2016 CVEs (page 82)
Page 82 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0671 | Low | 3.7 | 2016-04-21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vector… |
CVE-2016-0669 | Medium | 6.0 | 2016-04-21 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect integrity and availability via vectors related to Fwflash. |
CVE-2016-0668 | Medium | 4.1 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local us… |
CVE-2016-0667 | Medium | 4.4 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Locking. |
CVE-2016-0666 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0665 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security… |
CVE-2016-0663 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Performance Schema. |
CVE-2016-0662 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Partition. |
CVE-2016-0661 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options. |
CVE-2016-0659 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Optimizer. |
CVE-2016-0658 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to Optimizer. |
CVE-2016-0657 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON. |
CVE-2016-0656 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability… |
CVE-2016-0655 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local us… |
CVE-2016-0654 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB, a different vulnerability… |
CVE-2016-0653 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to FTS. |
CVE-2016-0652 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to DML. |
CVE-2016-0651 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer. |
CVE-2016-0650 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0649 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0648 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0647 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0646 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0644 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0643 | Low | 3.3 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and… |
CVE-2016-0642 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availabilit… |
CVE-2016-0641 | Medium | 5.1 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0640 | Medium | 6.1 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and… |
CVE-2016-0639 | Critical | 9.8 | 2016-04-21 | Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availabil… |
CVE-2016-0638 | Critical | 9.8 | 2016-04-21 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to aff… |
CVE-2016-0623 | Medium | 4.7 | 2016-04-21 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect integrity via vectors related to the Automated Installer sub-component. |
CVE-2016-0479 | Medium | 6.1 | 2016-04-21 | Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 a… |
CVE-2016-0469 | Medium | 5.5 | 2016-04-21 | Unspecified vulnerability in the Oracle Retail MICROS C2 component in Oracle Retail Applications 9.89.0.0 allows local users to affect confidentiality via vect… |
CVE-2016-0468 | Medium | 5.4 | 2016-04-21 | Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 a… |
CVE-2016-0408 | Medium | 5.4 | 2016-04-21 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 through 8.55 allows remote authenticated users… |
CVE-2016-0407 | Medium | 6.5 | 2016-04-21 | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect conf… |
CVE-2016-2202 | Medium | 5.5 | 2016-04-20 | The Inventory Solution component in the Management Agent in the client in Symantec Altiris IT Management Suite (ITMS) through 7.6 HF7 allows local users to byp… |
CVE-2016-2003 | Critical | 9.8 | 2016-04-20 | HPE P9000 Command View Advanced Edition Software (CVAE) 7.x and 8.x before 8.4.0-00 and XP7 CVAE 7.x and 8.x before 8.4.0-00 allow remote attackers to execute… |
CVE-2016-2002 | Critical | 9.8 | 2016-04-20 | The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allow… |
CVE-2016-1384 | High | 7.5 | 2016-04-20 | The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID… |
CVE-2016-0891 | High | 8.8 | 2016-04-20 | Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authenticati… |
CVE-2016-3628 | High | 8.8 | 2016-04-20 | Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote authenticated user… |
CVE-2016-2390 | Medium | 5.9 | 2016-04-19 | The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with… |
CVE-2016-0741 | High | 7.5 | 2016-04-19 | slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infi… |
CVE-2016-4040 | High | 7.2 | 2016-04-19 | SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parame… |
CVE-2016-3960 | High | 8.8 | 2016-04-19 | Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by s… |
CVE-2016-3688 | Medium | 6.5 | 2016-04-19 | SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/U… |
CVE-2016-3186 | Medium | 6.2 | 2016-04-19 | Buffer overflow in the readextension function in gif2tiff.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (application crash) via a cra… |
CVE-2016-3972 | Low | 2.7 | 2016-04-18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (… |
CVE-2016-3971 | Medium | 4.8 | 2016-04-18 | Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the que… |
CVE-2016-3943 | High | 7.8 | 2016-04-18 | Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent… |
CVE-2016-3941 | Medium | 5.5 | 2016-04-18 | Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cause a denial of serv… |
