CVEs from 2016
Total
8,564
critical
critical 1,164
high
high 3,521
medium
medium 3,172
low
low 249
% Critical
13.6%
% with KEV
0.7%
% with exploit
0.9%
Top vendors
Top products
- phpmyadmin 3,382
- php 1,748
- squid 1,549
- samba 1,093
- drupal 868
- firefox 757
- moodle 700
- openssl 664
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2016-6630 | medium | 6.5 | 6.5 | 10y ago | An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to … | |
| CVE-2016-6623 | medium | 6.5 | 6.5 | 10y ago | An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions… | |
| CVE-2016-6618 | medium | 6.5 | 6.5 | 10y ago | phpMyAdmin Denial of service (DOS) attack in transformation feature | |
| CVE-2016-6612 | medium | 6.5 | 6.5 | 10y ago | An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions… | |
| CVE-2016-3044 | medium | 6.5 | 6.5 | 10y ago | The Linux kernel component in IBM PowerKVM 2.1 before 2.1.1.3-65.10 and 3.1 before 3.1.0.2 allows guest OS users to cause a denial of service (host OS infinite loop and hang) via unspecified vectors. | |
| CVE-2016-2881 | medium | 6.5 | 6.5 | 10y ago | IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 and QRadar Incident Forensics 7.2 before 7.2.7 allow remote attackers to bypass intended access restrictions via modified request paramete… | |
| CVE-2016-2950 | medium | 6.5 | 6.5 | 10y ago | SQL injection vulnerability in IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | |
| CVE-2016-2937 | medium | 6.5 | 6.5 | 10y ago | IBM BigFix Remote Control before 9.1.3 allows remote attackers to obtain sensitive information or spoof e-mail transmission via a crafted POST request, related to an "untrusted information vulnerabil… | |
| CVE-2016-5765 | medium | 6.5 | 6.5 | 10y ago | Administrative Server in Micro Focus Host Access Management and Security Server (MSS) and Reflection for the Web (RWeb) and Reflection Security Gateway (RSG) and Reflection ZFE (ZFE) allows remote un… | |
| CVE-2016-0317 | medium | 6.5 | 6.5 | 10y ago | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors. | |
| CVE-2016-9452 | medium | 6.5 | 6.5 | 10y ago | Drupal Denial of service via transliterate mechanism | |
| CVE-2016-2996 | medium | 6.5 | 6.5 | 10y ago | IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, allows remote authenticated users to append to arbitrary files via unspecified vectors. | |
| CVE-2016-9149 | medium | 6.5 | 6.5 | 10y ago | The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6 mishandles single qu… | |
| CVE-2016-6457 | medium | 6.5 | 6.5 | 10y ago | A vulnerability in the Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure (ACI) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS)… | |
| CVE-2016-7252 | medium | 6.5 | 6.5 | 10y ago | Microsoft SQL Server 2016 mishandles the FILESTREAM path, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Analysis Services Information Disclosure Vulnera… | |
| CVE-2016-7237 | medium | 6.5 | 6.5 | 10y ago | Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Win… | |
| CVE-2016-7233 | medium | 6.5 | 6.5 | 10y ago | Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2013 SP1, and Off… | |
| CVE-2016-7210 | medium | 6.5 | 6.5 | 10y ago | atmfd.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows… | |
| CVE-2016-6454 | medium | 6.5 | 6.5 | 10y ago | A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulfillment application could allow an unauthenticated, remote attacker to execute u… | |
| CVE-2016-9086 | medium | 6.5 | 6.5 | 10y ago | GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this feature allows a user to export and then re-import their p… | |
| CVE-2016-8879 | medium | 6.5 | 6.5 | 10y ago | The thumbnail shell extension plugin (FoxitThumbnailHndlr_x86.dll) in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to cause a denial of service (out-of-bounds write and a… | |
| CVE-2016-7965 | medium | 6.5 | 6.5 | 10y ago | DokuWiki 2016-06-26a and older uses $_SERVER[HTTP_HOST] instead of the baseurl setting as part of the password-reset URL. This can lead to phishing attacks. (A remote unauthenticated attacker can cha… | |
