2016 CVEs (page 9)
Page 9 of 107 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9073 | High | 7.5 | 2018-06-11 | WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50. |
CVE-2016-9072 | High | 7.5 | 2018-06-11 | When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default. Note: This issue only af… |
CVE-2016-9071 | Medium | 5.3 | 2018-06-11 | Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser histo… |
CVE-2016-9070 | High | 8.0 | 2018-06-11 | A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violat… |
CVE-2016-9068 | High | 7.5 | 2018-06-11 | A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50. |
CVE-2016-9067 | Medium | 6.5 | 2018-06-11 | Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. |
CVE-2016-9066 | High | 7.5 | 2018-06-11 | A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability… |
CVE-2016-9065 | High | 7.5 | 2018-06-11 | The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar withou… |
CVE-2016-9064 | Medium | 5.9 | 2018-06-11 | Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in… |
CVE-2016-9063 | Critical | 9.8 | 2018-06-11 | An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. |
CVE-2016-9062 | Low | 3.3 | 2018-06-11 | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after… |
CVE-2016-9061 | High | 7.5 | 2018-06-11 | A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox… |
CVE-2016-5299 | High | 7.5 | 2018-06-11 | A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: Th… |
CVE-2016-5298 | Medium | 6.5 | 2018-06-11 | A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is load… |
CVE-2016-5297 | Critical | 9.8 | 2018-06-11 | An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderb… |
CVE-2016-5296 | High | 7.5 | 2018-06-11 | A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability a… |
CVE-2016-5295 | High | 7.8 | 2018-06-11 | This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater… |
CVE-2016-5294 | Medium | 5.5 | 2018-06-11 | The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires… |
CVE-2016-5293 | Medium | 5.5 | 2018-06-11 | When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This… |
CVE-2016-5292 | Medium | 6.5 | 2018-06-11 | During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50. |
CVE-2016-5291 | Medium | 5.5 | 2018-06-11 | A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 4… |
CVE-2016-5290 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough ef… |
CVE-2016-5289 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2016-5288 | Medium | 5.9 | 2018-06-11 | Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affec… |
CVE-2016-5287 | Critical | 9.8 | 2018-06-11 | A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This… |
CVE-2016-9490 | Medium | 6.1 | 2018-06-05 | ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is pro… |
CVE-2016-9488 | Critical | 9.8 | 2018-06-05 | ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able t… |
CVE-2016-1000352 | High | 7.4 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support fo… |
CVE-2016-1000346 | Low | 3.7 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be u… |
CVE-2016-1000345 | Medium | 5.9 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environme… |
CVE-2016-1000344 | High | 7.4 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support fo… |
CVE-2016-9042 | Medium | 5.9 | 2018-06-04 | An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network… |
CVE-2016-8390 | High | 7.8 | 2018-06-04 | An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can… |
CVE-2016-10697 | High | 8.1 | 2018-06-04 | react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP… |
CVE-2016-10696 | High | 8.1 | 2018-06-04 | windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP, which leaves it v… |
CVE-2016-10695 | High | 8.1 | 2018-06-04 | The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP, which leav… |
CVE-2016-10694 | High | 8.1 | 2018-06-04 | alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HT… |
CVE-2016-10693 | High | 8.1 | 2018-06-04 | pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10692 | High | 8.1 | 2018-06-04 | haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to… |
CVE-2016-10691 | High | 8.1 | 2018-06-04 | windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MI… |
CVE-2016-10690 | High | 8.1 | 2018-06-04 | openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP, which lea… |
CVE-2016-10689 | High | 8.1 | 2018-06-04 | The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10688 | High | 8.1 | 2018-06-04 | Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10687 | High | 8.1 | 2018-06-04 | windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leave… |
CVE-2016-10686 | High | 8.1 | 2018-06-04 | fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10685 | High | 8.1 | 2018-06-04 | pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10684 | High | 8.1 | 2018-06-04 | healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10683 | High | 8.1 | 2018-06-04 | arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the… |
CVE-2016-10678 | High | 8.1 | 2018-06-04 | serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause… |
CVE-2016-10677 | High | 8.1 | 2018-06-04 | google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads bi… |
CVE-2016-10676 | High | 8.1 | 2018-06-04 | rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10675 | High | 8.1 | 2018-06-04 | libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10673 | High | 8.1 | 2018-06-04 | ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITM attacks. This cou… |
CVE-2016-10672 | High | 8.1 | 2018-06-04 | cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10671 | High | 8.1 | 2018-06-04 | mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may b… |
CVE-2016-10670 | High | 8.1 | 2018-06-04 | windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM… |
CVE-2016-10669 | High | 8.1 | 2018-06-04 | soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out… |
CVE-2016-10668 | High | 8.1 | 2018-06-04 | libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10667 | High | 8.1 | 2018-06-04 | selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be pos… |
CVE-2016-10665 | High | 8.1 | 2018-06-04 | herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable… |
CVE-2016-10664 | High | 8.1 | 2018-06-04 | mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vulnerable to MITM at… |
CVE-2016-10663 | High | 8.1 | 2018-06-04 | wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks… |
CVE-2016-10662 | High | 8.1 | 2018-06-04 | tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10661 | High | 8.1 | 2018-06-04 | phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10660 | High | 8.1 | 2018-06-04 | fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10657 | High | 8.1 | 2018-06-04 | co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacks. It may be possi… |
CVE-2016-10656 | High | 8.1 | 2018-06-04 | qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP, which le… |
CVE-2016-10655 | High | 8.1 | 2018-06-04 | The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may… |
CVE-2016-10654 | High | 8.1 | 2018-06-04 | sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10653 | High | 8.1 | 2018-06-04 | xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP, which leaves it vulnerable to MITM att… |
CVE-2016-10652 | High | 8.1 | 2018-06-04 | prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation. prebuild-lwip downloads resources over HTTP, which leaves it v… |
CVE-2016-10651 | High | 8.1 | 2018-06-04 | webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP, which leaves it vulnerable to MITM attack… |
CVE-2016-10649 | High | 8.1 | 2018-06-04 | frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by sw… |
CVE-2016-10648 | High | 8.1 | 2018-06-04 | marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP, which lea… |
CVE-2016-10647 | High | 8.1 | 2018-06-04 | node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cau… |
CVE-2016-10646 | High | 8.1 | 2018-06-04 | resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP, which leaves it… |
CVE-2016-10645 | High | 8.1 | 2018-06-04 | grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-10644 | High | 8.1 | 2018-06-04 | slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP, which leaves it vulner… |
CVE-2016-10643 | High | 8.1 | 2018-06-04 | jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be p… |
CVE-2016-10642 | High | 8.1 | 2018-06-04 | cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to caus… |
CVE-2016-10641 | High | 8.1 | 2018-06-04 | node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10640 | High | 8.1 | 2018-06-04 | node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10639 | High | 8.1 | 2018-06-04 | redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible t… |
CVE-2016-10638 | High | 8.1 | 2018-06-04 | js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c… |
CVE-2016-10637 | High | 8.1 | 2018-06-04 | haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause re… |
CVE-2016-10636 | High | 8.1 | 2018-06-04 | grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be… |
CVE-2016-1000343 | High | 7.5 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key… |
CVE-2016-1000342 | High | 7.5 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject… |
CVE-2016-1000341 | Medium | 5.9 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for t… |
CVE-2016-1000340 | High | 7.5 | 2018-06-04 | In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes… |
CVE-2016-1000339 | Medium | 5.3 | 2018-06-04 | In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach use… |
CVE-2016-1000338 | High | 7.5 | 2018-06-01 | In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject ex… |
CVE-2016-10634 | High | 8.1 | 2018-06-01 | scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10633 | High | 8.1 | 2018-06-01 | dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It… |
CVE-2016-10632 | High | 8.1 | 2018-06-01 | apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to… |
CVE-2016-10631 | High | 8.1 | 2018-06-01 | jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP, which leaves it vulnerable to MITM a… |
CVE-2016-10630 | Medium | 5.9 | 2018-06-01 | install-g-test downloads resources over HTTP, which leaves it vulnerable to MITM attacks. |
CVE-2016-10629 | High | 8.1 | 2018-06-01 | nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be poss… |
CVE-2016-10628 | High | 8.1 | 2018-06-01 | selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves… |
CVE-2016-10626 | High | 8.1 | 2018-06-01 | mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possib… |