2016 CVEs (page 74)
Page 74 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4358 | High | 8.1 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulne… |
CVE-2016-4357 | High | 8.1 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffe… |
CVE-2016-2078 | Medium | 6.1 | 2016-06-08 | Cross-site scripting (XSS) vulnerability in the Web Client in VMware vCenter Server 5.1 before update 3d, 5.5 before update 3d, and 6.0 before update 2 on Wind… |
CVE-2016-2030 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-2029 | Critical | 9.1 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors, a different vulne… |
CVE-2016-2028 | High | 8.1 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diffe… |
CVE-2016-2027 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2016-2026 | High | 7.5 | 2016-06-08 | HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information via unspecified vectors, a different vulnerability than C… |
CVE-2016-2024 | Critical | 9.8 | 2016-06-08 | HPE Insight Control before 7.5.1 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors. |
CVE-2016-2022 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-2021 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-2020 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-2019 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-2018 | Critical | 9.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors. |
CVE-2016-2017 | High | 8.1 | 2016-06-08 | HPE Systems Insight Manager (SIM) before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a diff… |
CVE-2016-1418 | High | 7.8 | 2016-06-08 | Cisco Aironet Access Point Software 8.2(100.0) on 1830e, 1830i, 1850e, 1850i, 2800, and 3800 access points allows local users to obtain Linux root access via c… |
CVE-2016-1405 | High | 7.5 | 2016-06-08 | libclamav in ClamAV (aka Clam AntiVirus), as used in Advanced Malware Protection (AMP) on Cisco Email Security Appliance (ESA) devices before 9.7.0-125 and Web… |
CVE-2016-4545 | High | 7.5 | 2016-06-07 | Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service (resource consumption and Traffic Manag… |
CVE-2016-3093 | Medium | 5.3 | 2016-06-07 | Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a deni… |
CVE-2016-3087 | Critical | 9.8 | 2016-06-07 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitr… |
CVE-2016-3072 | High | 8.8 | 2016-06-07 | Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated… |
CVE-2016-5242 | Medium | 5.6 | 2016-06-07 | The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of servic… |
CVE-2016-4963 | Medium | 4.7 | 2016-06-07 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confu… |
CVE-2016-4962 | Medium | 6.7 | 2016-06-07 | The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facili… |
CVE-2016-4450 | High | 7.5 | 2016-06-07 | os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker p… |
CVE-2016-4437 | Critical | 9.8 | 2016-06-07 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass… |
CVE-2016-2335 | High | 8.8 | 2016-06-07 | The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of… |
CVE-2016-1703 | High | 8.8 | 2016-06-05 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknow… |
CVE-2016-1702 | Medium | 6.5 | 2016-06-05 | The SkRegion::readFromMemory function in core/SkRegion.cpp in Skia, as used in Google Chrome before 51.0.2704.79, does not validate the interval count, which a… |
CVE-2016-1701 | High | 8.8 | 2016-06-05 | The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame del… |
CVE-2016-1700 | High | 7.5 | 2016-06-05 | extensions/renderer/runtime_custom_bindings.cc in Google Chrome before 51.0.2704.79 does not consider side effects during creation of an array of extension vie… |
CVE-2016-1699 | Medium | 6.5 | 2016-06-05 | WebKit/Source/devtools/front_end/devtools.js in the Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before 51.0.2704.79, does not e… |
CVE-2016-1698 | Medium | 6.5 | 2016-06-05 | The createCustomType function in extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.79 does not validate modu… |
CVE-2016-1697 | High | 8.8 | 2016-06-05 | The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame… |
CVE-2016-1696 | High | 8.8 | 2016-06-05 | The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Orig… |
CVE-2016-1695 | High | 8.8 | 2016-06-05 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknow… |
