2016 CVEs (page 68)
Page 68 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-3271 | Medium | 6.5 | 2016-07-13 | The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine… |
CVE-2016-3269 | High | 8.8 | 2016-07-13 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
CVE-2016-3265 | High | 8.8 | 2016-07-13 | The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted… |
CVE-2016-3264 | High | 7.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v… |
CVE-2016-3261 | Medium | 5.3 | 2016-07-13 | Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vu… |
CVE-2016-3260 | High | 8.8 | 2016-07-13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, al… |
CVE-2016-3259 | High | 8.8 | 2016-07-13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other pr… |
CVE-2016-3258 | Medium | 4.7 | 2016-07-13 | Race condition in the kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypa… |
CVE-2016-3256 | Medium | 5.0 | 2016-07-13 | Microsoft Windows 10 Gold and 1511 allows local users to bypass the Secure Kernel Mode protection mechanism and obtain sensitive information via a crafted appl… |
CVE-2016-3255 | High | 7.5 | 2016-07-13 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity… |
CVE-2016-3254 | High | 7.8 | 2016-07-13 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-3252 | High | 7.3 | 2016-07-13 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-3251 | Low | 2.8 | 2016-07-13 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… |
CVE-2016-3250 | High | 7.3 | 2016-07-13 | The kernel-mode drivers in Microsoft Windows Server 2012 and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win3… |
CVE-2016-3249 | High | 7.3 | 2016-07-13 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-3248 | High | 8.8 | 2016-07-13 | The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other pr… |
CVE-2016-3246 | High | 7.5 | 2016-07-13 | Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
CVE-2016-3245 | Medium | 6.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "I… |
CVE-2016-3244 | Medium | 4.3 | 2016-07-13 | Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature Bypass." |
CVE-2016-3243 | High | 7.5 | 2016-07-13 | Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site… |
CVE-2016-3242 | High | 7.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-3241 | High | 7.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-3240 | High | 7.5 | 2016-07-13 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-3239 | High | 7.8 | 2016-07-13 | The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Wind… |
CVE-2016-3238 | High | 8.1 | 2016-07-13 | The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Wind… |
CVE-2016-3204 | High | 8.8 | 2016-07-13 | The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers… |
CVE-2016-6174 | High | 8.1 | 2016-07-12 | applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13… |
CVE-2016-5850 | Medium | 5.4 | 2016-07-12 | Cross-site scripting (XSS) vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote authenticated users to… |
CVE-2016-5774 | High | 8.1 | 2016-07-12 | The HTTPS server in Blue Coat PacketShaper S-Series 11.5.x before 11.5.3.2 might allow remote attackers to obtain sensitive credentials and other information v… |
CVE-2016-5009 | Medium | 6.5 | 2016-07-12 | The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash… |
CVE-2016-4994 | High | 7.8 | 2016-07-12 | Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash)… |
CVE-2016-4985 | High | 7.5 | 2016-07-12 | The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a… |
CVE-2016-4428 | Medium | 5.4 | 2016-07-12 | Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject… |
CVE-2016-2219 | Medium | 5.4 | 2016-07-12 | Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject… |
CVE-2016-5781 | High | 7.8 | 2016-07-12 | Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file. |
CVE-2016-5308 | Medium | 5.5 | 2016-07-12 | The Client Intrusion Detection System (CIDS) driver before 15.0.6 in Symantec Endpoint Protection (SEP) and before 15.1.2 in Norton Security allows remote atta… |
CVE-2016-4831 | High | 7.8 | 2016-07-12 | Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Trojan horse DLL in an… |
CVE-2016-4533 | High | 7.8 | 2016-07-12 | Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file. |
CVE-2016-4503 | Critical | 9.8 | 2016-07-12 | Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to readi… |
CVE-2016-2206 | Medium | 5.7 | 2016-07-12 | The management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5… |
CVE-2016-2205 | Medium | 5.7 | 2016-07-12 | Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1… |
CVE-2016-1445 | Medium | 5.3 | 2016-07-12 | Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to sub… |
CVE-2016-3818 | Medium | 5.5 | 2016-07-11 | libc in Android 4.x before 4.4.4 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28740702. |
CVE-2016-3816 | Medium | 5.5 | 2016-07-11 | The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka… |
CVE-2016-3815 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3814 | Medium | 5.5 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Androi… |
CVE-2016-3813 | Medium | 5.5 | 2016-07-11 | The Qualcomm USB driver in Android before 2016-07-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted applicati… |
CVE-2016-3812 | Medium | 5.5 | 2016-07-11 | The MediaTek video codec driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application… |
CVE-2016-3811 | High | 7.8 | 2016-07-11 | The kernel video driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 2844755… |
CVE-2016-3810 | Medium | 5.5 | 2016-07-11 | The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka A… |
CVE-2016-3809 | Medium | 5.5 | 2016-07-11 | The networking component in Android before 2016-07-05 on Android One, Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C… |
CVE-2016-3808 | High | 7.8 | 2016-07-11 | The serial peripheral interface driver in Android before 2016-07-05 on Pixel C devices allows attackers to gain privileges via a crafted application, aka inter… |
