2016 CVEs (page 80)
Page 80 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2187 | Medium | 4.6 | 2016-05-02 | The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NU… |
CVE-2016-2186 | Medium | 4.6 | 2016-05-02 | The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of serv… |
CVE-2016-2185 | Medium | 4.6 | 2016-05-02 | The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of… |
CVE-2016-2117 | High | 7.5 | 2016-05-02 | The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remo… |
CVE-2016-2070 | High | 7.5 | 2016-05-02 | The tcp_cwnd_reduction function in net/ipv4/tcp_input.c in the Linux kernel before 4.3.5 allows remote attackers to cause a denial of service (divide-by-zero e… |
CVE-2016-2053 | Medium | 4.7 | 2016-05-02 | The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file… |
CVE-2016-1576 | High | 7.8 | 2016-05-02 | The overlayfs implementation in the Linux kernel through 4.5.2 does not properly restrict the mount namespace, which allows local users to gain privileges by m… |
CVE-2016-1575 | High | 7.8 | 2016-05-02 | The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by… |
CVE-2016-4421 | Medium | 5.9 | 2016-05-01 | epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of se… |
CVE-2016-4420 | Medium | 5.9 | 2016-05-01 | The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet. |
CVE-2016-4419 | Medium | 5.9 | 2016-05-01 | epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial… |
CVE-2016-4418 | Medium | 5.9 | 2016-05-01 | epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of se… |
CVE-2016-4417 | Medium | 5.9 | 2016-05-01 | Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote… |
CVE-2016-4416 | Medium | 5.9 | 2016-05-01 | epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which allows remote attackers t… |
CVE-2016-4415 | Medium | 5.9 | 2016-05-01 | wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which allows remote attackers to ca… |
CVE-2016-2820 | Medium | 4.3 | 2016-04-30 | The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes… |
CVE-2016-2817 | Medium | 5.4 | 2016-04-30 | The WebExtension sandbox feature in browser/components/extensions/ext-tabs.js in Mozilla Firefox before 46.0 does not properly restrict principal inheritance d… |
CVE-2016-2816 | Medium | 6.5 | 2016-04-30 | Mozilla Firefox before 46.0 allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via the multipart/x-mixed-replace content… |
CVE-2016-2814 | High | 8.8 | 2016-04-30 | Heap-based buffer overflow in the stagefright::SampleTable::parseSampleCencInfo function in libstagefright in Mozilla Firefox before 46.0, Firefox ESR 38.x bef… |
CVE-2016-2813 | Medium | 6.5 | 2016-04-30 | Mozilla Firefox before 46.0 on Android does not properly restrict JavaScript access to orientation and motion data, which allows remote attackers to obtain sen… |
CVE-2016-2812 | High | 7.5 | 2016-04-30 | Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attacke… |
CVE-2016-2811 | High | 8.8 | 2016-04-30 | Use-after-free vulnerability in the ServiceWorkerInfo class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute a… |
CVE-2016-2810 | Medium | 5.0 | 2016-04-30 | Mozilla Firefox before 46.0 on Android before 5.0 allows attackers to bypass intended Signature access requirements via a crafted application that leverages co… |
CVE-2016-2809 | Medium | 5.5 | 2016-04-30 | The Mozilla Maintenance Service updater in Mozilla Firefox before 46.0 on Windows allows user-assisted remote attackers to delete arbitrary files by leveraging… |
CVE-2016-2808 | High | 7.5 | 2016-04-30 | The watch implementation in the JavaScript engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote… |
CVE-2016-2807 | High | 8.8 | 2016-04-30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow… |
CVE-2016-2806 | High | 8.8 | 2016-04-30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a de… |
CVE-2016-2805 | High | 8.8 | 2016-04-30 | Unspecified vulnerability in the browser engine in Mozilla Firefox ESR 38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption… |
CVE-2016-2804 | High | 8.8 | 2016-04-30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 allow remote attackers to cause a denial of service (memory corruptio… |
CVE-2016-1343 | Critical | 10.0 | 2016-04-30 | The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption)… |
CVE-2016-1201 | High | 8.8 | 2016-04-30 | Cross-site request forgery (CSRF) vulnerability in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to hijack the authentication of administrators. |
CVE-2016-1200 | Medium | 6.3 | 2016-04-30 | The management screen in LOCKON EC-CUBE 3.0.7 through 3.0.9 allows remote authenticated users to bypass intended access restrictions via unspecified vectors, a… |
