2016 CVEs (page 71)
Page 71 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4513 | Medium | 6.1 | 2016-06-26 | Cross-site scripting (XSS) vulnerability in the Schneider Electric PowerLogic PM8ECC module before 2.651 for PowerMeter 800 devices allows remote attackers to… |
CVE-2016-2901 | High | 8.8 | 2016-06-26 | Cross-site request forgery (CSRF) vulnerability in the PA_Theme_Creator application in IBM WebSphere Portal 8.5 CF08 through CF10 and Web Content Manager allow… |
CVE-2016-4828 | Medium | 6.5 | 2016-06-25 | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of… |
CVE-2016-4827 | Medium | 6.1 | 2016-06-25 | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scr… |
CVE-2016-4826 | Medium | 6.1 | 2016-06-25 | Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web scr… |
CVE-2016-4825 | Medium | 5.6 | 2016-06-25 | The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code… |
CVE-2016-4824 | Medium | 5.3 | 2016-06-25 | The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authentication attempts, w… |
CVE-2016-4823 | High | 7.5 | 2016-06-25 | Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors. |
CVE-2016-4822 | High | 8.0 | 2016-06-25 | Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors. |
CVE-2016-1193 | High | 7.5 | 2016-06-25 | Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors. |
CVE-2016-1190 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.1 through 4.2 allows remote authenticated users to bypass intended restrictions on MultiReport reading via unspecified vectors. |
CVE-2016-1189 | High | 8.1 | 2016-06-25 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspe… |
CVE-2016-1188 | Medium | 6.5 | 2016-06-25 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to send spoofed e-mail messages via unspecified vectors. |
CVE-2016-4528 | Medium | 5.0 | 2016-06-25 | Buffer overflow in Advantech WebAccess before 8.1_20160519 allows local users to cause a denial of service via a crafted DLL file. |
CVE-2016-4525 | Medium | 6.6 | 2016-06-25 | Unspecified ActiveX controls in Advantech WebAccess before 8.1_20160519 allow remote authenticated users to obtain sensitive information or modify data via unk… |
CVE-2016-4519 | Critical | 9.8 | 2016-06-25 | Stack-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.30 allows remote attackers to execute arbitrary code via a crafted filename field in a… |
CVE-2016-5723 | High | 7.8 | 2016-06-24 | Huawei FusionInsight HD before V100R002C60SPC200 allows local users to gain root privileges via unspecified vectors. |
CVE-2016-5722 | High | 7.3 | 2016-06-24 | Huawei OceanStor 5300 V3, 5500 V3, 5600 V3, 5800 V3, 6800 V3, 18800 V3, and 18500 V3 before V300R003C10 sends the plaintext session token in the HTTP header, w… |
CVE-2016-5709 | Medium | 4.7 | 2016-06-24 | SolarWinds Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which allows local users with superuser privileges… |
CVE-2016-5435 | Medium | 5.9 | 2016-06-24 | Memory leak in Huawei IPS Module, NGFW Module, NIP6300, NIP6600, and Secospace USG6300, USG6500, USG6600, USG9500, and AntiDDoS8000 V500R001C00 before V500R001… |
CVE-2016-5021 | Medium | 4.9 | 2016-06-24 | The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.5.x before 11.5.4, 11.6.x before 11.6.1, and 12.x before… |
CVE-2016-4802 | High | 7.8 | 2016-06-24 | Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbit… |
CVE-2016-1439 | Medium | 6.1 | 2016-06-23 | Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Contact Center Enterprise through 10.5(2) allows remote attackers to inje… |
CVE-2016-1438 | High | 7.5 | 2016-06-23 | Cisco AsyncOS 9.7.0-125 on Email Security Appliance (ESA) devices allows remote attackers to bypass intended spam filtering via crafted executable content in a… |
CVE-2016-1437 | Medium | 6.5 | 2016-06-23 | SQL injection vulnerability in the SQL database in Cisco Prime Collaboration Deployment before 11.5.1 allows remote authenticated users to execute arbitrary SQ… |
CVE-2016-1436 | High | 7.5 | 2016-06-23 | The General Packet Radio Switching Tunneling Protocol 1 (aka GTPv1) implementation on Cisco ASR 5000 Packet Data Network Gateway devices before 19.4 allows rem… |
CVE-2016-1435 | High | 7.0 | 2016-06-23 | Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, which allows local users to write to arbitrary files by leverag… |
CVE-2016-1434 | Medium | 6.5 | 2016-06-23 | The license-certificate upload functionality on Cisco 8800 phones with software 11.0(1) allows remote authenticated users to delete arbitrary files via an inva… |
CVE-2016-1428 | Medium | 6.5 | 2016-06-23 | Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device restart) via a sequenc… |
CVE-2016-0914 | Medium | 6.3 | 2016-06-23 | EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before P… |
CVE-2016-2364 | High | 7.5 | 2016-06-20 | The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different custom… |
CVE-2016-2363 | High | 7.8 | 2016-06-20 | Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obt… |
CVE-2016-2362 | Critical | 9.8 | 2016-06-20 | Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain ac… |
CVE-2016-2178 | Medium | 5.5 | 2016-06-20 | The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it eas… |
CVE-2016-2177 | Critical | 9.8 | 2016-06-20 | OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (in… |
CVE-2016-4811 | Medium | 5.6 | 2016-06-19 | The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attack… |
CVE-2016-4530 | Medium | 6.5 | 2016-06-19 | OSIsoft PI SQL Data Access Server (aka OLE DB) 2016 1.5 allows remote authenticated users to cause a denial of service (service outage and data loss) via a mes… |
CVE-2016-4518 | Medium | 6.5 | 2016-06-19 | OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message. |
CVE-2016-4514 | High | 7.7 | 2016-06-19 | Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy. |
CVE-2016-1864 | Medium | 4.3 | 2016-06-19 | The XSS auditor in WebKit, as used in Apple iOS before 9.3 and Safari before 9.1, does not properly handle redirects in block mode, which allows remote attacke… |
CVE-2016-1862 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1861 | High | 7.8 | 2016-06-19 | The NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of serv… |
CVE-2016-1860 | Low | 3.3 | 2016-06-19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnera… |
CVE-2016-1196 | Medium | 4.3 | 2016-06-19 | Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive Address Book information v… |
CVE-2016-1192 | Medium | 4.3 | 2016-06-19 | Directory traversal vulnerability in the logging implementation in Cybozu Garoon 3.7 through 4.2 allows remote authenticated users to read a log file via unspe… |
CVE-2016-1191 | Medium | 5.3 | 2016-06-19 | Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified ve… |
CVE-2016-0912 | Critical | 9.8 | 2016-06-19 | EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1)… |
CVE-2016-0911 | High | 8.2 | 2016-06-19 | EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain fil… |
CVE-2016-0392 | High | 8.4 | 2016-06-19 | IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x be… |
CVE-2016-1226 | Medium | 6.1 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in Trend Micro Internet Security 8 and 10 allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2016-1225 | Medium | 6.5 | 2016-06-19 | Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors. |
CVE-2016-1197 | Medium | 6.1 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.x before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vecto… |
CVE-2016-1195 | High | 7.4 | 2016-06-19 | Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing att… |
CVE-2016-4821 | Medium | 5.3 | 2016-06-19 | I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors. |
CVE-2016-4820 | High | 8.8 | 2016-06-19 | Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arbitrary users. |
CVE-2016-4819 | Critical | 9.8 | 2016-06-19 | The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Library for Visual C+… |
CVE-2016-4817 | High | 7.5 | 2016-06-19 | lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of servi… |
CVE-2016-4816 | Medium | 6.5 | 2016-06-19 | BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive informati… |
CVE-2016-4815 | High | 7.5 | 2016-06-19 | Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 and earlier allows r… |
CVE-2016-4814 | High | 7.5 | 2016-06-19 | Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 on Windows allows re… |
CVE-2016-4813 | High | 8.8 | 2016-06-19 | NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account. |
CVE-2016-4371 | High | 8.0 | 2016-06-19 | HPE Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote authenticated users to obtain sensitive information, modify data… |
CVE-2016-1424 | Medium | 6.5 | 2016-06-19 | Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug ID CSCun63132. |
CVE-2016-1397 | Medium | 6.5 | 2016-06-19 | Buffer overflow in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and R… |
