2016 CVEs (page 91)
Page 91 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-1944 | Critical | 9.8 | 2016-01-31 | The Buffer11::NativeBuffer11::map function in ANGLE, as used in Mozilla Firefox before 44.0, might allow remote attackers to cause a denial of service (memory… |
CVE-2016-1943 | Medium | 4.7 | 2016-01-31 | Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via the scrollTo method. |
CVE-2016-1942 | High | 7.4 | 2016-01-31 | Mozilla Firefox before 44.0 allows user-assisted remote attackers to spoof a trailing substring in the address bar by leveraging a user's paste of a (1) wyciwy… |
CVE-2016-1941 | Medium | 6.1 | 2016-01-31 | The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking att… |
CVE-2016-1940 | Medium | 5.3 | 2016-01-31 | Mozilla Firefox before 44.0 on Android allows remote attackers to spoof the address bar via a data: URL that is mishandled during (1) shortcut opening or (2) B… |
CVE-2016-1939 | Medium | 5.3 | 2016-01-31 | Mozilla Firefox before 44.0 stores cookies with names containing vertical tab characters, which allows remote attackers to obtain sensitive information by read… |
CVE-2016-1938 | Medium | 6.5 | 2016-01-31 | The s_mp_div function in lib/freebl/mpi/mpi.c in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, improperly divide… |
CVE-2016-1937 | Medium | 6.1 | 2016-01-31 | The protocol-handler dialog in Mozilla Firefox before 44.0 allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a singl… |
CVE-2016-1935 | High | 8.8 | 2016-01-31 | Buffer overflow in the BufferSubData function in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allows remote attackers to execute arbitrary code… |
CVE-2016-1933 | Medium | 6.5 | 2016-01-31 | Integer overflow in the image-deinterlacing functionality in Mozilla Firefox before 44.0 allows remote attackers to cause a denial of service (memory consumpti… |
CVE-2016-1931 | Critical | 10.0 | 2016-01-31 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory corruptio… |
CVE-2016-1930 | Critical | 9.8 | 2016-01-31 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 and Firefox ESR 38.x before 38.6 allow remote attackers to cause a de… |
CVE-2016-1985 | Critical | 10.0 | 2016-01-30 | HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache… |
CVE-2016-1145 | High | 7.5 | 2016-01-30 | Directory traversal vulnerability in WebManager in NEC EXPRESSCLUSTER X through 3.3 11.31 on Windows and through 3.3 3.3.1-1 on Linux and Solaris allows remote… |
CVE-2016-1144 | Medium | 5.4 | 2016-01-30 | Cross-site scripting (XSS) vulnerability in JOB-CUBE -JOB WEB SYSTEM before 1.2.2 and -JOB WEB SYSTEM High Income 1.0.6 and earlier allows remote authenticated… |
CVE-2016-1143 | Medium | 6.1 | 2016-01-30 | Cross-site scripting (XSS) vulnerability in main.rb in Vine MV before 2015-11-08 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
CVE-2016-1141 | Medium | 4.7 | 2016-01-30 | KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. |
CVE-2016-1140 | Medium | 6.1 | 2016-01-30 | KDDI HOME SPOT CUBE devices before 2 allow remote attackers to conduct clickjacking attacks via unspecified vectors. |
CVE-2016-1139 | High | 7.5 | 2016-01-30 | Cross-site request forgery (CSRF) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to hijack the authentication of unspecified vic… |
CVE-2016-1138 | Medium | 4.7 | 2016-01-30 | CRLF injection vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to inject arbitrary HTTP headers via unspecified vectors. |
CVE-2016-1137 | High | 7.4 | 2016-01-30 | Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attac… |
CVE-2016-1136 | Medium | 5.4 | 2016-01-30 | Cross-site scripting (XSS) vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote authenticated users to inject arbitrary web script or HTML via u… |
CVE-2016-0867 | High | 7.5 | 2016-01-30 | CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request. |
CVE-2016-1488 | Medium | 6.1 | 2016-01-30 | Cross-site scripting (XSS) vulnerability in the login form in the integrated web server on Siemens OZW OZW672 devices before 6.00 and OZW772 devices before 6.0… |
CVE-2016-1304 | Medium | 6.1 | 2016-01-30 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted va… |
CVE-2016-1303 | High | 7.5 | 2016-01-30 | The web GUI on Cisco Small Business 500 devices 1.2.0.92 allows remote attackers to cause a denial of service via a crafted HTTP request, aka Bug ID CSCul65330. |
CVE-2016-1493 | High | 7.5 | 2016-01-29 | Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code v… |
CVE-2016-0756 | Medium | 5.3 | 2016-01-29 | The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allow… |
