2016 CVEs (page 6)
Page 6 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-10774 | Medium | 5.4 | 2019-08-05 | cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172). |
CVE-2016-10773 | High | 8.8 | 2019-08-05 | cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171). |
CVE-2016-10772 | Low | 3.3 | 2019-08-05 | cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168). |
CVE-2016-10771 | High | 8.1 | 2019-08-05 | cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165). |
CVE-2016-10770 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164). |
CVE-2016-10769 | Medium | 6.1 | 2019-08-05 | cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162). |
CVE-2016-10768 | Medium | 6.5 | 2019-08-05 | cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161). |
CVE-2016-10767 | Medium | 5.4 | 2019-08-05 | cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159). |
CVE-2016-10826 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93). |
CVE-2016-10821 | Medium | 6.5 | 2019-08-01 | In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). |
CVE-2016-10820 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). |
CVE-2016-10819 | Medium | 6.5 | 2019-08-01 | In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). |
CVE-2016-10818 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124). |
CVE-2016-10817 | Critical | 9.8 | 2019-08-01 | cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). |
CVE-2016-10816 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121). |
CVE-2016-10815 | Medium | 6.5 | 2019-08-01 | cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120). |
CVE-2016-10814 | High | 8.8 | 2019-08-01 | cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). |
CVE-2016-10813 | Medium | 5.4 | 2019-08-01 | cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118). |
CVE-2016-10835 | Medium | 4.3 | 2019-08-01 | cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107). |
CVE-2016-10834 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). |
CVE-2016-10833 | High | 7.5 | 2019-08-01 | cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104). |
CVE-2016-10832 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102). |
CVE-2016-10831 | High | 7.2 | 2019-08-01 | cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101). |
CVE-2016-10830 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100). |
CVE-2016-10829 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99). |
CVE-2016-10828 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97). |
CVE-2016-10827 | Medium | 5.4 | 2019-08-01 | cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96). |
CVE-2016-10825 | High | 8.1 | 2019-08-01 | cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92). |
CVE-2016-10824 | Critical | 9.8 | 2019-08-01 | cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90). |
CVE-2016-10823 | High | 8.8 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89). |
CVE-2016-10822 | Medium | 5.4 | 2019-08-01 | cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). |
CVE-2016-10849 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82). |
CVE-2016-10848 | High | 7.2 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81). |
CVE-2016-10847 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80). |
CVE-2016-10846 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79). |
CVE-2016-10845 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78). |
CVE-2016-10844 | Medium | 6.5 | 2019-08-01 | The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). |
CVE-2016-10843 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76). |
CVE-2016-10842 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74). |
CVE-2016-10841 | Medium | 5.3 | 2019-08-01 | The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73). |
CVE-2016-10840 | High | 8.8 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72). |
CVE-2016-10839 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). |
CVE-2016-10838 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70). |
CVE-2016-10837 | High | 7.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46). |
CVE-2016-10836 | Medium | 6.5 | 2019-08-01 | cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108). |
CVE-2016-10860 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66). |
CVE-2016-10859 | High | 8.1 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65). |
CVE-2016-10858 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64). |
CVE-2016-10857 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). |
CVE-2016-10856 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29). |
CVE-2016-10855 | Critical | 9.8 | 2019-08-01 | cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91). |
CVE-2016-10854 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). |
CVE-2016-10853 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86). |
CVE-2016-10852 | Medium | 6.5 | 2019-08-01 | cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). |
CVE-2016-10851 | Medium | 5.4 | 2019-08-01 | cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84). |
CVE-2016-10850 | High | 8.8 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83). |