CVE-2016-1199 | Medium | 5.3 | 2016-04-30 | The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecifie… |
CVE-2016-1111 | High | 8.8 | 2016-04-30 | Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader… |
CVE-2016-4349 | High | 7.8 | 2016-04-28 | Untrusted search path vulnerability in Cisco WebEx Productivity Tools 2.40.5001.10012 allows local users to gain privileges via a Trojan horse cryptsp.dll, dwm… |
CVE-2016-1389 | High | 7.4 | 2016-04-28 | Open redirect vulnerability in Cisco WebEx Meetings Server (CWMS) 2.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing att… |
CVE-2016-1386 | High | 7.5 | 2016-04-28 | The API in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.0(1) allows remote attackers to spoof administrative notifications… |
CVE-2016-1205 | Medium | 6.1 | 2016-04-28 | Cross-site scripting (XSS) vulnerability in the shiro8 (1) category_freearea_ addition_plugin plugin 1.0 and (2) itemdetail_freearea_ addition_plugin plugin 1… |
CVE-2016-0211 | Medium | 4.3 | 2016-04-28 | IBM DB2 9.7 through FP11, 9.8, 10.1 through FP5, and 10.5 through FP7 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of servic… |
CVE-2016-3672 | High | 7.8 | 2016-04-27 | The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it… |
CVE-2016-3156 | Medium | 5.5 | 2016-04-27 | The IPv4 implementation in the Linux kernel before 4.5.2 mishandles destruction of device objects, which allows guest OS users to cause a denial of service (ho… |
CVE-2016-3139 | Medium | 4.6 | 2016-04-27 | The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service… |
CVE-2016-3135 | High | 7.8 | 2016-04-27 | Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to ga… |
CVE-2016-3134 | High | 8.4 | 2016-04-27 | The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denia… |
CVE-2016-2847 | Medium | 6.2 | 2016-04-27 | fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consu… |
CVE-2016-2782 | Medium | 4.6 | 2016-04-27 | The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL… |
CVE-2016-2550 | Medium | 5.5 | 2016-04-27 | The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect trac… |
CVE-2016-2549 | Medium | 6.2 | 2016-04-27 | sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service (deadlo… |
CVE-2016-2548 | Medium | 6.2 | 2016-04-27 | sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of se… |
CVE-2016-2547 | Medium | 5.1 | 2016-04-27 | sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances, which allows local users to cause… |
CVE-2016-2546 | Medium | 5.1 | 2016-04-27 | sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local users to cause a denial of service (race condition, use… |
CVE-2016-2545 | Medium | 5.1 | 2016-04-27 | The snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local us… |
CVE-2016-2544 | Medium | 5.1 | 2016-04-27 | Race condition in the queue_delete function in sound/core/seq/seq_queue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use… |
CVE-2016-2543 | Medium | 6.2 | 2016-04-27 | The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding w… |
CVE-2016-2384 | Medium | 4.6 | 2016-04-27 | Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause… |
CVE-2016-2383 | Medium | 5.5 | 2016-04-27 | The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local… |
CVE-2016-2184 | Medium | 4.6 | 2016-04-27 | The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers… |
CVE-2016-2143 | High | 7.8 | 2016-04-27 | The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a den… |
CVE-2016-2085 | Medium | 5.5 | 2016-04-27 | The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local u… |
CVE-2016-2069 | High | 7.4 | 2016-04-27 | Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a diff… |
CVE-2016-0774 | Medium | 6.8 | 2016-04-27 | The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian whee… |
CVE-2016-4002 | Critical | 9.8 | 2016-04-26 | Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers… |
CVE-2016-3082 | Critical | 9.8 | 2016-04-26 | XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via t… |
CVE-2016-3081 | High | 8.1 | 2016-04-26 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitr… |
CVE-2016-3074 | Critical | 9.8 | 2016-04-26 | Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute… |
CVE-2016-1601 | Critical | 9.8 | 2016-04-26 | yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation… |
CVE-2016-2346 | High | 8.1 | 2016-04-25 | Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrar… |
CVE-2016-2333 | High | 7.5 | 2016-04-25 | SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 use the same hardcoded encryption key across different customers' i… |
