2016 CVEs (page 75)
Page 75 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4502 | High | 7.5 | 2016-05-31 | Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitr… |
CVE-2016-4501 | Critical | 9.1 | 2016-05-31 | Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and m… |
CVE-2016-2295 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-2286 | High | 7.5 | 2016-05-31 | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices wi… |
CVE-2016-2285 | High | 8.8 | 2016-05-31 | Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware… |
CVE-2016-0879 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote… |
CVE-2016-0878 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests. |
CVE-2016-0877 | High | 7.5 | 2016-05-31 | Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the pin… |
CVE-2016-0876 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file. |
CVE-2016-0875 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL. |
CVE-2016-4118 | High | 7.8 | 2016-05-30 | Untrusted search path vulnerability in the installer in Adobe Connect Add-In before 11.9.976.291 on Windows allows local users to gain privileges via unspecifi… |
CVE-2016-2311 | Medium | 6.5 | 2016-05-30 | Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with… |
CVE-2016-2309 | High | 7.2 | 2016-05-30 | iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vect… |
CVE-2016-2025 | High | 7.5 | 2016-05-30 | HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related… |
CVE-2016-2023 | Medium | 5.5 | 2016-05-30 | HPE RESTful Interface Tool 1.40 allows local users to obtain sensitive information via unspecified vectors. |
CVE-2016-1999 | Critical | 9.8 | 2016-05-30 | The server in HP Release Control 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to th… |
CVE-2016-0907 | Medium | 5.9 | 2016-05-30 | EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a D… |
CVE-2016-1409 | High | 7.5 | 2016-05-29 | The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote at… |
CVE-2016-1404 | High | 7.5 | 2016-05-29 | Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers'… |
CVE-2016-1413 | Medium | 6.5 | 2016-05-28 | The web interface in Cisco Firepower Management Center 5.4.0 through 6.0.0.1 allows remote authenticated users to modify pages by placing crafted code in a par… |
CVE-2016-1410 | High | 7.5 | 2016-05-28 | Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hostin… |
CVE-2016-1379 | Medium | 6.5 | 2016-05-28 | Cisco Adaptive Security Appliance (ASA) Software 9.0 through 9.5.1 mishandles IPsec error processing, which allows remote authenticated users to cause a denial… |
CVE-2016-3681 | High | 7.8 | 2016-05-26 | Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL be… |
CVE-2016-3680 | High | 7.8 | 2016-05-26 | Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL be… |
CVE-2016-0718 | Critical | 9.8 | 2016-05-26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers… |
CVE-2016-1385 | Medium | 6.5 | 2016-05-26 | The XML parser in Cisco Adaptive Security Appliance (ASA) Software through 9.5.2 allows remote authenticated users to cause a denial of service (instability, m… |
CVE-2016-4792 | Medium | 5.3 | 2016-05-26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1 allows remote attackers to disclose sign in pages via unspecified vectors. |
CVE-2016-4791 | High | 8.6 | 2016-05-26 | The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote adm… |
CVE-2016-4790 | Medium | 5.5 | 2016-05-26 | Cross-site scripting (XSS) vulnerability in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r… |
CVE-2016-4789 | Medium | 6.1 | 2016-05-26 | Cross-site scripting (XSS) vulnerability in the system configuration section in the administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r… |
CVE-2016-4788 | Medium | 5.8 | 2016-05-26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read an unspecified system… |
CVE-2016-4787 | Critical | 10.0 | 2016-05-26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r10, and 7.4 before 7.4r13.4 allow remote attackers to read sensitive system authe… |
CVE-2016-4786 | High | 7.5 | 2016-05-26 | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (… |
CVE-2016-4021 | High | 7.5 | 2016-05-26 | The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption)… |
CVE-2016-2784 | Medium | 4.7 | 2016-05-26 | CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links… |
CVE-2016-4575 | Medium | 6.1 | 2016-05-25 | Cross-site scripting (XSS) vulnerability in the email APP in Huawei PLK smartphones with software AL10C00 before AL10C00B211 and AL10C92 before AL10C92B211; AT… |
CVE-2016-4020 | Medium | 6.5 | 2016-05-25 | The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensi… |
CVE-2016-1887 | High | 7.8 | 2016-05-25 | Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local user… |
CVE-2016-1886 | High | 7.8 | 2016-05-25 | Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p… |
CVE-2016-1407 | High | 7.5 | 2016-05-25 | Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries, which allows remote attackers to cause a denial of service (ses… |
CVE-2016-1406 | High | 8.8 | 2016-05-25 | The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to… |
CVE-2016-1400 | High | 7.5 | 2016-05-25 | Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted… |
CVE-2016-1383 | High | 7.5 | 2016-05-25 | Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via… |
CVE-2016-1382 | High | 7.5 | 2016-05-25 | Cisco AsyncOS before 8.5.3-069 and 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, which allows remote… |
CVE-2016-1381 | High | 7.5 | 2016-05-25 | Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (mem… |
CVE-2016-1380 | High | 7.5 | 2016-05-25 | Cisco AsyncOS 8.0 before 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a craf… |
CVE-2016-0264 | Medium | 5.6 | 2016-05-24 | Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before… |
