2016 CVEs (page 7)
Page 7 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-5819 | Medium | 6.1 | 2019-03-21 | Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scri… |
CVE-2016-5800 | High | 7.5 | 2019-03-21 | A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Des… |
CVE-2016-10742 | Medium | 6.1 | 2019-02-17 | Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request param… |
CVE-2016-1000282 | Critical | 9.8 | 2019-02-05 | Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injectio… |
CVE-2016-1000271 | Critical | 9.8 | 2019-02-04 | Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&c… |
CVE-2016-10741 | Medium | 4.7 | 2019-02-01 | In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between di… |
CVE-2016-10740 | Medium | 4.9 | 2019-01-29 | Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP director… |
CVE-2016-10739 | Medium | 5.3 | 2019-01-21 | In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by w… |
CVE-2016-9778 | High | 7.5 | 2019-01-16 | An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for which it is also p… |
CVE-2016-10738 | High | 8.8 | 2019-01-16 | Zenbership v107 has CSRF via admin/cp-functions/event-add.php. |
CVE-2016-10737 | Medium | 5.4 | 2019-01-16 | Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter. |
CVE-2016-7576 | High | 7.8 | 2019-01-11 | In iOS before 9.3.3, a memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. |
CVE-2016-4644 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a downgrade issue existed with HTTP authentication cr… |
CVE-2016-4643 | Medium | 6.5 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, a validation issue existed in the parsing of 407 resp… |
CVE-2016-4642 | Medium | 5.9 | 2019-01-11 | In iOS before 9.3.3, tvOS before 9.2.2, and OS X El Capitan before v10.11.6 and Security Update 2016-004, proxy authentication incorrectly reported HTTP proxie… |
CVE-2016-10736 | Medium | 6.1 | 2019-01-09 | The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class param… |
CVE-2016-9651 | High | 8.8 | 2019-01-09 | A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary co… |
CVE-2016-10403 | High | 8.8 | 2019-01-09 | Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bounds memory read v… |
CVE-2016-10735 | Medium | 6.1 | 2019-01-09 | In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. |
CVE-2016-10502 | Critical | 9.8 | 2018-12-10 | While generating trusted application id, An integer overflow can occur giving the trusted application an invalid identity in Snapdragon Mobile and Snapdragon W… |
CVE-2016-9749 | Medium | 4.0 | 2018-11-09 | IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass security due to lack of input validation… |
CVE-2016-2123 | High | 8.8 | 2018-11-01 | A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled mem… |
CVE-2016-2120 | High | 7.5 | 2018-11-01 | An issue has been found in PowerDNS Authoritative Server versions up to and including 3.4.10, 4.0.1 allowing an authorized user to crash the server by insertin… |
CVE-2016-6328 | High | 8.1 | 2018-10-31 | A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Infor… |
CVE-2016-2125 | Medium | 6.5 | 2018-10-31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba… |
CVE-2016-6343 | Medium | 6.1 | 2018-10-31 | JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder… |
CVE-2016-5402 | High | 8.8 | 2018-10-31 | A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the c… |
CVE-2016-2121 | Medium | 4.0 | 2018-10-31 | A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potentially contain sensitive information. A loc… |
CVE-2016-10734 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php. |
CVE-2016-10733 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string. |
CVE-2016-10732 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.ph… |
CVE-2016-10731 | Critical | 9.8 | 2018-10-29 | ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files… |
CVE-2016-10730 | High | 7.8 | 2018-10-24 | An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. Amstar is an Amanda Application API scri… |
CVE-2016-10729 | High | 7.8 | 2018-10-24 | An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not… |
CVE-2016-9069 | High | 7.8 | 2018-10-18 | A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. |
CVE-2016-7475 | High | 7.5 | 2018-10-08 | Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel (TMM) may not properly clean-up pool… |
CVE-2016-9045 | High | 8.8 | 2018-09-17 | A code execution vulnerability exists in ProcessMaker Enterprise Core 3.0.1.7-community. A specially crafted web request can cause unsafe deserialization poten… |
CVE-2016-0715 | Medium | 5.9 | 2018-09-11 | Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosu… |
CVE-2016-7066 | High | 7.8 | 2018-09-11 | It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform before 7.1.0 can allow any local user to con… |
CVE-2016-7074 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7073 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in position of man-in-the-middle to alter… |
CVE-2016-7070 | High | 8.0 | 2018-09-11 | A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of… |
CVE-2016-7069 | Medium | 5.9 | 2018-09-11 | An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to a… |
CVE-2016-7068 | Medium | 5.3 | 2018-09-11 | An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated attacker to cause… |
CVE-2016-7047 | Medium | 4.3 | 2018-09-11 | A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could… |
CVE-2016-0750 | Medium | 4.2 | 2018-09-11 | The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit… |
CVE-2016-7072 | Medium | 5.3 | 2018-09-10 | An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated attacker to cause a denial of service by op… |
CVE-2016-9048 | High | 7.4 | 2018-09-10 | Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially crafted web requests can cause SQL injec… |