CVE-2016-0755 | High | 7.3 | 2016-01-29 | The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote att… |
CVE-2016-0754 | Medium | 5.3 | 2016-01-29 | cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file n… |
CVE-2016-0738 | High | 7.5 | 2016-01-29 | OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote att… |
CVE-2016-0737 | High | 7.5 | 2016-01-29 | OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-ser… |
CVE-2016-1882 | High | 7.5 | 2016-01-29 | FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9 allow remote attackers to cause a denial of service (kernel crash) via vectors related to creating… |
CVE-2016-1879 | High | 7.5 | 2016-01-29 | The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, when the kernel is configured for IPv6… |
CVE-2016-0868 | Critical | 9.8 | 2016-01-28 | Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execut… |
CVE-2016-1300 | Medium | 6.1 | 2016-01-27 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a craft… |
CVE-2016-1299 | Medium | 5.3 | 2016-01-27 | The web-management GUI implementation on Cisco Small Business SG300 devices 1.4.1.x allows remote attackers to cause a denial of service (HTTPS outage) via cra… |
CVE-2016-2047 | Medium | 5.9 | 2016-01-27 | The ssl_verify_server_cert function in sql-common/client.c in MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle MySQL 5.5.48 and… |
CVE-2016-1983 | High | 7.5 | 2016-01-27 | The client_host function in parsers.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash) via an empty HTTP… |
CVE-2016-1982 | High | 7.5 | 2016-01-27 | The remove_chunked_transfer_coding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service (invalid read and crash)… |
CVE-2016-1924 | Medium | 6.5 | 2016-01-27 | The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted… |
CVE-2016-1923 | Medium | 6.5 | 2016-01-27 | Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds… |
CVE-2016-1896 | Critical | 9.8 | 2016-01-27 | Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before Y… |
CVE-2016-0209 | Medium | 6.1 | 2016-01-27 | Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF09 allows remote attackers to inject arbitrary web script or HTML via unspecifi… |
CVE-2016-1926 | Medium | 6.1 | 2016-01-26 | Cross-site scripting (XSS) vulnerability in the charts module in Greenbone Security Assistant (GSA) 6.x before 6.0.8 allows remote attackers to inject arbitrar… |
CVE-2016-1567 | High | 8.1 | 2016-01-26 | chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to… |
CVE-2016-1492 | Medium | 6.1 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.5.48_ww for Android, when configured to receive files, does not require a password, which makes it easier for remot… |
CVE-2016-1491 | High | 8.8 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows, when configured to receive files, has a hardcoded password of 12345678, which makes it easier for… |
CVE-2016-1490 | Medium | 4.1 | 2016-01-26 | The Wifi hotspot in Lenovo SHAREit before 3.2.0 for Windows allows remote attackers to obtain sensitive file names via a crafted file request to /list. |
CVE-2016-1489 | High | 8.0 | 2016-01-26 | Lenovo SHAREit before 3.2.0 for Windows and SHAREit before 3.5.48_ww for Android transfer files in cleartext, which allows remote attackers to (1) obtain sensi… |
CVE-2016-1233 | High | 7.8 | 2016-01-26 | An unspecified udev rule in the Debian fuse package in jessie before 2.9.3-15+deb8u2, in stretch before 2.9.5-1, and in sid before 2.9.5-1 sets world-writable… |
CVE-2016-0869 | Medium | 5.0 | 2016-01-26 | Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document. |
CVE-2016-1298 | Medium | 6.1 | 2016-01-26 | Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Contact Center Express 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to in… |
CVE-2016-2052 | High | 7.6 | 2016-01-25 | Multiple unspecified vulnerabilities in HarfBuzz before 1.0.6, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service or po… |
CVE-2016-2051 | Critical | 9.8 | 2016-01-25 | Multiple unspecified vulnerabilities in Google V8 before 4.8.271.17, as used in Google Chrome before 48.0.2564.82, allow attackers to cause a denial of service… |
CVE-2016-1620 | High | 8.8 | 2016-01-25 | Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers to cause a denial of service or possibly have other impact via unknow… |
CVE-2016-1619 | High | 7.6 | 2016-01-25 | Multiple integer overflows in the (1) sycc422_to_rgb and (2) sycc444_to_rgb functions in fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome… |