| CVE-2016-9117 | medium | 6.5 | 6.5 | 10y ago | NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. | |
| CVE-2016-9116 | medium | 6.5 | 6.5 | 10y ago | NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. | |
| CVE-2016-9115 | medium | 6.5 | 6.5 | 10y ago | Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file. | |
| CVE-2016-4394 | medium | 6.5 | 6.5 | 10y ago | HPE System Management Homepage before v7.6 allows remote attackers to obtain sensitive information via unspecified vectors, related to an "HSTS" issue. | |
| CVE-2016-6440 | medium | 6.5 | 6.5 | 10y ago | The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking attack. More Information… | |
| CVE-2016-5627 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB. | |
| CVE-2016-5626 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS. | |
| CVE-2016-5624 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML. | |
| CVE-2016-5612 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. | |
| CVE-2016-5609 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. | |
| CVE-2016-5585 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Oracle Interaction Center Intelligence component in Oracle E-Business Suite 12.1.1 through 12.1.3 allows remote attackers to affect confidentiality and integrity via … | |
| CVE-2016-5571 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via… | |
| CVE-2016-5570 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via vectors re… | |
| CVE-2016-5567 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via… | |
| CVE-2016-5534 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Siebel Apps - Customer Order Management component in Oracle Siebel CRM 16.1 allows remote authenticated users to affect confidentiality via unknown vectors. | |
| CVE-2016-5521 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, … | |
| CVE-2016-3492 | medium | 6.5 | 6.5 | 10y ago | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimi… | |
| CVE-2016-4407 | medium | 6.5 | 6.5 | 10y ago | The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka S… | |
| CVE-2016-8564 | medium | 6.5 | 6.5 | 10y ago | SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410. | |
| CVE-2016-3882 | medium | 6.5 | 6.5 | 10y ago | Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (reboot) via an acc… | |
| CVE-2016-6435 | medium | 6.5 | 6.5 | 10y ago | The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376. | |
| CVE-2016-6424 | medium | 6.5 | 6.5 | 10y ago | The DHCP Relay implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4.7.29 and 9.1.7.4 allows remote attackers to cause a denial of service (interface wedge) via a crafted rate of DHC… | |
| CVE-2016-1454 | medium | 6.5 | 6.5 | 10y ago | Cisco NX-OS 4.0 through 7.3 and 11.0 through 11.2 on 1000v, 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device reload)… | |
| CVE-2016-6423 | medium | 6.5 | 6.5 | 10y ago | The IKEv2 client and initiator implementations in Cisco IOS 15.5(3)M and IOS XE allow remote IKEv2 servers to cause a denial of service (device reload) via crafted IKEv2 packets, aka Bug ID CSCux9754… | |
| CVE-2016-6420 | medium | 6.5 | 6.5 | 10y ago | Cisco FireSIGHT System Software 4.10.3 through 5.4.0 in Firepower Management Center allows remote authenticated users to bypass authorization checks and gain privileges via a crafted HTTP request, ak… | |
| CVE-2016-8280 | medium | 6.5 | 6.5 | 10y ago | Directory traversal vulnerability in Huawei eSight before V300R003C20SPC005 allows remote authenticated users to read arbitrary files via unspecified vectors. | |
| CVE-2016-8277 | medium | 6.5 | 6.5 | 10y ago | Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified… | |
| CVE-2016-6905 | medium | 6.5 | 6.5 | 10y ago | The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TGA image. | |
| CVE-2016-3625 | medium | 6.5 | 6.5 | 10y ago | tif_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted TIFF image. | |
| CVE-2016-3622 | medium | 6.5 | 6.5 | 10y ago | The fpAcc function in tif_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted TIFF image. | |
