2016 CVEs (page 85)
Page 85 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2216 | High | 7.5 | 2016-04-07 | The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows rem… |
CVE-2016-2086 | High | 7.5 | 2016-04-07 | Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks v… |
CVE-2016-0729 | Critical | 9.8 | 2016-04-07 | Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3… |
CVE-2016-2510 | High | 8.1 | 2016-04-07 | BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbi… |
CVE-2016-3975 | Medium | 6.1 | 2016-04-07 | Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arbitrary web script or HTML via the naviga… |
CVE-2016-3974 | Critical | 9.1 | 2016-04-07 | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of servi… |
CVE-2016-3973 | Medium | 5.3 | 2016-04-07 | The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to obtain sensitive… |
CVE-2016-2858 | Medium | 6.5 | 2016-04-07 | QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via… |
CVE-2016-1714 | High | 8.1 | 2016-04-07 | The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support… |
CVE-2016-0734 | Medium | 6.1 | 2016-04-07 | The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attack… |
CVE-2016-3948 | High | 7.5 | 2016-04-07 | Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP… |
CVE-2016-3947 | High | 8.2 | 2016-04-07 | Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers… |
CVE-2016-1563 | Medium | 6.8 | 2016-04-07 | NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and o… |
CVE-2016-1019 | Critical | 9.8 | 2016-04-07 | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspe… |
CVE-2016-0888 | High | 8.8 | 2016-04-07 | EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors. |
CVE-2016-2292 | Medium | 6.5 | 2016-04-06 | Stack-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 al… |
CVE-2016-2291 | Medium | 6.5 | 2016-04-06 | Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allow remote attackers to execute… |
CVE-2016-2290 | High | 8.8 | 2016-04-06 | Heap-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 all… |
CVE-2016-2277 | Medium | 6.3 | 2016-04-06 | IAB.exe in Rockwell Automation Integrated Architecture Builder (IAB) before 9.6.0.8 and 9.7.x before 9.7.0.2 allows remote attackers to execute arbitrary code… |
CVE-2016-2272 | High | 7.5 | 2016-04-06 | Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie. |
CVE-2016-1346 | Medium | 5.9 | 2016-04-06 | The kernel in Cisco TelePresence Server 3.0 through 4.2(4.18) on Mobility Services Engine (MSE) 8710 devices allows remote attackers to cause a denial of servi… |
CVE-2016-1313 | Critical | 9.8 | 2016-04-06 | Cisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance, and Whiptail Racerunner improperly store a default SSH priva… |
CVE-2016-1291 | Critical | 9.8 | 2016-04-06 | Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via… |
CVE-2016-1290 | High | 8.1 | 2016-04-06 | The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to b… |
CVE-2016-1174 | High | 8.8 | 2016-04-06 | Cross-site request forgery (CSRF) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of admini… |
CVE-2016-1173 | Medium | 6.1 | 2016-04-06 | Cross-site scripting (XSS) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2016-1172 | High | 8.8 | 2016-04-06 | Cross-site request forgery (CSRF) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of adminis… |
CVE-2016-1171 | Medium | 6.1 | 2016-04-06 | Cross-site scripting (XSS) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to inject arbitrary web script or HTML via uns… |
CVE-2016-1170 | High | 8.8 | 2016-04-06 | Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of admini… |
CVE-2016-1169 | Medium | 6.1 | 2016-04-06 | Cross-site scripting (XSS) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to inject arbitrary web script or HTML via un… |
CVE-2016-0871 | High | 7.5 | 2016-04-06 | Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct re… |
CVE-2016-3969 | Medium | 6.1 | 2016-04-06 | Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:RE… |
CVE-2016-3968 | Medium | 6.1 | 2016-04-06 | Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with f… |
CVE-2016-3118 | Medium | 6.5 | 2016-04-06 | CRLF injection vulnerability in CA API Gateway (formerly Layer7 API Gateway) 7.1 before 7.1.04, 8.0 through 8.3 before 8.3.01, and 8.4 before 8.4.01 allows rem… |
CVE-2016-3125 | High | 7.5 | 2016-04-05 | The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than in… |
CVE-2016-2000 | Critical | 9.8 | 2016-04-05 | HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted seriali… |
CVE-2016-1177 | Medium | 6.1 | 2016-04-05 | The management screen in Falcon WisePoint 4.3.1 and earlier and WisePoint Authenticator 4.1.19.22 and earlier allows remote attackers to conduct clickjacking a… |
CVE-2016-1789 | Medium | 5.5 | 2016-04-05 | Apple iBooks Author before 2.4.1 allows remote attackers to read arbitrary files via an iBooks Author file containing an XML external entity declaration in con… |
CVE-2016-1176 | Medium | 6.3 | 2016-04-05 | Buffer overflow in the ActiveX control in Sharp EVA Animeter allows remote attackers to execute arbitrary code via a crafted web page. |
CVE-2016-1175 | Medium | 4.3 | 2016-04-05 | Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authenticati… |
CVE-2016-0289 | Medium | 4.3 | 2016-04-05 | shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to b… |
CVE-2016-2343 | Critical | 9.8 | 2016-04-01 | Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient informat… |
CVE-2016-2289 | High | 7.5 | 2016-04-01 | Directory traversal vulnerability in ICONICS WebHMI 9 and earlier allows remote attackers to read configuration files, and consequently discover password hashe… |
CVE-2016-0793 | High | 7.5 | 2016-04-01 | Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows al… |
CVE-2016-1168 | High | 8.8 | 2016-04-01 | Cross-site request forgery (CSRF) vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authenticat… |
CVE-2016-1167 | High | 8.8 | 2016-04-01 | Cross-site request forgery (CSRF) vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users. |
CVE-2016-1345 | High | 7.5 | 2016-04-01 | Cisco FireSIGHT System Software 5.4.0 through 6.0.1 and ASA with FirePOWER Services 5.4.0 through 6.0.0.1 allow remote attackers to bypass malware protection v… |