CVE-2016-1618 | Medium | 6.5 | 2016-01-25 | Blink, as used in Google Chrome before 48.0.2564.82, does not ensure that a proper cryptographicallyRandomValues random number generator is used, which makes i… |
CVE-2016-1617 | Medium | 4.3 | 2016-01-25 | The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Go… |
CVE-2016-1616 | Medium | 4.3 | 2016-01-25 | The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoo… |
CVE-2016-1615 | Medium | 6.5 | 2016-01-25 | The Omnibox implementation in Google Chrome before 48.0.2564.82 allows remote attackers to spoof a document's origin via unspecified vectors. |
CVE-2016-1614 | Medium | 4.3 | 2016-01-25 | The UnacceleratedImageBufferSurface class in WebKit/Source/platform/graphics/UnacceleratedImageBufferSurface.cpp in Blink, as used in Google Chrome before 48.0… |
CVE-2016-1613 | High | 7.6 | 2016-01-25 | Multiple use-after-free vulnerabilities in the formfiller implementation in PDFium, as used in Google Chrome before 48.0.2564.82, allow remote attackers to cau… |
CVE-2016-1612 | High | 7.6 | 2016-01-25 | The LoadIC::UpdateCaches function in ic/ic.cc in Google V8, as used in Google Chrome before 48.0.2564.82, does not ensure receiver compatibility before perform… |
CVE-2016-1572 | High | 8.4 | 2016-01-22 | mount.ecryptfs_private.c in eCryptfs-utils does not validate mount destination filesystem types, which allows local users to gain privileges by mounting over a… |
CVE-2016-1571 | Medium | 6.3 | 2016-01-22 | The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows lo… |
CVE-2016-1570 | High | 8.5 | 2016-01-22 | The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a de… |
CVE-2016-1984 | Critical | 9.8 | 2016-01-22 | The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2016-01-20 has a hardcoded password for the 1MB@tMaN account, which makes it easier… |
CVE-2016-1135 | Medium | 6.1 | 2016-01-22 | Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166D… |
CVE-2016-1134 | High | 8.8 | 2016-01-22 | Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WH… |
CVE-2016-0618 | | 2016-01-21 | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality via unknown vectors related to Zones. | |
CVE-2016-0616 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenti… | |
CVE-2016-0614 | | 2016-01-21 | Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated u… | |
CVE-2016-0611 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to… | |
CVE-2016-0610 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect av… | |
CVE-2016-0609 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0608 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0607 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to… | |
CVE-2016-0606 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0605 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors. | |
CVE-2016-0602 | | 2016-01-21 | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality… | |
CVE-2016-0601 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Partition. | |
CVE-2016-0600 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0599 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. | |
CVE-2016-0598 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0597 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before… | |
CVE-2016-0596 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10… | |
CVE-2016-0595 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML. | |
CVE-2016-0594 | | 2016-01-21 | Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML. | |
CVE-2016-0592 | | 2016-01-21 | Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affec… | |
CVE-2016-0591 | | 2016-01-21 | Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to… | |
CVE-2016-0590 | | 2016-01-21 | Unspecified vulnerability in the PeopleSoft Enterprise SCM Order Management component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affe… | |
CVE-2016-0589 | | 2016-01-21 | Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentia… | |
CVE-2016-0588 | | 2016-01-21 | Unspecified vulnerability in the Oracle General Ledger component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown v… | |
CVE-2016-0587 | | 2016-01-21 | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated use… | |
CVE-2016-0586 | | 2016-01-21 | Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity v… | |
CVE-2016-0585 | | 2016-01-21 | Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availabilit… | |
CVE-2016-0584 | | 2016-01-21 | Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity vi… | |
CVE-2016-0583 | | 2016-01-21 | Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity vi… | |
CVE-2016-0582 | | 2016-01-21 | Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity vi… |