| CVE-2016-3619 | medium | 6.5 | 6.5 | 10y ago | The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows remote attackers to cause a denial of service (buffer over-r… | |
| CVE-2016-5176 | medium | 6.5 | 6.5 | 10y ago | Google Chrome before 53.0.2785.113 allows remote attackers to bypass the SafeBrowsing protection mechanism via unspecified vectors. | |
| CVE-2016-7498 | medium | 6.5 | 6.5 | 10y ago | OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances wh… | |
| CVE-2016-6038 | medium | 6.5 | 6.5 | 10y ago | Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.3, 6.1, and 7.1, allows remote authenticated users to read arbitrary files via a… | |
| CVE-2016-6901 | medium | 6.5 | 6.5 | 10y ago | Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3600 routers with software before V200R007C00SPC900 and NetEngine 16EX routers wi… | |
| CVE-2016-6827 | medium | 6.5 | 6.5 | 10y ago | Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated users to obtain sensitive information via unspecified vectors. | |
| CVE-2016-6826 | medium | 6.5 | 6.5 | 10y ago | Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a crafted compressed email attachment. | |
| CVE-2016-5997 | medium | 6.5 | 6.5 | 10y ago | The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A before 9.0.1.5108_9.0.1A FP5, 9.0.2 before 9.0.2.122… | |
| CVE-2016-5970 | medium | 6.5 | 6.5 | 10y ago | Directory traversal vulnerability in IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 allows remote authenticated users to read arbitrary files via a .. (dot do… | |
| CVE-2016-5946 | medium | 6.5 | 6.5 | 10y ago | Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.2.11 allows remote authenticated users to read arbitrary files via a .. (dot dot… | |
| CVE-2016-2999 | medium | 6.5 | 6.5 | 10y ago | IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sensitive information via an unspecified brute-force attack. | |
| CVE-2016-5174 | medium | 6.5 | 6.5 | 10y ago | browser/ui/cocoa/browser_window_controller_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests during a fullscreen transition, which allows remote attackers t… | |
| CVE-2016-5172 | medium | 6.5 | 6.5 | 10y ago | The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive information from arbitrary memory locations via crafted Ja… | |
| CVE-2016-4760 | medium | 6.5 | 6.5 | 10y ago | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 s… | |
| CVE-2016-4758 | medium | 6.5 | 6.5 | 10y ago | WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive info… | |
| CVE-2016-4718 | medium | 6.5 | 6.5 | 10y ago | Buffer overflow in FontParser in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive information from process memory via a crafted… | |
| CVE-2016-4708 | medium | 6.5 | 6.5 | 10y ago | CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remote attackers to obtain sensitive information via a crafted … | |
| CVE-2016-6412 | medium | 6.5 | 6.5 | 10y ago | The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE, when the IOx feature set is enabled, allows man-in-the-middle attackers to trigger arbitrary downloads via c… | |
| CVE-2016-6410 | medium | 6.5 | 6.5 | 10y ago | The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE, when the IOx feature set is enabled, allows remote authenticated users to read arbitrary files via unspecifi… | |
| CVE-2016-5282 | medium | 6.5 | 6.5 | 10y ago | Mozilla Firefox before 49.0 does not properly restrict the scheme in favicon requests, which might allow remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by a… | |
| CVE-2016-5271 | medium | 6.5 | 6.5 | 10y ago | The PropertyProvider::GetSpacingInternal function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conju… | |
| CVE-2016-2827 | medium | 6.5 | 6.5 | 10y ago | The mozilla::net::IsValidReferrerPolicy function in Mozilla Firefox before 49.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a Content Security … | |
| CVE-2016-6824 | medium | 6.5 | 6.5 | 10y ago | Huawei AC6003, AC6005, AC6605, and ACU2 access controllers with software before V200R006C10SPC200 allows remote authenticated users to cause a denial of service (device restart) via crafted CAPWAP pa… | |
