2016 CVEs (page 86)
Page 86 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-1758 | Low | 3.3 | 2016-03-24 | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-… |
CVE-2016-1757 | High | 7.0 | 2016-03-24 | Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted a… |
CVE-2016-1756 | High | 7.8 | 2016-03-24 | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NUL… |
CVE-2016-1755 | High | 7.8 | 2016-03-24 | The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged con… |
CVE-2016-1754 | High | 7.8 | 2016-03-24 | The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged con… |
CVE-2016-1753 | High | 7.8 | 2016-03-24 | Multiple integer overflows in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allow attackers to execute arbit… |
CVE-2016-1752 | Medium | 5.5 | 2016-03-24 | The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to cause a denial of service via a crafted ap… |
CVE-2016-1751 | High | 7.8 | 2016-03-24 | The kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly restrict the execute permission, which allows attackers to bypass… |
CVE-2016-1750 | High | 7.8 | 2016-03-24 | Use-after-free vulnerability in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute ar… |
CVE-2016-1749 | High | 7.8 | 2016-03-24 | IOUSBFamily in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) vi… |
CVE-2016-1748 | Low | 3.3 | 2016-03-24 | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout inf… |
CVE-2016-1747 | High | 7.8 | 2016-03-24 | IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |
CVE-2016-1746 | High | 7.8 | 2016-03-24 | IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |
CVE-2016-1745 | Medium | 5.5 | 2016-03-24 | IOFireWireFamily in Apple OS X before 10.11.4 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors. |
CVE-2016-1744 | High | 7.8 | 2016-03-24 | The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a d… |
CVE-2016-1743 | High | 7.8 | 2016-03-24 | The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a d… |
CVE-2016-1741 | Critical | 9.8 | 2016-03-24 | The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a… |
CVE-2016-1740 | High | 7.8 | 2016-03-24 | FontParser in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a d… |
CVE-2016-1738 | High | 7.8 | 2016-03-24 | dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app. |
CVE-2016-1737 | Medium | 6.3 | 2016-03-24 | Carbon in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dfont fil… |
CVE-2016-1736 | High | 7.8 | 2016-03-24 | Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |
CVE-2016-1735 | High | 7.8 | 2016-03-24 | Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |
CVE-2016-1734 | Medium | 6.8 | 2016-03-24 | AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or c… |
CVE-2016-1733 | High | 7.8 | 2016-03-24 | AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via… |
CVE-2016-1732 | Medium | 5.5 | 2016-03-24 | AppleRAID in Apple OS X before 10.11.4 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read… |
CVE-2016-1599 | Medium | 6.1 | 2016-03-24 | Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary w… |
CVE-2016-3116 | Medium | 6.4 | 2016-03-22 | CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 for… |
CVE-2016-3115 | Medium | 6.4 | 2016-03-22 | Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrict… |
CVE-2016-1998 | Critical | 9.8 | 2016-03-22 | HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object… |
CVE-2016-1997 | Critical | 9.8 | 2016-03-22 | HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a cra… |
CVE-2016-2245 | Critical | 9.8 | 2016-03-19 | HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors. |
CVE-2016-0283 | Medium | 6.1 | 2016-03-19 | Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 be… |
CVE-2016-2287 | Medium | 6.1 | 2016-03-19 | Cross-site scripting (XSS) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2016-3155 | Low | 3.4 | 2016-03-18 | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecifie… |
CVE-2016-2281 | High | 7.2 | 2016-03-18 | Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
CVE-2016-1996 | High | 7.7 | 2016-03-18 | HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors. |
CVE-2016-1995 | Critical | 9.8 | 2016-03-18 | HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2016-1994 | Medium | 6.5 | 2016-03-18 | HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors. |
CVE-2016-1993 | High | 8.1 | 2016-03-18 | HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors. |
CVE-2016-3191 | Critical | 9.8 | 2016-03-17 | The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) sub… |
CVE-2016-2345 | Critical | 9.8 | 2016-03-17 | Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code… |
CVE-2016-2342 | High | 8.1 | 2016-03-17 | The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used… |
CVE-2016-1992 | Medium | 6.5 | 2016-03-17 | HPE ArcSight ESM before 6.8c, and ArcSight ESM Express before 6.9.1, allows remote authenticated users to obtain sensitive information via unspecified vectors. |
CVE-2016-2846 | Medium | 6.5 | 2016-03-16 | Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program block" protection mechanism via unspecified vectors. |
CVE-2016-2075 | Medium | 5.4 | 2016-03-16 | Cross-site scripting (XSS) vulnerability in VMware vRealize Business Advanced and Enterprise 8.x before 8.2.5 on Linux allows remote authenticated users to inj… |
CVE-2016-1991 | High | 8.0 | 2016-03-16 | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows remote authenticated use… |
CVE-2016-1990 | High | 7.8 | 2016-03-16 | HPE ArcSight ESM 5.x before 5.6, 6.0, 6.5.x before 6.5C SP1 Patch 2, and 6.8c before P1, and ArcSight ESM Express before 6.9.1, allows local users to gain priv… |
CVE-2016-1989 | Critical | 9.8 | 2016-03-15 | HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unsp… |
CVE-2016-1988 | Critical | 9.8 | 2016-03-15 | HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unsp… |
CVE-2016-2856 | High | 8.4 | 2016-03-14 | pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8… |