CVE-2016-3142 | High | 8.2 | 2016-03-31 | The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive informa… |
CVE-2016-3141 | Critical | 9.8 | 2016-03-31 | Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service… |
CVE-2016-2288 | High | 7.8 | 2016-03-29 | Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file. |
CVE-2016-1760 | Medium | 6.2 | 2016-03-29 | The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's eve… |
CVE-2016-3679 | High | 8.8 | 2016-03-29 | Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of servic… |
CVE-2016-1650 | High | 8.8 | 2016-03-29 | The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 all… |
CVE-2016-1649 | High | 8.8 | 2016-03-29 | The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-typ… |
CVE-2016-1648 | High | 8.8 | 2016-03-29 | Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before… |
CVE-2016-1647 | High | 8.8 | 2016-03-29 | Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implem… |
CVE-2016-1646 | High | 8.8 | 2016-03-29 | The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data t… |
CVE-2016-2344 | High | 7.5 | 2016-03-28 | Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attackers to execute arbit… |
CVE-2016-1314 | Medium | 6.1 | 2016-03-28 | Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (CDM) 8.1(1) allows remote authenticated users to inject arbitrary web… |
CVE-2016-0226 | High | 7.8 | 2016-03-28 | The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap… |
CVE-2016-3119 | Medium | 5.3 | 2016-03-26 | The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 an… |
CVE-2016-1351 | High | 7.5 | 2016-03-26 | The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of serv… |
CVE-2016-1350 | High | 7.5 | 2016-03-26 | Cisco IOS 15.3 and 15.4, Cisco IOS XE 3.8 through 3.11, and Cisco Unified Communications Manager allow remote attackers to cause a denial of service (device re… |
CVE-2016-1349 | High | 7.5 | 2016-03-26 | The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (devi… |
CVE-2016-1348 | High | 7.5 | 2016-03-26 | Cisco IOS 15.0 through 15.5 and IOS XE 3.3 through 3.16 allow remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 Relay message… |
CVE-2016-1344 | Medium | 5.9 | 2016-03-26 | The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fr… |
CVE-2016-1160 | Medium | 6.1 | 2016-03-26 | Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or H… |
CVE-2016-2340 | Medium | 5.4 | 2016-03-25 | The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or… |
CVE-2016-1366 | Medium | 6.5 | 2016-03-24 | The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows rem… |
CVE-2016-1347 | High | 7.5 | 2016-03-24 | The Wide Area Application Services (WAAS) Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service (device re… |
CVE-2016-0636 | High | 8.1 | 2016-03-24 | Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vec… |
CVE-2016-1788 | Medium | 5.9 | 2016-03-24 | Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechanism, which allows re… |
CVE-2016-1787 | Medium | 5.3 | 2016-03-24 | Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors. |
CVE-2016-1786 | Medium | 5.4 | 2016-03-24 | The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, whi… |
CVE-2016-1785 | Medium | 6.5 | 2016-03-24 | The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allow… |
CVE-2016-1784 | Medium | 6.5 | 2016-03-24 | The History implementation in WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to cause a denial of service (reso… |
CVE-2016-1783 | High | 8.8 | 2016-03-24 | WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory c… |
CVE-2016-1782 | Medium | 6.5 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypa… |
CVE-2016-1781 | Medium | 4.3 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified ve… |
CVE-2016-1780 | Medium | 4.3 | 2016-03-24 | WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive in… |
CVE-2016-1779 | Medium | 6.5 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted g… |
CVE-2016-1778 | High | 8.8 | 2016-03-24 | WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a c… |
CVE-2016-1777 | High | 7.5 | 2016-03-24 | Web Server in Apple OS X Server before 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms… |
CVE-2016-1776 | Medium | 5.3 | 2016-03-24 | Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitiv… |
CVE-2016-1775 | High | 7.8 | 2016-03-24 | TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause… |
CVE-2016-1774 | Medium | 5.3 | 2016-03-24 | The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier… |
CVE-2016-1773 | Low | 3.3 | 2016-03-24 | The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitra… |
CVE-2016-1772 | Medium | 4.3 | 2016-03-24 | The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors. |
CVE-2016-1771 | Medium | 6.5 | 2016-03-24 | The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site. |
CVE-2016-1770 | Medium | 6.5 | 2016-03-24 | The Reminders component in Apple OS X before 10.11.4 allows attackers to bypass an intended user-confirmation requirement and trigger a dialing action via a te… |
CVE-2016-1769 | High | 7.8 | 2016-03-24 | QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photosh… |
CVE-2016-1768 | High | 7.8 | 2016-03-24 | QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPi… |
CVE-2016-1767 | High | 7.8 | 2016-03-24 | QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPi… |
CVE-2016-1766 | High | 7.5 | 2016-03-24 | The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via u… |
CVE-2016-1765 | High | 7.8 | 2016-03-24 | otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified ve… |
CVE-2016-1764 | Medium | 4.3 | 2016-03-24 | The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascr… |
CVE-2016-1763 | Low | 3.5 | 2016-03-24 | Messages in Apple iOS before 9.3 does not ensure that an auto-fill action applies to the intended message thread, which allows remote authenticated users to ob… |
CVE-2016-1762 | High | 8.1 | 2016-03-24 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document. |
CVE-2016-1761 | Critical | 9.8 | 2016-03-24 | libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (me… |
CVE-2016-1759 | High | 7.8 | 2016-03-24 | The kernel in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |