2016 CVEs (page 90)
Page 90 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-0948 | High | 8.8 | 2016-02-10 | Cross-site request forgery (CSRF) vulnerability in Adobe Connect before 9.5.2 allows remote attackers to hijack the authentication of unspecified victims via u… |
CVE-2016-0084 | High | 8.8 | 2016-02-10 | Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge M… |
CVE-2016-0080 | Medium | 4.3 | 2016-02-10 | Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a cra… |
CVE-2016-0077 | Medium | 4.3 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a crafted URL, aka "M… |
CVE-2016-0072 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-0071 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "I… |
CVE-2016-0067 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-0064 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "… |
CVE-2016-0063 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web s… |
CVE-2016-0062 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft… |
CVE-2016-0061 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v… |
CVE-2016-0060 | High | 8.8 | 2016-02-10 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) v… |
CVE-2016-0059 | Medium | 4.3 | 2016-02-10 | The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a craf… |
CVE-2016-0058 | High | 7.8 | 2016-02-10 | Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code… |
CVE-2016-0056 | High | 7.8 | 2016-02-10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow remote attackers t… |
CVE-2016-0055 | High | 7.8 | 2016-02-10 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerabilit… |
CVE-2016-0054 | High | 7.8 | 2016-02-10 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3… |
CVE-2016-0053 | High | 7.8 | 2016-02-10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automatio… |
CVE-2016-0052 | High | 7.8 | 2016-02-10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility… |
CVE-2016-0051 | High | 7.8 | 2016-02-10 | The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8… |
CVE-2016-0050 | Medium | 5.3 | 2016-02-10 | Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attacke… |
CVE-2016-0049 | Medium | 6.2 | 2016-02-10 | Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold a… |
CVE-2016-0048 | High | 7.8 | 2016-02-10 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Window… |
CVE-2016-0047 | High | 7.5 | 2016-02-10 | WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via… |
CVE-2016-0046 | High | 7.8 | 2016-02-10 | Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader… |
CVE-2016-0044 | High | 7.5 | 2016-02-10 | Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service… |
CVE-2016-0042 | High | 7.8 | 2016-02-10 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Go… |
CVE-2016-0041 | High | 7.8 | 2016-02-10 | Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold a… |
CVE-2016-0040 | High | 7.8 | 2016-02-10 | The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted applicatio… |
CVE-2016-0039 | Medium | 6.1 | 2016-02-10 | Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web scrip… |
CVE-2016-0038 | High | 7.8 | 2016-02-10 | Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10… |
CVE-2016-0037 | High | 7.5 | 2016-02-10 | The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to… |
CVE-2016-0036 | High | 8.1 | 2016-02-10 | The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote authent… |
CVE-2016-0033 | High | 7.5 | 2016-02-10 | Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to… |
CVE-2016-0022 | High | 7.8 | 2016-02-10 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility… |
CVE-2016-1319 | Medium | 5.3 | 2016-02-09 | Cisco Unified Communications Manager (aka CallManager) 9.1(2.10000.28), 10.5(2.10000.5), 10.5(2.12901.1), and 11.0(1.10000.10); Unified Communications Manager… |
CVE-2016-1318 | Medium | 6.1 | 2016-02-09 | Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to injec… |
CVE-2016-1317 | Medium | 4.3 | 2016-02-09 | Cisco Unified Communications Manager 11.5(0.98000.480) allows remote authenticated users to obtain sensitive database table-name and entity-name information vi… |
CVE-2016-1316 | Medium | 5.3 | 2016-02-09 | Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7, as used in conjunction with Jabber Guest, allows remote attackers to obtain sensitive ca… |
CVE-2016-2268 | Medium | 6.8 | 2016-02-08 | Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive info… |
CVE-2016-2214 | Medium | 6.1 | 2016-02-08 | Cross-site scripting (XSS) vulnerability in an unspecified portal authentication page in Huawei Agile Controller-Campus with software before V100R001C00SPC319… |
CVE-2016-2091 | Low | 3.3 | 2016-02-08 | The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted… |
CVE-2016-2089 | Medium | 6.5 | 2016-02-08 | The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a cra… |
CVE-2016-2048 | Medium | 5.5 | 2016-02-08 | Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdm… |
CVE-2016-2230 | Critical | 9.8 | 2016-02-08 | OpenELEC and RasPlex devices have a hardcoded password for the root account, which makes it easier for remote attackers to obtain access via an SSH session. |
CVE-2016-2201 | Medium | 5.3 | 2016-02-08 | Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to bypass a replay protection mechanism via packets on TCP port 102. |
CVE-2016-2200 | High | 7.5 | 2016-02-08 | Siemens SIMATIC S7-1500 CPU devices before 1.8.3 allow remote attackers to cause a denial of service (STOP mode transition) via crafted packets on TCP port 102. |
CVE-2016-0603 | | 2016-02-08 | Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect co… | |
CVE-2016-0728 | High | 7.8 | 2016-02-08 | The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which… |
CVE-2016-0723 | Medium | 6.8 | 2016-02-08 | Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kern… |
CVE-2016-1309 | Medium | 6.1 | 2016-02-07 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meetings Server 2.5.1.5 allow remote attackers to inject arbitrary web script or HTML via un… |
CVE-2016-1308 | Medium | 6.5 | 2016-02-07 | SQL injection vulnerability in Cisco Unified Communications Manager 10.5(2.13900.9) allows remote authenticated users to execute arbitrary SQL commands via a c… |
CVE-2016-1307 | Medium | 5.4 | 2016-02-07 | The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for… |
CVE-2016-1305 | Medium | 6.1 | 2016-02-07 | Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to injec… |
CVE-2016-1302 | High | 8.8 | 2016-02-07 | Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.0(3h) and 1.1 before 1.1(1j) and Nexus 9000 ACI Mode switches with sof… |
CVE-2016-1301 | High | 8.8 | 2016-02-07 | The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1(112) and Cisco Prime Security Manager (PRSM) software before 9.3.1.1(112… |
CVE-2016-0813 | Medium | 6.1 | 2016-02-07 | packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-0… |
CVE-2016-0812 | Medium | 6.1 | 2016-02-07 | The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1… |
CVE-2016-0811 | High | 7.5 | 2016-02-07 | Integer overflow in the BnCrypto::onTransact function in media/libmedia/ICrypto.cpp in libmediaplayerservice in Android 6.x before 2016-02-01 allows attackers… |
CVE-2016-0810 | High | 7.8 | 2016-02-07 | media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, wh… |
CVE-2016-0809 | High | 8.8 | 2016-02-07 | Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain pr… |
CVE-2016-0808 | Medium | 6.2 | 2016-02-07 | Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 al… |
CVE-2016-0807 | High | 8.4 | 2016-02-07 | The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mis… |
CVE-2016-0806 | High | 8.4 | 2016-02-07 | The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via… |
CVE-2016-0805 | High | 8.4 | 2016-02-07 | The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to g… |
CVE-2016-0804 | Critical | 9.8 | 2016-02-07 | The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5… |
CVE-2016-0803 | Critical | 9.8 | 2016-02-07 | libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code… |
CVE-2016-0802 | High | 8.8 | 2016-02-07 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbi… |
CVE-2016-0801 | Critical | 9.8 | 2016-02-07 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbi… |
CVE-2016-1311 | Medium | 6.1 | 2016-02-06 | Cross-site scripting (XSS) vulnerability in the management interface in Cisco Jabber Guest Server 10.6(8) allows remote attackers to inject arbitrary web scrip… |
CVE-2016-1310 | Medium | 6.1 | 2016-02-06 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 11.5(0.199) allows remote attackers to inject arbitrary web script or HTML via a crafted URL… |
CVE-2016-1306 | Medium | 6.1 | 2016-02-06 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Fog Director 1.0(0) allow remote attackers to inject arbitrary web script or HTML via a crafted pa… |
CVE-2016-0862 | Medium | 6.5 | 2016-02-05 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext… |
CVE-2016-0861 | High | 8.8 | 2016-02-05 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands… |
CVE-2016-1284 | Medium | 5.9 | 2016-02-04 | rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of ser… |
CVE-2016-1906 | Critical | 9.8 | 2016-02-03 | Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed. |
CVE-2016-1905 | High | 7.7 | 2016-02-03 | The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted pa… |
CVE-2016-1505 | Critical | 10.0 | 2016-02-03 | The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrate… |
CVE-2016-2213 | Medium | 6.5 | 2016-02-03 | The jpeg2000_decode_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.6 allows remote attackers to cause a denial of service (out-of-bounds array… |
CVE-2016-2199 | High | 8.8 | 2016-02-01 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations and Remediation management page in Enterprise Manager in McAfee Vulnerability M… |
CVE-2016-2049 | High | 8.8 | 2016-02-01 | examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the… |
CVE-2016-1730 | Medium | 5.4 | 2016-02-01 | WebSheet in Apple iOS before 9.2.1 allows remote attackers to read or write to cookies by operating a crafted captive portal. |
CVE-2016-1729 | High | 7.3 | 2016-02-01 | Untrusted search path vulnerability in OSA Scripts in Apple OS X before 10.11.3 allows attackers to load arbitrary script libraries via a quarantined applicati… |
CVE-2016-1728 | Medium | 4.3 | 2016-02-01 | The Cascading Style Sheets (CSS) implementation in Apple iOS before 9.2.1 and Safari before 9.0.3 mishandles the "a:visited button" selector during height proc… |
CVE-2016-1727 | High | 8.8 | 2016-02-01 | WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of s… |
CVE-2016-1726 | High | 8.8 | 2016-02-01 | WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru… |
CVE-2016-1725 | High | 8.8 | 2016-02-01 | WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru… |
CVE-2016-1724 | High | 8.8 | 2016-02-01 | WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of s… |
CVE-2016-1723 | High | 8.8 | 2016-02-01 | WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru… |
CVE-2016-1722 | High | 7.8 | 2016-02-01 | syslog in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corrupt… |
CVE-2016-1721 | High | 7.8 | 2016-02-01 | The kernel in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory cor… |
CVE-2016-1720 | High | 7.8 | 2016-02-01 | IOKit in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (memory corrupti… |
CVE-2016-1719 | High | 7.8 | 2016-02-01 | The IOHIDFamily API in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of service (m… |
CVE-2016-1718 | High | 7.3 | 2016-02-01 | The IOAcceleratorFamily2 interface in IOAcceleratorFamily in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memo… |
CVE-2016-1717 | High | 7.8 | 2016-02-01 | The Disk Images component in Apple iOS before 9.2.1, OS X before 10.11.3, and tvOS before 9.1.1 allows local users to gain privileges or cause a denial of serv… |
CVE-2016-1716 | High | 7.8 | 2016-02-01 | AppleGraphicsPowerManagement in Apple OS X before 10.11.3 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecifie… |
CVE-2016-1948 | Medium | 5.3 | 2016-01-31 | Mozilla Firefox before 44.0 on Android does not ensure that HTTPS is used for a lightweight-theme installation, which allows man-in-the-middle attackers to rep… |
CVE-2016-1947 | Medium | 4.7 | 2016-01-31 | Mozilla Firefox 43.x mishandles attempts to connect to the Application Reputation service, which makes it easier for remote attackers to trigger an unintended… |
CVE-2016-1946 | Critical | 9.8 | 2016-01-31 | The MoofParser::Metadata function in binding/MoofParser.cpp in libstagefright in Mozilla Firefox before 44.0 does not limit the size of read operations, which… |
CVE-2016-1945 | High | 8.8 | 2016-01-31 | The nsZipArchive function in Mozilla Firefox before 44.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by… |