CVE-2016-1731 | Medium | 5.9 | 2016-03-14 | Apple Software Update before 2.2 on Windows does not use HTTPS, which makes it easier for man-in-the-middle attackers to spoof updates by modifying the client-… |
CVE-2016-0262 | Medium | 5.4 | 2016-03-14 | Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 a… |
CVE-2016-0222 | Medium | 4.3 | 2016-03-14 | IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-ord… |
CVE-2016-0208 | Low | 3.7 | 2016-03-14 | IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing… |
CVE-2016-1645 | High | 8.8 | 2016-03-13 | Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allo… |
CVE-2016-1644 | High | 8.8 | 2016-03-13 | WebKit/Source/core/layout/LayoutObject.cpp in Blink, as used in Google Chrome before 49.0.2623.87, does not properly restrict relayout scheduling, which allows… |
CVE-2016-1643 | High | 8.8 | 2016-03-13 | The ImageInputType::ensurePrimaryContent function in WebKit/Source/core/html/forms/ImageInputType.cpp in Blink, as used in Google Chrome before 49.0.2623.87, d… |
CVE-2016-0771 | Medium | 5.9 | 2016-03-13 | The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remo… |
CVE-2016-2802 | High | 8.8 | 2016-03-13 | The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7… |
CVE-2016-2801 | High | 8.8 | 2016-03-13 | The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x be… |
CVE-2016-2800 | High | 8.8 | 2016-03-13 | The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows r… |
CVE-2016-2799 | High | 8.8 | 2016-03-13 | Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x bef… |
CVE-2016-2798 | High | 8.8 | 2016-03-13 | The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows… |
CVE-2016-2797 | High | 8.8 | 2016-03-13 | The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allo… |
CVE-2016-2796 | High | 8.8 | 2016-03-13 | Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ES… |
CVE-2016-2795 | High | 8.8 | 2016-03-13 | The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not in… |
CVE-2016-2794 | High | 8.8 | 2016-03-13 | The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38… |
CVE-2016-2793 | High | 8.8 | 2016-03-13 | CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial o… |
CVE-2016-2792 | High | 8.8 | 2016-03-13 | The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows r… |
CVE-2016-2791 | High | 8.8 | 2016-03-13 | The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote at… |
CVE-2016-2790 | High | 8.8 | 2016-03-13 | The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not ini… |
CVE-2016-1979 | High | 8.8 | 2016-03-13 | Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozi… |
CVE-2016-1978 | High | 7.3 | 2016-03-13 | Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefo… |
CVE-2016-1977 | High | 8.8 | 2016-03-13 | The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, all… |
CVE-2016-1976 | Medium | 5.5 | 2016-03-13 | Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attack… |
CVE-2016-1975 | Medium | 6.3 | 2016-03-13 | Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote… |
CVE-2016-1974 | High | 8.8 | 2016-03-13 | The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds… |
CVE-2016-1973 | High | 8.8 | 2016-03-13 | Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allow remote attackers to execute arbitrary… |
CVE-2016-1972 | High | 8.8 | 2016-03-13 | Race condition in libvpx in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (use-after-free) or possibly have… |
CVE-2016-1971 | High | 8.8 | 2016-03-13 | The I420VideoFrame::CreateFrame function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows omits an unspecified status check, which might… |
CVE-2016-1970 | High | 8.8 | 2016-03-13 | Integer underflow in the srtp_unprotect function in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a… |
CVE-2016-1969 | High | 8.8 | 2016-03-13 | The setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.6.1, allows remote attackers to cause a… |
CVE-2016-1968 | High | 8.8 | 2016-03-13 | Integer underflow in Brotli, as used in Mozilla Firefox before 45.0, allows remote attackers to execute arbitrary code or cause a denial of service (buffer ove… |
CVE-2016-1967 | Medium | 6.5 | 2016-03-13 | Mozilla Firefox before 45.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same O… |
CVE-2016-1966 | High | 8.8 | 2016-03-13 | The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote a… |
CVE-2016-1965 | Medium | 4.3 | 2016-03-13 | Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers t… |
CVE-2016-1964 | High | 8.8 | 2016-03-13 | Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execut… |
CVE-2016-1963 | High | 7.4 | 2016-03-13 | The FileReader class in Mozilla Firefox before 45.0 allows local users to gain privileges or cause a denial of service (memory corruption) by changing a file d… |
CVE-2016-1962 | Critical | 9.8 | 2016-03-13 | Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remot… |
CVE-2016-1961 | High | 8.8 | 2016-03-13 | Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before… |
CVE-2016-1960 | High | 8.8 | 2016-03-13 | Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote atta… |
CVE-2016-1959 | High | 8.8 | 2016-03-13 | The ServiceWorkerManager class in Mozilla Firefox before 45.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds rea… |
CVE-2016-1958 | Medium | 4.3 | 2016-03-13 | browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascri… |
CVE-2016-1957 | Medium | 4.3 | 2016-03-13 | Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory cons… |
CVE-2016-1956 | Medium | 6.5 | 2016-03-13 | Mozilla Firefox before 45.0 on Linux, when an Intel video driver is used, allows remote attackers to cause a denial of service (memory consumption or stack mem… |
CVE-2016-1955 | Medium | 4.3 | 2016-03-13 | Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP… |
CVE-2016-1954 | High | 8.8 | 2016-03-13 | The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of… |
CVE-2016-1953 | High | 8.8 | 2016-03-13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruptio… |
CVE-2016-1952 | High | 8.8 | 2016-03-13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a de… |
CVE-2016-1950 | High | 8.8 | 2016-03-13 | Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45… |