CVE-2016-1694 | Medium | 5.3 | 2016-06-05 | browser/browsing_data/browsing_data_remover.cc in Google Chrome before 51.0.2704.63 deletes HPKP pins during cache clearing, which makes it easier for remote a… |
CVE-2016-1693 | Medium | 5.3 | 2016-06-05 | browser/safe_browsing/srt_field_trial_win.cc in Google Chrome before 51.0.2704.63 does not use the HTTPS service on dl.google.com to obtain the Software Remova… |
CVE-2016-1692 | Medium | 5.3 | 2016-06-05 | WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a Serv… |
CVE-2016-1691 | High | 7.5 | 2016-06-05 | Skia, as used in Google Chrome before 51.0.2704.63, mishandles coincidence runs, which allows remote attackers to cause a denial of service (heap-based buffer… |
CVE-2016-1690 | High | 7.5 | 2016-06-05 | The Autofill implementation in Google Chrome before 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame del… |
CVE-2016-1689 | Medium | 6.5 | 2016-06-05 | Heap-based buffer overflow in content/renderer/media/canvas_capture_handler.cc in Google Chrome before 51.0.2704.63 allows remote attackers to cause a denial o… |
CVE-2016-1688 | Medium | 6.5 | 2016-06-05 | The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string size… |
CVE-2016-1687 | Medium | 6.5 | 2016-06-05 | The renderer implementation in Google Chrome before 51.0.2704.63 does not properly restrict public exposure of classes, which allows remote attackers to obtain… |
CVE-2016-1686 | Medium | 6.5 | 2016-06-05 | The CPDF_DIBSource::CreateDecoder function in core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, misha… |
CVE-2016-1685 | Medium | 6.5 | 2016-06-05 | core/fxge/ge/fx_ge_text.cpp in PDFium, as used in Google Chrome before 51.0.2704.63, miscalculates certain index values, which allows remote attackers to cause… |
CVE-2016-1684 | High | 7.5 | 2016-06-05 | numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles the i format token for xsl:number data, which allows remote attack… |
CVE-2016-1683 | High | 7.5 | 2016-06-05 | numbers.c in libxslt before 1.1.29, as used in Google Chrome before 51.0.2704.63, mishandles namespace nodes, which allows remote attackers to cause a denial o… |
CVE-2016-1682 | Medium | 6.1 | 2016-06-05 | The ServiceWorkerContainer::registerServiceWorkerImpl function in WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp in Blink, as used in Google C… |
CVE-2016-1681 | High | 8.8 | 2016-06-05 | Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote… |
CVE-2016-1680 | High | 8.8 | 2016-06-05 | Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial… |
CVE-2016-1679 | High | 8.8 | 2016-06-05 | The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of ge… |
CVE-2016-1678 | High | 8.8 | 2016-06-05 | objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote att… |
CVE-2016-1677 | Medium | 6.5 | 2016-06-05 | uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sens… |
CVE-2016-1676 | High | 8.8 | 2016-06-05 | extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote a… |
CVE-2016-1675 | High | 8.8 | 2016-06-05 | Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattac… |
CVE-2016-1674 | High | 8.8 | 2016-06-05 | The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors. |
CVE-2016-1673 | High | 8.8 | 2016-06-05 | Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. |
CVE-2016-1672 | High | 8.8 | 2016-06-05 | The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles… |
CVE-2016-1230 | Medium | 6.1 | 2016-06-05 | Cross-site scripting (XSS) vulnerability in NTT PC Communications WebARENA Service formmail before 2.2.1 allows remote attackers to inject arbitrary web script… |
CVE-2016-1229 | Medium | 5.4 | 2016-06-05 | Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject… |
CVE-2016-1222 | Medium | 6.1 | 2016-06-05 | Cross-site scripting (XSS) vulnerability in Kobe Beauty php-contact-form before 2016-05-18 allows remote attackers to inject arbitrary web script or HTML via a… |
CVE-2016-1212 | Low | 2.7 | 2016-06-05 | Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrar… |
CVE-2016-4812 | Medium | 6.1 | 2016-06-04 | Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web scr… |
CVE-2016-4564 | Critical | 9.8 | 2016-06-04 | The DrawImage function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 makes an incorrect function call in attempting to locate the n… |
CVE-2016-4563 | High | 8.8 | 2016-06-04 | The TraceStrokePolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles the relationship between the BezierQuantum… |