CVE-2016-3807 | High | 7.8 | 2016-07-11 | The serial peripheral interface driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, a… |
CVE-2016-3806 | High | 7.8 | 2016-07-11 | The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android inte… |
CVE-2016-3805 | High | 7.8 | 2016-07-11 | The MediaTek power management driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka And… |
CVE-2016-3804 | High | 7.8 | 2016-07-11 | The MediaTek power management driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka And… |
CVE-2016-3803 | High | 7.8 | 2016-07-11 | The kernel filesystem implementation in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka… |
CVE-2016-3802 | High | 7.8 | 2016-07-11 | The kernel filesystem implementation in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka interna… |
CVE-2016-3801 | High | 7.8 | 2016-07-11 | The MediaTek GPS driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal… |
CVE-2016-3800 | High | 7.8 | 2016-07-11 | The MediaTek video driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3799 | High | 7.8 | 2016-07-11 | The MediaTek video driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3798 | High | 7.8 | 2016-07-11 | The MediaTek hardware sensor driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Andr… |
CVE-2016-3797 | High | 7.8 | 2016-07-11 | The Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka Android internal… |
CVE-2016-3796 | High | 7.8 | 2016-07-11 | The MediaTek power driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3795 | High | 7.8 | 2016-07-11 | The MediaTek power driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3793 | High | 7.8 | 2016-07-11 | The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka Android internal bu… |
CVE-2016-3792 | High | 7.8 | 2016-07-11 | CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 7 (2013) devices mishandles userspace data copying, which al… |
CVE-2016-3775 | High | 7.8 | 2016-07-11 | The kernel filesystem implementation in Android before 2016-07-05 on Nexus 5X, Nexus 6, Nexus 6P, Nexus Player, and Pixel C devices allows attackers to gain pr… |
CVE-2016-3774 | High | 7.8 | 2016-07-11 | The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3773 | High | 7.8 | 2016-07-11 | The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3772 | High | 7.8 | 2016-07-11 | The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3771 | High | 7.8 | 2016-07-11 | The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3770 | High | 7.8 | 2016-07-11 | The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3769 | High | 7.8 | 2016-07-11 | The NVIDIA video driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka Android internal bug… |
CVE-2016-3768 | High | 7.8 | 2016-07-11 | The Qualcomm performance component in Android before 2016-07-05 on Nexus 5, 6, 5X, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted a… |
CVE-2016-3767 | High | 7.8 | 2016-07-11 | The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android intern… |
CVE-2016-3766 | High | 7.5 | 2016-07-11 | MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not che… |
CVE-2016-3765 | High | 7.7 | 2016-07-11 | decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a den… |
CVE-2016-3764 | Medium | 4.0 | 2016-07-11 | media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016… |
CVE-2016-3763 | Low | 3.3 | 2016-07-11 | net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01… |
CVE-2016-3762 | High | 7.8 | 2016-07-11 | The sockets subsystem in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted applicatio… |
CVE-2016-3761 | Medium | 4.0 | 2016-07-11 | NfcService.java in NFC in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive fore… |
CVE-2016-3760 | High | 7.5 | 2016-07-11 | Bluetooth in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows local users to gain privileges by establishing a pairing that rem… |
CVE-2016-3759 | Low | 3.3 | 2016-07-11 | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application t… |
CVE-2016-3758 | High | 7.8 | 2016-07-11 | Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 201… |
CVE-2016-3757 | High | 7.0 | 2016-07-11 | The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted a… |
CVE-2016-3756 | High | 7.5 | 2016-07-11 | Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of… |
CVE-2016-3755 | High | 7.5 | 2016-07-11 | decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames, which allows remote attackers to cau… |
CVE-2016-3754 | High | 7.5 | 2016-07-11 | mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not limit process-memory usage, which allows re… |
CVE-2016-3753 | High | 7.5 | 2016-07-11 | mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors, aka internal bug 27210135. |
CVE-2016-3752 | High | 7.8 | 2016-07-11 | internal/app/ChooserActivity.java in the ChooserTarget service in Android 6.x before 2016-07-01 mishandles target security checks, which allows attackers to ga… |
CVE-2016-3751 | High | 7.8 | 2016-07-11 | Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allo… |
CVE-2016-3750 | High | 7.8 | 2016-07-11 | libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not va… |
CVE-2016-3749 | High | 8.4 | 2016-07-11 | server/LockSettingsService.java in LockSettingsService in Android 6.x before 2016-07-01 allows attackers to modify the screen-lock password or pattern via a cr… |
CVE-2016-3748 | High | 8.4 | 2016-07-11 | The sockets subsystem in Android 6.x before 2016-07-01 allows attackers to bypass intended system-call restrictions via a crafted application that makes an ioc… |
CVE-2016-3747 | High | 7.8 | 2016-07-11 | Use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x be… |
CVE-2016-3746 | High | 7.8 | 2016-07-11 | Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x be… |
CVE-2016-3745 | Critical | 9.8 | 2016-07-11 | Multiple buffer overflows in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain… |
CVE-2016-3744 | High | 7.5 | 2016-07-11 | Buffer overflow in the create_pbuf function in btif/src/btif_hh.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x bef… |
CVE-2016-3743 | Critical | 9.8 | 2016-07-11 | decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbi… |