| CVE-2016-5844 | medium | 6.5 | 6.5 | 10y ago | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file. | |
| CVE-2016-4968 | medium | 6.5 | 6.5 | 10y ago | The linkreport/tmp/admin_global page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to discover administrator cookies via a GET request. | |
| CVE-2016-4967 | medium | 6.5 | 6.5 | 10y ago | Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to obtain sensitive information from (1) a backup of the device configuration via script/cfg_show.php or (2) PCA… | |
| CVE-2016-4966 | medium | 6.5 | 6.5 | 10y ago | The diagnosis_control.php page in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users to download PCAP files via vectors related to the UserName GET parameter. | |
| CVE-2016-0921 | medium | 6.5 | 6.5 | 10y ago | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by repl… | |
| CVE-2016-6405 | medium | 6.5 | 6.5 | 10y ago | Cisco Fog Director 1.0(0) for IOx allows remote authenticated users to bypass intended access restrictions and write to arbitrary files via the Cartridge interface, aka Bug ID CSCuz89368. | |
| CVE-2016-4278 | medium | 6.5 | 6.5 | 10y ago | Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain se… | |
| CVE-2016-4277 | medium | 6.5 | 6.5 | 10y ago | Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain se… | |
| CVE-2016-4271 | medium | 6.5 | 6.5 | 10y ago | Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to bypass intended access restrictions and obtain se… | |
| CVE-2016-3374 | medium | 6.5 | 6.5 | 10y ago | The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a craf… | |
| CVE-2016-3370 | medium | 6.5 | 6.5 | 10y ago | The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a craf… | |
| CVE-2016-3366 | medium | 6.5 | 6.5 | 10y ago | Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass… | |
| CVE-2016-0141 | medium | 6.5 | 6.5 | 10y ago | The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive … | |
| CVE-2016-5954 | medium | 6.5 | 6.5 | 10y ago | IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF30, 8.0.0 through 8.0.0.1 CF21, and 8.5.0 before CF12 allows remote authenticated users to cause a… | |
| CVE-2016-4852 | medium | 6.5 | 6.5 | 10y ago | YoruFukurou (NightOwl) before 2.85 relies on support for emoji skin-tone modifiers even though this support is missing from the CoreText CTFramesetter API on OS X 10.9, which allows remote attackers … | |
| CVE-2016-5162 | medium | 6.5 | 6.5 | 10y ago | The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use a… | |
| CVE-2016-5160 | medium | 6.5 | 6.5 | 10y ago | The AllowCrossRendererResourceLoad function in extensions/browser/url_request_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use a… | |
| CVE-2016-5155 | medium | 6.5 | 6.5 | 10y ago | Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address ba… | |
| CVE-2016-1280 | medium | 6.5 | 6.5 | 10y ago | PKId in Juniper Junos OS before 12.1X44-D52, 12.1X46 before 12.1X46-D37, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D20, 13.3 before 13.3R10, 14.1 before 14.1R8, 14.1X53 … | |
| CVE-2016-1275 | medium | 6.5 | 6.5 | 10y ago | Juniper Junos OS before 13.3R9, 14.1R6 before 14.1R6-S1, and 14.1 before 14.1R7, when configured with VPLS routing-instances, allows remote attackers to obtain sensitive mbuf information by injecting… | |
| CVE-2016-5404 | medium | 6.5 | 6.5 | 10y ago | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certifi… | |
| CVE-2016-7108 | medium | 6.5 | 6.5 | 10y ago | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 SPH206 allows remote authenticated users to obtain the MD5 hashes of arbitrary user passwords via unspecified vectors. | |
| CVE-2016-6345 | medium | 6.5 | 6.5 | 10y ago | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. | |
| CVE-2016-0772 | medium | 6.5 | 6.5 | 10y ago | The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypa… | |
| CVE-2016-6376 | medium | 6.5 | 6.5 | 10y ago | The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before 8.0.140.0, 8.1.x and 8.2.x before 8.2.121.0, and 8.3.x before 8.3.102.0 allows r… |