CVE-2016-10766 | High | 8.8 | 2019-07-29 | edx-platform before 2016-06-06 allows CSRF. |
CVE-2016-10765 | Medium | 5.3 | 2019-07-29 | edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address. |
CVE-2016-10764 | Critical | 9.8 | 2019-07-27 | In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSEL… |
CVE-2016-10763 | Medium | 4.8 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. |
CVE-2016-10762 | High | 7.5 | 2019-07-18 | The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. |
CVE-2016-5236 | Medium | 5.4 | 2019-07-01 | Cross-Site-Scripting (XSS) vulnerabilities in F5 WebSafe Dashboard 3.9.5 and earlier, aka F5 WebSafe Alert Server, allow privileged authenticated users to inje… |
CVE-2016-5235 | Medium | 6.1 | 2019-07-01 | A Cross Site Scripting (XSS) vulnerability in versions of F5 WebSafe Dashboard 3.9.x and earlier, aka F5 WebSafe Alert Server, allows an unauthenticated user t… |
CVE-2016-10761 | Medium | 6.5 | 2019-06-29 | Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. |
CVE-2016-7404 | Critical | 9.8 | 2019-06-21 | OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL… |
CVE-2016-10760 | Critical | 9.8 | 2019-06-11 | On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter. |
CVE-2016-10759 | Critical | 9.8 | 2019-05-24 | The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php b… |
CVE-2016-10758 | High | 8.8 | 2019-05-24 | PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the image_name paramet… |
CVE-2016-10757 | High | 8.8 | 2019-05-24 | In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.ph… |
CVE-2016-10756 | High | 8.8 | 2019-05-24 | Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then… |
CVE-2016-10755 | High | 8.8 | 2019-05-24 | AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php… |
CVE-2016-10754 | High | 8.8 | 2019-05-24 | modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter. |
CVE-2016-10753 | High | 8.8 | 2019-05-24 | e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC. |
CVE-2016-10752 | Critical | 9.8 | 2019-05-24 | serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless fil… |
CVE-2016-10751 | High | 7.2 | 2019-05-24 | osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administra… |
CVE-2016-8900 | Critical | 9.8 | 2019-05-24 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. |
CVE-2016-8898 | Critical | 9.8 | 2019-05-24 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. |
CVE-2016-10245 | Medium | 6.1 | 2019-05-24 | Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection. |
CVE-2016-8899 | Critical | 9.8 | 2019-05-23 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. |
CVE-2016-8897 | Critical | 9.8 | 2019-05-23 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. |
CVE-2016-7550 | High | 7.5 | 2019-05-23 | asterisk 13.10.0 is affected by: denial of service issues in asterisk. The impact is: cause a denial of service (remote). |
CVE-2016-9969 | High | 7.5 | 2019-05-23 | In libwebp 0.5.1, there is a double free bug in libwebpmux. |
CVE-2016-8901 | Critical | 9.8 | 2019-05-23 | b2evolution 6.7.6 suffer from an Object Injection vulnerability in /htsrv/call_plugin.php. |
CVE-2016-10750 | High | 8.1 | 2019-05-22 | In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Haze… |
CVE-2016-7043 | Medium | 5.9 | 2019-05-15 | It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deplo… |
CVE-2016-7151 | Medium | 5.5 | 2019-05-15 | Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c. |
CVE-2016-10719 | Medium | 6.1 | 2019-05-15 | TP-Link Archer CR-700 1.0.6 devices have an XSS vulnerability that can be introduced into the admin account through a DHCP request, allowing the attacker to st… |
CVE-2016-1600 | High | 7.5 | 2019-05-09 | The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability. |
CVE-2016-10749 | Critical | 9.8 | 2019-04-29 | parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ charact… |
CVE-2016-1587 | High | 7.1 | 2019-04-22 | The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the orig… |
CVE-2016-1586 | Low | 1.8 | 2019-04-22 | A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before… |
CVE-2016-1585 | Critical | 9.8 | 2019-04-22 | In all versions of AppArmor mount rules are accidentally widened when compiled. |
CVE-2016-1584 | Low | 1.6 | 2019-04-22 | In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consume keyboard input. |
CVE-2016-1579 | Medium | 6.7 | 2019-04-22 | UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was n… |
CVE-2016-1573 | High | 7.8 | 2019-04-22 | Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in place of a fallback image supplied by a… |
CVE-2016-10746 | High | 7.5 | 2019-04-18 | libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed t… |
CVE-2016-10745 | High | 8.6 | 2019-04-08 | In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. |
CVE-2016-10744 | Medium | 6.1 | 2019-03-27 | In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML te… |
CVE-2016-10743 | High | 7.5 | 2019-03-23 | hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call. |
CVE-2016-9166 | High | 7.5 | 2019-03-21 | NetIQ eDirectory versions prior to 9.0.2, under some circumstances, could be susceptible to downgrade of communication security. |