CVE-2016-4562 | High | 8.8 | 2016-06-04 | The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data… |
CVE-2016-1403 | High | 7.8 | 2016-06-04 | CISCO IP 8800 phones with software 11.0.1 and earlier allow local users to gain privileges for OS command execution via crafted CLI commands, aka Bug ID CSCuz0… |
CVE-2016-1211 | Medium | 6.1 | 2016-06-04 | Cross-site scripting (XSS) vulnerability in Epoch Web Mailing List 0.31 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecif… |
CVE-2016-1391 | High | 8.8 | 2016-06-04 | Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(2) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1… |
CVE-2016-1390 | High | 7.8 | 2016-06-04 | Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1… |
CVE-2016-0908 | Medium | 6.7 | 2016-06-04 | EMC Isilon OneFS 7.1.x before 7.1.1.9 and 7.2.x before 7.2.1.2 allows local users to obtain root shell access by leveraging administrative privileges. |
CVE-2016-4804 | Medium | 6.2 | 2016-06-03 | The read_boot function in boot.c in dosfstools before 4.0 allows attackers to cause a denial of service (crash) via a crafted filesystem, which triggers a heap… |
CVE-2016-3944 | High | 7.5 | 2016-06-03 | UpdateAgent in Lenovo Accelerator Application allows man-in-the-middle attackers to execute arbitrary code by spoofing an update response from susapi.lenovomm… |
CVE-2016-3096 | High | 7.8 | 2016-06-03 | The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain… |
CVE-2016-0376 | High | 8.1 | 2016-06-03 | The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before S… |
CVE-2016-0363 | High | 8.1 | 2016-06-03 | The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 F… |
CVE-2016-1388 | Critical | 9.8 | 2016-06-03 | Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1… |
CVE-2016-1370 | Medium | 5.3 | 2016-06-03 | Cisco Prime Network Analysis Module (NAM) before 6.2(1-b) miscalculates IPv6 payload lengths, which allows remote attackers to cause a denial of service (mond… |
CVE-2016-5126 | High | 7.8 | 2016-06-01 | Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process cras… |
CVE-2016-4945 | Medium | 6.1 | 2016-06-01 | Cross-site scripting (XSS) vulnerability in vpn/js/gateway_login_form_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows remote attackers to in… |
CVE-2016-4810 | High | 7.5 | 2016-06-01 | Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attackers to set Access Pol… |
CVE-2016-4454 | Medium | 6.0 | 2016-06-01 | The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause… |
CVE-2016-4453 | Medium | 4.4 | 2016-06-01 | The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU proce… |
CVE-2016-4423 | High | 7.5 | 2016-06-01 | The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2… |
CVE-2016-1902 | High | 7.5 | 2016-06-01 | The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random number… |
CVE-2016-4432 | Critical | 9.1 | 2016-06-01 | The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently p… |
CVE-2016-3697 | High | 7.8 | 2016-06-01 | libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local us… |
CVE-2016-3094 | Medium | 5.9 | 2016-06-01 | PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of… |
CVE-2016-3088 | Critical | 9.8 | 2016-06-01 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by a… |
CVE-2016-3075 | High | 7.5 | 2016-06-01 | Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attack… |
CVE-2016-2175 | High | 7.8 | 2016-06-01 | Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External… |
CVE-2016-1234 | High | 7.5 | 2016-06-01 | Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attacke… |
CVE-2016-4500 | Medium | 5.8 | 2016-06-01 | Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access. |
CVE-2016-0288 | Medium | 6.5 | 2016-06-01 | IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via… |
CVE-2016-4785 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4784 | Medium | 5.3 | 2016-05-31 | A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100… |
CVE-2016-4521 | Critical | 9.8 | 2016-05-31 | Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, which allows remote attackers to obtain access via unsp… |
CVE-2016-4506 | High | 8.0 | 2016-05-31 | Cross-site request forgery (CSRF) vulnerability on Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allows remote authenticate… |
CVE-2016-4505 | High | 8.8 | 2016-05-31 | Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecifie… |