2016 CVEs (page 59)
Page 59 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5157 | High | 8.8 | 2016-09-11 | Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS… |
CVE-2016-5156 | High | 8.8 | 2016-09-11 | extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts… |
CVE-2016-5155 | Medium | 6.5 | 2016-09-11 | Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows… |
CVE-2016-5154 | High | 8.8 | 2016-09-11 | Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote… |
CVE-2016-5153 | High | 8.8 | 2016-09-11 | The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, improperly relie… |
CVE-2016-5152 | High | 8.8 | 2016-09-11 | Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X… |
CVE-2016-5151 | High | 8.8 | 2016-09-11 | PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote attackers to cause a de… |
CVE-2016-5150 | High | 8.8 | 2016-09-11 | WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on… |
CVE-2016-5149 | High | 8.8 | 2016-09-11 | The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify a… |
CVE-2016-5148 | Medium | 6.1 | 2016-09-11 | Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows re… |
CVE-2016-5147 | Medium | 6.1 | 2016-09-11 | Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, which allows remote a… |
CVE-2016-6212 | Medium | 5.3 | 2016-09-09 | The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intende… |
CVE-2016-6211 | High | 8.8 | 2016-09-09 | The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a… |
CVE-2016-4573 | Critical | 9.8 | 2016-09-09 | Fortinet FortiSwitch FSW-108D-POE, FSW-124D, FSW-124D-POE, FSW-224D-POE, FSW-224D-FPOE, FSW-248D-POE, FSW-248D-FPOE, FSW-424D, FSW-424D-POE, FSW-424D-FPOE, FSW… |
CVE-2016-1280 | Medium | 6.5 | 2016-09-09 | PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 befo… |
CVE-2016-1279 | Critical | 9.8 | 2016-09-09 | J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13.3R10, 13… |
CVE-2016-1277 | Medium | 5.9 | 2016-09-09 | Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D40, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40… |
CVE-2016-1275 | Medium | 6.5 | 2016-09-09 | Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain… |
CVE-2016-1263 | High | 7.5 | 2016-09-09 | Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 befor… |
CVE-2016-7180 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-ipmi-trace.c in the IPMI trace dissector in Wireshark 2.x before 2.0.6 does not properly consider whether a string is constant, which al… |
CVE-2016-7179 | Medium | 5.9 | 2016-09-09 | Stack-based buffer overflow in epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark 2.x before 2.0.6 allows remote attacker… |
CVE-2016-7178 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-umts_fp.c in the UMTS FP dissector in Wireshark 2.x before 2.0.6 does not ensure that memory is allocated for certain data structures, w… |
CVE-2016-7177 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-catapult-dct2000.c in the Catapult DCT2000 dissector in Wireshark 2.x before 2.0.6 does not restrict the number of channels, which allow… |
CVE-2016-7176 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-h225.c in the H.225 dissector in Wireshark 2.x before 2.0.6 calls snprintf with one of its input buffers as the output buffer, which all… |
CVE-2016-7175 | Medium | 5.9 | 2016-09-09 | epan/dissectors/packet-qnet6.c in the QNX6 QNET dissector in Wireshark 2.x before 2.0.6 mishandles MAC address data, which allows remote attackers to cause a d… |
CVE-2016-4381 | Medium | 4.5 | 2016-09-08 | HPE XP7 Command View Advanced Edition (CVAE) Suite 6.x through 8.x before 8.4.1-02, when Replication Manager (RepMgr) and Device Manager (DevMgr) are enabled… |
CVE-2016-4380 | Medium | 5.4 | 2016-09-08 | Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary… |
CVE-2016-4379 | Low | 3.7 | 2016-09-08 | The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC… |
CVE-2016-4375 | Critical | 9.8 | 2016-09-08 | Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (aka iLO 3) firmware before 1.88, Integrated Lights-Out 4 (aka iLO 4) firmware before 2.44… |
CVE-2016-6263 | High | 7.5 | 2016-09-07 | The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds… |
CVE-2016-6262 | High | 7.5 | 2016-09-07 | idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds… |
CVE-2016-6261 | High | 7.5 | 2016-09-07 | The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash… |
CVE-2016-6179 | High | 7.0 | 2016-09-07 | The WiFi driver in Huawei Honor 6 smartphones with software H60-L01 before H60-L01C00B850, H60-L11 before H60-L11C00B850, H60-L21 before H60-L21C00B850, H60-L0… |
CVE-2016-5404 | Medium | 6.5 | 2016-09-07 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certific… |
CVE-2016-7110 | Critical | 9.8 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vul… |
CVE-2016-7109 | Critical | 9.8 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a different vul… |
CVE-2016-7108 | Medium | 6.5 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords v… |
CVE-2016-7107 | High | 7.5 | 2016-09-07 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote attackers to reset arbitrary user passwords and consequently affect system… |
CVE-2016-6900 | Medium | 5.5 | 2016-09-07 | The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613; RH2288 V3 servers with software befo… |
CVE-2016-6899 | High | 7.5 | 2016-09-07 | The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software befo… |
CVE-2016-6898 | Medium | 6.6 | 2016-09-07 | XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote… |
CVE-2016-6876 | High | 7.5 | 2016-09-07 | The RESOLV::lookup iRule command in F5 BIG-IP LTM, APM, ASM, and Link Controller 10.2.1 through 10.2.4, 11.2.1, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before… |
CVE-2016-6839 | Medium | 6.1 | 2016-09-07 | CRLF injection vulnerability in Huawei FusionAccess before V100R006C00 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response split… |
CVE-2016-6838 | High | 7.5 | 2016-09-07 | Huawei X6800 and XH620 V3 servers with software before V100R003C00SPC606, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with soft… |
CVE-2016-6825 | Critical | 9.8 | 2016-09-07 | Huawei XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610, RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 ser… |