CVE-2016-7061 | Low | 3.5 | 2018-09-10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marki… |
CVE-2016-7056 | Medium | 5.5 | 2018-09-10 | A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. |
CVE-2016-7041 | Medium | 6.5 | 2018-09-10 | Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and re… |
CVE-2016-7035 | High | 8.8 | 2018-09-10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pa… |
CVE-2016-7078 | Medium | 4.3 | 2018-09-10 | foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/loca… |
CVE-2016-7077 | Medium | 4.3 | 2018-09-10 | foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthoriz… |
CVE-2016-7071 | High | 8.8 | 2018-09-10 | It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated att… |
CVE-2016-7075 | High | 7.5 | 2018-09-10 | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker c… |
CVE-2016-7067 | Medium | 6.5 | 2018-09-10 | Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitor… |
CVE-2016-9044 | High | 8.8 | 2018-09-07 | An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can… |
CVE-2016-9040 | Medium | 5.5 | 2018-09-07 | An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system ca… |
CVE-2016-1000232 | Medium | 5.3 | 2018-09-05 | NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Servic… |
CVE-2016-1000030 | Critical | 9.8 | 2018-09-05 | Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() a… |
CVE-2016-0373 | Low | 3.1 | 2018-08-30 | IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing use… |
CVE-2016-0234 | Medium | 4.0 | 2018-08-30 | IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neg… |
CVE-2016-0205 | Low | 3.3 | 2018-08-30 | A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate val… |
CVE-2016-9605 | Medium | 6.1 | 2018-08-22 | A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file read… |
CVE-2016-7048 | High | 8.1 | 2018-08-20 | The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by le… |
CVE-2016-9598 | Medium | 6.5 | 2018-08-16 | libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via… |
CVE-2016-9596 | Medium | 6.5 | 2018-08-16 | libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption)… |
CVE-2016-4975 | Medium | 6.1 | 2018-08-14 | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32… |
CVE-2016-2922 | Low | 3.7 | 2018-08-13 | IBM Rational ClearQuest 8.0 through 8.0.1.9 and 9.0 through 9.0.1.3 (CQ OSLC linkages, EmailRelay) fails to check the SSL certificate against the requested hos… |
CVE-2016-8527 | Medium | 6.1 | 2018-08-06 | Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to a reflected cross-site scripting (XSS). The vulnerability is present in the Visua… |
CVE-2016-8526 | High | 8.8 | 2018-08-06 | Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access st… |
CVE-2016-4406 | Medium | 6.1 | 2018-08-06 | A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44. |
CVE-2016-4405 | High | 8.8 | 2018-08-06 | A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.2… |
CVE-2016-4404 | Critical | 9.8 | 2018-08-06 | A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow co… |
CVE-2016-4403 | Critical | 9.8 | 2018-08-06 | A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow co… |
CVE-2016-4402 | Critical | 9.8 | 2018-08-06 | A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow co… |
CVE-2016-4400 | Medium | 5.4 | 2018-08-06 | A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could res… |
CVE-2016-4399 | Medium | 5.4 | 2018-08-06 | A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could res… |
CVE-2016-4398 | High | 8.8 | 2018-08-06 | A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using… |
CVE-2016-4397 | High | 7.8 | 2018-08-06 | A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software. |
CVE-2016-4392 | Medium | 5.4 | 2018-08-06 | A remote cross site scripting vulnerability has been identified in HP Business Service Management software v9.1x, v9.20 - v9.25IP1. |
CVE-2016-4391 | Critical | 9.8 | 2018-08-06 | A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0. |
CVE-2016-8640 | Critical | 9.1 | 2018-08-01 | A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw datab… |
CVE-2016-9583 | Medium | 5.5 | 2018-08-01 | An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. |
CVE-2016-8609 | Low | 3.7 | 2018-08-01 | It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from… |
CVE-2016-9580 | Low | 3.3 | 2018-08-01 | An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow. |
CVE-2016-9579 | Medium | 6.5 | 2018-08-01 | A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unaut… |
CVE-2016-9572 | Medium | 5.9 | 2018-08-01 | A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the… |
CVE-2016-8654 | High | 7.8 | 2018-08-01 | A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are… |
CVE-2016-8651 | Low | 3.1 | 2018-08-01 | An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull a… |
CVE-2016-9581 | Low | 3.3 | 2018-08-01 | An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2. |
CVE-2016-8653 | Medium | 5.3 | 2018-08-01 | It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to la… |
CVE-2016-8648 | High | 7.2 | 2018-08-01 | It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An… |
CVE-2016-8641 | Medium | 6.7 | 2018-08-01 | A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownershi… |
CVE-2016-8608 | Medium | 5.4 | 2018-08-01 | JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authen… |
CVE-2016-8639 | Medium | 6.1 | 2018-08-01 | It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set… |
CVE-2016-8637 | Medium | 5.0 | 2018-08-01 | A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used… |
CVE-2016-8635 | Medium | 5.3 | 2018-08-01 | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this fla… |
CVE-2016-8634 | Medium | 6.1 | 2018-08-01 | A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard… |