVE-2016-4715 | Low | 3.3 | 2016-09-25 | The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via… |
CVE-2016-4713 | Medium | 5.3 | 2016-09-25 | CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access. |
CVE-2016-4712 | High | 7.8 | 2016-09-25 | CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of serv… |
CVE-2016-4711 | High | 7.5 | 2016-09-25 | CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function c… |
CVE-2016-4710 | High | 7.8 | 2016-09-25 | WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE… |
CVE-2016-4709 | High | 7.8 | 2016-09-25 | WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE… |
CVE-2016-4708 | Medium | 6.5 | 2016-09-25 | CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obt… |
CVE-2016-4707 | Medium | 4.0 | 2016-09-25 | CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited web sites of arbitra… |
CVE-2016-4706 | Medium | 5.5 | 2016-09-25 | cd9660 in Apple OS X before 10.12 allows local users to cause a denial of service via unspecified vectors. |
CVE-2016-4703 | High | 7.8 | 2016-09-25 | Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a… |
CVE-2016-4702 | Critical | 9.8 | 2016-09-25 | Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of se… |
CVE-2016-4701 | Medium | 6.2 | 2016-09-25 | Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variabl… |
CVE-2016-4700 | High | 7.8 | 2016-09-25 | AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a c… |
CVE-2016-4699 | High | 7.8 | 2016-09-25 | AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a c… |
CVE-2016-4698 | High | 7.8 | 2016-09-25 | AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, wh… |
CVE-2016-4697 | High | 7.8 | 2016-09-25 | Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corrupti… |
CVE-2016-4696 | High | 7.8 | 2016-09-25 | AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer derefe… |
CVE-2016-4694 | Critical | 9.1 | 2016-09-25 | The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t… |
CVE-2016-4658 | Critical | 9.8 | 2016-09-25 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbi… |
CVE-2016-4618 | Medium | 6.1 | 2016-09-25 | Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or… |
CVE-2016-4611 | High | 8.8 | 2016-09-25 | WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corr… |
CVE-2016-6532 | Critical | 9.8 | 2016-09-24 | DEXIS Imaging Suite 10 has a hardcoded password for the sa account, which allows remote attackers to obtain administrative access by entering this password in… |