CVE-2016-4783 | Medium | 6.1 | 2016-05-23 | Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98_ww on Android before 4.4 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2016-4782 | High | 8.8 | 2016-05-23 | Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL a… |
CVE-2016-4577 | High | 7.5 | 2016-05-23 | Buffer overflow in the Smart DNS functionality in the Huawei NGFW Module and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls with software before V5… |
CVE-2016-4576 | Critical | 9.8 | 2016-05-23 | Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in the Huawei IPS Module, NGFW Module, NIP6300, NIP6600, Secospace USG6300, U… |
CVE-2016-4087 | High | 8.1 | 2016-05-23 | Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch is enabled, allows… |
CVE-2016-4049 | High | 7.5 | 2016-05-23 | The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a de… |
CVE-2016-4037 | Medium | 6.0 | 2016-05-23 | The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumpti… |
CVE-2016-4001 | High | 8.6 | 2016-05-23 | Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large… |
CVE-2016-3959 | High | 7.5 | 2016-05-23 | The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which… |
CVE-2016-3958 | High | 7.8 | 2016-05-23 | Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the cu… |
CVE-2016-3664 | High | 7.4 | 2016-05-23 | Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middl… |
CVE-2016-2855 | High | 7.8 | 2016-05-23 | The Huawei Mobile Broadband HL Service 22.001.25.00.03 and earlier uses a weak ACL for the MobileBrServ program data directory, which allows local users to gai… |
CVE-2016-4951 | High | 7.8 | 2016-05-23 | The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denia… |
CVE-2016-4913 | High | 7.8 | 2016-05-23 | The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, w… |
CVE-2016-4805 | High | 7.8 | 2016-05-23 | Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corrupti… |
CVE-2016-4794 | High | 7.8 | 2016-05-23 | Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified… |
CVE-2016-4581 | Medium | 5.5 | 2016-05-23 | fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local u… |
CVE-2016-4580 | High | 7.5 | 2016-05-23 | The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which… |
CVE-2016-4578 | Medium | 5.5 | 2016-05-23 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information fro… |
CVE-2016-4569 | Medium | 5.5 | 2016-05-23 | The snd_timer_user_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users… |
CVE-2016-4568 | High | 7.8 | 2016-05-23 | drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or po… |
CVE-2016-4565 | High | 7.8 | 2016-05-23 | The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of servi… |
CVE-2016-4558 | High | 7.0 | 2016-05-23 | The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possi… |
CVE-2016-4557 | High | 7.8 | 2016-05-23 | The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allow… |
CVE-2016-4486 | Low | 3.3 | 2016-05-23 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local use… |
CVE-2016-4485 | High | 7.5 | 2016-05-23 | The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain s… |
CVE-2016-4482 | Medium | 6.2 | 2016-05-23 | The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local user… |
CVE-2016-2190 | Medium | 5.3 | 2016-05-22 | Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remo… |
CVE-2016-2159 | Medium | 4.3 | 2016-05-22 | The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x be… |
CVE-2016-2158 | Medium | 4.3 | 2016-05-22 | lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin f… |
CVE-2016-2157 | High | 8.8 | 2016-05-22 | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x… |
CVE-2016-2156 | Medium | 4.3 | 2016-05-22 | calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event… |
CVE-2016-2155 | Medium | 4.3 | 2016-05-22 | The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moo… |
CVE-2016-2154 | Medium | 4.3 | 2016-05-22 | admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewh… |
CVE-2016-2153 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x b… |
CVE-2016-2152 | Medium | 6.1 | 2016-05-22 | Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5… |
CVE-2016-2151 | Medium | 4.3 | 2016-05-22 | user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on… |
CVE-2016-4567 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attac… |
CVE-2016-4566 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject a… |
CVE-2016-4544 | Critical | 9.8 | 2016-05-22 | The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, wh… |
CVE-2016-4543 | Critical | 9.8 | 2016-05-22 | The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which all… |
CVE-2016-4542 | Critical | 9.8 | 2016-05-22 | The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf argum… |
CVE-2016-4541 | Critical | 9.8 | 2016-05-22 | The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to… |
CVE-2016-4540 | Critical | 9.8 | 2016-05-22 | The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to… |
CVE-2016-4539 | Critical | 9.8 | 2016-05-22 | The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial o… |
CVE-2016-4538 | Critical | 9.8 | 2016-05-22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without consideri… |
CVE-2016-4537 | Critical | 9.8 | 2016-05-22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument… |
CVE-2016-4346 | Critical | 9.8 | 2016-05-22 | Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have uns… |
CVE-2016-4345 | Critical | 9.8 | 2016-05-22 | Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cause a denial of serv… |
CVE-2016-4344 | Critical | 9.8 | 2016-05-22 | Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have uns… |
CVE-2016-4343 | High | 8.8 | 2016-05-22 | The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remot… |
CVE-2016-4342 | High | 8.8 | 2016-05-22 | ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers… |
CVE-2016-2222 | High | 8.6 | 2016-05-22 | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attac… |