CVE-2016-1396 | Medium | 6.1 | 2016-06-19 | Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmwa… |
CVE-2016-1395 | Critical | 9.8 | 2016-06-19 | The web-based management interface on Cisco RV110W devices with firmware before 1.2.1.7, RV130W devices with firmware before 1.0.3.16, and RV215W devices with… |
CVE-2016-1224 | Medium | 6.1 | 2016-06-19 | CRLF injection vulnerability in Trend Micro Worry-Free Business Security Service 5.x and Worry-Free Business Security 9.0 allows remote attackers to inject arb… |
CVE-2016-1223 | Medium | 5.3 | 2016-06-19 | Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote… |
CVE-2016-1183 | Low | 3.7 | 2016-06-19 | NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allow… |
CVE-2016-1432 | Medium | 6.5 | 2016-06-18 | Cisco IOS XE 3.15S and 3.16S on cBR-8 Converged Broadband Router devices allows remote authenticated users to cause a denial of service (NULL pointer dereferen… |
CVE-2016-1431 | Medium | 6.1 | 2016-06-18 | Cross-site scripting (XSS) vulnerability in Cisco Firepower Management Center 4.10.3, 5.2.0, 5.3.0, 5.3.1, and 5.4.0 allows remote attackers to inject arbitrar… |
CVE-2016-1427 | High | 7.5 | 2016-06-18 | The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attacke… |
CVE-2016-5433 | Medium | 6.1 | 2016-06-17 | Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors. |
CVE-2016-5363 | High | 8.2 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism… |
CVE-2016-5362 | High | 8.2 | 2016-06-17 | The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanis… |
CVE-2016-3643 | High | 7.8 | 2016-06-17 | SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat… |
CVE-2016-3642 | Critical | 9.8 | 2016-06-17 | The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted serialized Java obje… |
CVE-2016-5300 | High | 7.5 | 2016-06-16 | The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU con… |
CVE-2016-3687 | Medium | 5.3 | 2016-06-16 | Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi-domain single sign-… |
CVE-2016-3062 | High | 8.8 | 2016-06-16 | The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corrup… |
CVE-2016-2841 | Medium | 6.0 | 2016-06-16 | The ne2000_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators to cause a denial o… |
CVE-2016-2538 | High | 7.1 | 2016-06-16 | Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of… |
CVE-2016-2392 | Medium | 6.5 | 2016-06-16 | The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor object… |
CVE-2016-2391 | Medium | 5.0 | 2016-06-16 | The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NU… |
CVE-2016-5361 | High | 7.5 | 2016-06-16 | programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic am… |
CVE-2016-4171 | Critical | 9.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in t… |
CVE-2016-4167 | Critical | 9.8 | 2016-06-16 | Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspec… |
CVE-2016-4166 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4165 | Critical | 9.8 | 2016-06-16 | The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input. |
CVE-2016-4164 | Medium | 6.1 | 2016-06-16 | Cross-site scripting (XSS) vulnerability in Adobe Brackets before 1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2016-4163 | Critical | 9.8 | 2016-06-16 | Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute a… |
CVE-2016-4162 | Critical | 9.8 | 2016-06-16 | Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute a… |
CVE-2016-4161 | Critical | 9.8 | 2016-06-16 | Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute a… |
CVE-2016-4160 | Critical | 9.8 | 2016-06-16 | Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute a… |
CVE-2016-4159 | Medium | 6.1 | 2016-06-16 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to injec… |
CVE-2016-4158 | High | 7.3 | 2016-06-16 | Unquoted Windows search path vulnerability in Adobe Creative Cloud Desktop Application before 3.7.0.272 on Windows allows local users to gain privileges via a… |
CVE-2016-4157 | High | 7.3 | 2016-06-16 | Untrusted search path vulnerability in the installer in Adobe Creative Cloud Desktop Application before 3.7.0.272 on Windows allows local users to gain privile… |
CVE-2016-4156 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4155 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |
CVE-2016-4154 | High | 8.8 | 2016-06-16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Micro… |