CVE-2016-6670 | Medium | 5.3 | 2016-09-07 | Huawei S7700, S9300, S9700, and S12700 devices with software before V200R008C00SPC500 use random numbers with insufficient entropy to generate self-signed cert… |
CVE-2016-6318 | High | 7.8 | 2016-09-07 | Stack-based buffer overflow in the FascistGecosUser function in lib/fascist.c in cracklib allows local users to cause a denial of service (application crash) o… |
CVE-2016-6317 | High | 7.5 | 2016-09-07 | Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JS… |
CVE-2016-6316 | Medium | 6.1 | 2016-09-07 | Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote att… |
CVE-2016-6184 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6183 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6182 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6181 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-6180 | High | 7.0 | 2016-09-07 | The Camera driver in Huawei Honor 4C smartphones with software CHM-UL00C00 before CHM-UL00C00B564, CHM-TL00C01 before CHM-TL00C01B564, and CHM-TL00C00 before C… |
CVE-2016-5422 | High | 8.8 | 2016-09-07 | The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows… |
CVE-2016-5022 | Critical | 9.8 | 2016-09-07 | F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1, and 12.x… |
CVE-2016-1242 | Medium | 4.4 | 2016-09-07 | file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with ce… |
CVE-2016-1241 | Medium | 5.3 | 2016-09-07 | Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user… |
CVE-2016-7034 | High | 8.8 | 2016-09-07 | The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, wh… |
CVE-2016-7033 | Medium | 6.1 | 2016-09-07 | Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitra… |
CVE-2016-6855 | High | 7.5 | 2016-09-07 | Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cau… |
CVE-2016-6351 | Medium | 6.7 | 2016-09-07 | The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS adminis… |
CVE-2016-6346 | High | 7.5 | 2016-09-07 | RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2016-6345 | Medium | 6.5 | 2016-09-07 | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. |
CVE-2016-6344 | Medium | 5.3 | 2016-09-07 | Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obta… |
CVE-2016-7153 | Medium | 5.3 | 2016-09-06 | The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote att… |
CVE-2016-7152 | Medium | 5.3 | 2016-09-06 | The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote atta… |
CVE-2016-7114 | High | 8.8 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-7113 | High | 7.5 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-7112 | Critical | 9.8 | 2016-09-06 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-6377 | High | 8.1 | 2016-09-03 | Media Origination System Suite Software 2.6 and earlier in Cisco Virtual Media Packager (VMP) allows remote attackers to bypass authentication and make arbitra… |
CVE-2016-5430 | Medium | 5.3 | 2016-09-03 | The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling protection mechanism, which makes it ea… |
CVE-2016-5429 | Low | 3.7 | 2016-09-03 | jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via… |
CVE-2016-1464 | High | 7.8 | 2016-09-03 | Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to execute arbitrary code via a crafted file, aka Bug ID CSCva093… |
CVE-2016-1415 | Medium | 5.5 | 2016-09-03 | Cisco WebEx Meetings Player T29.10, when WRF file support is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted fi… |
CVE-2016-7123 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of… |
CVE-2016-6893 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authenticatio… |
CVE-2016-5879 | High | 8.8 | 2016-09-02 | MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery or (2) High Availa… |
CVE-2016-5699 | Medium | 6.1 | 2016-09-02 | CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows r… |
CVE-2016-5636 | Critical | 9.8 | 2016-09-02 | Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attacker… |
CVE-2016-5107 | Medium | 6.0 | 2016-09-02 | The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS administrators to cau… |
CVE-2016-5106 | Medium | 6.0 | 2016-09-02 | The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local gu… |
CVE-2016-5105 | Medium | 4.4 | 2016-09-02 | The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized… |
CVE-2016-4952 | Medium | 6.0 | 2016-09-02 | QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS administrators to cause a denial of serv… |
CVE-2016-0772 | Medium | 6.5 | 2016-09-02 | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might a… |
CVE-2016-6483 | High | 8.6 | 2016-09-02 | The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6… |
CVE-2016-4853 | High | 7.8 | 2016-09-02 | AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by Happy Wardrobe. |
CVE-2016-4851 | Medium | 6.1 | 2016-09-02 | Cross-site scripting (XSS) vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject arbitrary web script or HTML via unspeci… |
CVE-2016-4848 | Medium | 6.1 | 2016-09-02 | Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2016-6376 | Medium | 6.5 | 2016-09-02 | The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.12… |
CVE-2016-1473 | Critical | 9.8 | 2016-09-02 | Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, which allows remote attackers to read or modify SNMP objects by… |
CVE-2016-1472 | High | 7.5 | 2016-09-02 | The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attackers to cause a denial of service (inter… |
CVE-2016-1471 | Medium | 6.1 | 2016-09-02 | Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote a… |
CVE-2016-1470 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows r… |
CVE-2016-6298 | Medium | 5.3 | 2016-09-01 | The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easie… |
CVE-2016-4264 | High | 8.6 | 2016-09-01 | The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP… |
CVE-2016-5047 | Medium | 6.5 | 2016-09-01 | NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via unspecified vectors. |
CVE-2016-3010 | Medium | 5.4 | 2016-09-01 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote au… |
CVE-2016-3008 | Medium | 5.4 | 2016-09-01 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remote authenticated users to inject arbitra… |
CVE-2016-3005 | Medium | 5.4 | 2016-09-01 | Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote au… |