CVE-2016-2332 | High | 8.8 | 2016-04-25 | flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users t… |
CVE-2016-2331 | Critical | 9.8 | 2016-04-25 | The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier… |
CVE-2016-1202 | High | 7.8 | 2016-04-25 | Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent director… |
CVE-2016-1185 | Low | 2.5 | 2016-04-25 | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application. |
CVE-2016-4054 | High | 8.1 | 2016-04-25 | Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) response… |
CVE-2016-4053 | Low | 3.7 | 2016-04-25 | Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses… |
CVE-2016-4052 | High | 8.1 | 2016-04-25 | Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitra… |
CVE-2016-4051 | High | 8.8 | 2016-04-25 | Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbi… |
CVE-2016-4085 | Medium | 5.9 | 2016-04-25 | Stack-based buffer overflow in epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 1.12.x before 1.12.11 allows remote attackers to cause a de… |
CVE-2016-4084 | Medium | 5.9 | 2016-04-25 | Integer signedness error in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 allows remote attackers to cause a denial of… |
CVE-2016-4083 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.3 does not ensure that data is available before array allocation, which al… |
CVE-2016-4082 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses the wrong variable to index an array… |
CVE-2016-4081 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-iax2.c in the IAX2 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 uses an incorrect integer data type, which allows… |
CVE-2016-4080 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 misparses timestamp fields, which allows remote a… |
CVE-2016-4079 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-pktc.c in the PKTC dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not verify BER identifiers, which allows rem… |
CVE-2016-4078 | Medium | 5.9 | 2016-04-25 | The IEEE 802.11 dissector in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not properly restrict element lists, which allows remote attackers to… |
CVE-2016-4077 | Medium | 5.9 | 2016-04-25 | epan/reassemble.c in TShark in Wireshark 2.0.x before 2.0.3 relies on incorrect special-case handling of truncated Tvb data structures, which allows remote att… |
CVE-2016-4076 | Medium | 5.9 | 2016-04-25 | epan/dissectors/packet-ncp2222.inc in the NCP dissector in Wireshark 2.0.x before 2.0.3 does not properly initialize memory for search patterns, which allows r… |
CVE-2016-4006 | Medium | 5.9 | 2016-04-25 | epan/proto.c in Wireshark 1.12.x before 1.12.11 and 2.0.x before 2.0.3 does not limit the protocol-tree depth, which allows remote attackers to cause a denial… |
CVE-2016-2115 | Medium | 5.9 | 2016-04-25 | Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not require SMB signing within a DCERPC session over ncacn_np, which allows ma… |
CVE-2016-2114 | Medium | 5.9 | 2016-04-25 | The SMB1 protocol implementation in Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "server signing = mandatory" set… |
CVE-2016-2113 | High | 7.4 | 2016-04-25 | Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attacke… |
CVE-2016-2112 | Medium | 5.9 | 2016-04-25 | The bundled LDAP client library in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not recognize the "client ldap sasl wrappin… |
CVE-2016-2111 | Medium | 6.3 | 2016-04-25 | The NETLOGON service in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2, when a domain controller is configured, allows remote atta… |
CVE-2016-2110 | Medium | 5.9 | 2016-04-25 | The NTLMSSP authentication implementation in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 allows man-in-the-middle attackers to… |
CVE-2016-3126 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-2204 | High | 8.2 | 2016-04-22 | The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to obtain root-shell access via crafted terminal-… |
CVE-2016-2203 | High | 7.8 | 2016-04-22 | The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveragin… |
CVE-2016-1918 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-1917 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote attackers to inject arb… |
CVE-2016-1916 | Medium | 5.4 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in the Management Console in BlackBerry Enterprise Server (BES) 12 before 12.4.1 allows remote authenticated users to… |
CVE-2016-1036 | Medium | 6.1 | 2016-04-22 | Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, allows remote attacke… |