CVE-2016-4036 | Medium | 5.5 | 2016-04-18 | The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which allows local users to… |
CVE-2016-3950 | Medium | 6.5 | 2016-04-18 | Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via crafted packets. |
CVE-2016-3071 | High | 7.5 | 2016-04-18 | Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform. |
CVE-2016-1659 | Critical | 9.8 | 2016-04-18 | Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have other impact via unknow… |
CVE-2016-1658 | Medium | 4.3 | 2016-04-18 | The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which allows remote attacker… |
CVE-2016-1657 | Medium | 4.3 | 2016-04-18 | The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 50.0.2661.75 mishandles fo… |
CVE-2016-1656 | High | 7.5 | 2016-04-18 | The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified ve… |
CVE-2016-1655 | High | 8.8 | 2016-04-18 | Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a d… |
CVE-2016-1654 | Medium | 6.5 | 2016-04-18 | The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to cause a denial of… |
CVE-2016-1653 | High | 8.8 | 2016-04-18 | The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denia… |
CVE-2016-1652 | Medium | 6.1 | 2016-04-18 | Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the Extensions subsystem in… |
CVE-2016-1651 | High | 8.1 | 2016-04-18 | fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb f… |
CVE-2016-2427 | Medium | 5.5 | 2016-04-18 | The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for… |
CVE-2016-2426 | Medium | 5.5 | 2016-04-18 | server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 do… |
CVE-2016-2425 | Medium | 5.5 | 2016-04-18 | mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///… |
CVE-2016-2424 | Medium | 5.5 | 2016-04-18 | server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 misma… |
CVE-2016-2423 | Medium | 6.1 | 2016-04-18 | server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly… |
CVE-2016-2422 | High | 7.8 | 2016-04-18 | Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrel… |
CVE-2016-2421 | Medium | 6.1 | 2016-04-18 | Setup Wizard in Android 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows physically proximate attackers to bypass the Factory Reset Protection protection me… |
CVE-2016-2420 | High | 7.8 | 2016-04-18 | rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to g… |
CVE-2016-2419 | Critical | 9.8 | 2016-04-18 | media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obt… |
CVE-2016-2418 | Critical | 9.8 | 2016-04-18 | media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain… |
CVE-2016-2417 | Critical | 9.8 | 2016-04-18 | media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a par… |
CVE-2016-2416 | Critical | 9.8 | 2016-04-18 | libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check f… |
CVE-2016-2415 | Medium | 5.5 | 2016-04-18 | exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2… |
CVE-2016-2414 | Medium | 6.2 | 2016-04-18 | The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data… |
CVE-2016-2413 | High | 7.8 | 2016-04-18 | media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which… |
CVE-2016-2412 | High | 7.8 | 2016-04-18 | include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, m… |
CVE-2016-2411 | Medium | 6.5 | 2016-04-18 | A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages root ac… |
CVE-2016-2410 | High | 7.4 | 2016-04-18 | A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a ser… |
CVE-2016-2409 | High | 8.1 | 2016-04-18 | A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages con… |
CVE-2016-1503 | Critical | 9.8 | 2016-04-18 | dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages opt… |
CVE-2016-0850 | High | 8.8 | 2016-04-18 | The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote a… |
CVE-2016-0849 | High | 8.4 | 2016-04-18 | Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow att… |
CVE-2016-0848 | High | 8.4 | 2016-04-18 | Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to bypass pr… |
CVE-2016-0847 | High | 8.4 | 2016-04-18 | The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number o… |
CVE-2016-0846 | High | 8.4 | 2016-04-18 | libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not… |
CVE-2016-0844 | High | 8.4 | 2016-04-18 | The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via… |
CVE-2016-0843 | High | 8.4 | 2016-04-18 | The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows atta… |
CVE-2016-0842 | High | 8.4 | 2016-04-18 | The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers… |
CVE-2016-0841 | Critical | 9.8 | 2016-04-18 | media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishand… |
CVE-2016-0840 | High | 8.4 | 2016-04-18 | Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitr… |
CVE-2016-0839 | Critical | 9.8 | 2016-04-18 | post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitra… |
CVE-2016-0838 | Critical | 9.8 | 2016-04-18 | Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of s… |
CVE-2016-0837 | Critical | 9.8 | 2016-04-18 | MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remot… |
CVE-2016-0836 | High | 7.8 | 2016-04-18 | Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-0835 | Critical | 9.8 | 2016-04-18 | decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memor… |
CVE-2016-0834 | High | 8.4 | 2016-04-18 | An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memo… |