CVEs from 2016
Total
8,565
critical
critical 1,164
high
high 3,521
medium
medium 3,172
low
low 249
% Critical
13.6%
% with KEV
0.7%
% with exploit
0.7%
Top vendors
Top products
- phpmyadmin 3,382
- php 1,748
- squid 1,549
- samba 1,093
- drupal 868
- firefox 757
- moodle 700
- openssl 664
| CVE | Severity | CVSS | Risk | Published | Description | Impact |
|---|---|---|---|---|---|---|
| CVE-2016-3088 | unknown | — | 2.5 | 4y ago | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request | |
| CVE-2016-0752 | unknown | — | 2.5 | 11y ago | Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files. | |
| CVE-2016-7836 | unknown | — | 1.5 | 8mo ago | SKYSEA Client View contains an improper authentication vulnerability that allows remote code execution via a flaw in processing authentication on the TCP connection with the management console progra… | |
| CVE-2016-3714 | unknown | — | 1.5 | 2y ago | ImageMagick contains an improper input validation vulnerability that affects the EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT coders. This allows a remote attacker to execute arbitrary code v… | |
| CVE-2016-20017 | unknown | — | 1.5 | 2y ago | D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. | |
| CVE-2016-0165 | unknown | — | 1.5 | 3y ago | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation. | |
| CVE-2016-6415 | unknown | — | 1.5 | 3y ago | Cisco IOS, IOS XR, and IOS XE contain insufficient condition checks in the part of the code that handles Internet Key Exchange version 1 (IKEv1) security negotiation requests. contains an information… | |
| CVE-2016-3427 | unknown | — | 1.5 | 3y ago | Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions … | |
| CVE-2016-2386 | unknown | — | 1.5 | 4y ago | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |
| CVE-2016-2388 | unknown | — | 1.5 | 4y ago | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request. | |
| CVE-2016-1646 | unknown | — | 1.5 | 4y ago | Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript co… | |
| CVE-2016-5198 | unknown | — | 1.5 | 4y ago | Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. Thi… | |
| CVE-2016-1010 | unknown | — | 1.5 | 4y ago | Integer overflow vulnerability in Adobe Flash Player and AIR allows attackers to execute code. | |
| CVE-2016-3393 | unknown | — | 1.5 | 4y ago | A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the… | |
| CVE-2016-7256 | unknown | — | 1.5 | 4y ago | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take con… | |
| CVE-2016-0984 | unknown | — | 1.5 | 4y ago | Use-after-free vulnerability in Adobe Flash Player and Adobe AIR allows attackers to execute code. | |
| CVE-2016-0034 | unknown | — | 1.5 | 4y ago | Microsoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS). | |
| CVE-2016-3351 | unknown | — | 1.5 | 4y ago | An information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific f… | |
| CVE-2016-6366 | unknown | — | 1.5 | 4y ago | A buffer overflow vulnerability in the Simple Network Management Protocol (SNMP) code of Cisco ASA software could allow an attacker to cause a reload of the affected system or to remotely execute cod… | |
| CVE-2016-0162 | unknown | — | 1.5 | 4y ago | An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer. | |
| CVE-2016-4655 | unknown | — | 1.5 | 4y ago | The Apple iOS kernel allows attackers to obtain sensitive information from memory via a crafted application. | |
| CVE-2016-4656 | unknown | — | 1.5 | 4y ago | A memory corruption vulnerability in Apple iOS kernel allows attackers to execute code in a privileged context or cause a denial-of-service (DoS) via a crafted application. | |
| CVE-2016-4657 | unknown | — | 1.5 | 4y ago | Apple iOS WebKit contains a memory corruption vulnerability that allows attackers to execute remote code or cause a denial-of-service (DoS) via a crafted web site. This vulnerability could impact HTM… | |
| CVE-2016-6367 | unknown | — | 1.5 | 4y ago | A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code. | |
| CVE-2016-3298 | unknown | — | 1.5 | 4y ago | An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow th… | |
| CVE-2016-4437 | unknown | — | 1.5 | 4y ago | Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been confi… | |
| CVE-2016-7200 | unknown | — | 1.5 | 4y ago | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. | |
| CVE-2016-7201 | unknown | — | 1.5 | 4y ago | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site. | |
| CVE-2016-8735 | unknown | — | 1.5 | 4y ago | Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This C… | |
| CVE-2016-4523 | unknown | — | 1.5 | 4y ago | The WAP interface in Trihedral VTScada (formerly VTS) allows remote attackers to cause a denial-of-service (DoS). | |
| CVE-2016-0040 | unknown | — | 1.5 | 4y ago | The kernel in Microsoft Windows allows local users to gain privileges via a crafted application. | |
| CVE-2016-0189 | unknown | — | 1.5 | 4y ago | The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web s… | |
| CVE-2016-0151 | unknown | — | 1.5 | 4y ago | The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application. | |
| CVE-2016-7892 | unknown | — | 1.5 | 4y ago | Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class. | |
| CVE-2016-4171 | unknown | — | 1.5 | 4y ago | Unspecified vulnerability in Adobe Flash Player allows for remote code execution. | |
| CVE-2016-11021 | unknown | — | 1.5 | 4y ago | setSystemCommand on D-Link DCS-930L devices allows a remote attacker to execute code via an OS command. | |
| CVE-2016-1555 | unknown | — | 1.5 | 4y ago | Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution. | |
| CVE-2016-10174 | unknown | — | 1.5 | 4y ago | The NETGEAR WNR2000v5 router contains a buffer overflow which can be exploited to achieve remote code execution. | |
| CVE-2016-3309 | unknown | — | 1.5 | 4y ago | A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in k… | |
| CVE-2016-6277 | unknown | — | 1.5 | 4y ago | NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution. | |
| CVE-2016-7193 | unknown | — | 1.5 | 4y ago | Microsoft Office contains a memory corruption vulnerability which can allow for remote code execution. | |
| CVE-2016-1019 | unknown | — | 1.5 | 4y ago | Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code. | |
| CVE-2016-7855 | unknown | — | 1.5 | 4y ago | Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code. | |
| CVE-2016-0099 | unknown | — | 1.5 | 4y ago | A privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this… | |
| CVE-2016-7262 | unknown | — | 1.5 | 4y ago | A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands. | |
| CVE-2016-4117 | unknown | — | 1.5 | 4y ago | An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution. | |
| CVE-2016-8562 | unknown | — | 1.5 | 4y ago | An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. | |
| CVE-2016-0185 | unknown | — | 1.5 | 5y ago | Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. | |
| CVE-2016-9563 | unknown | — | 1.5 | 5y ago | SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks. | |
| CVE-2016-3643 | unknown | — | 1.5 | 5y ago | SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. | |
| CVE-2016-3235 | unknown | — | 1.5 | 5y ago | Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitat… | |
| CVE-2016-7255 | unknown | — | 1.5 | 5y ago | Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode. | |
| CVE-2016-0167 | unknown | — | 1.5 | 5y ago | Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted application | |
| CVE-2016-3715 | unknown | — | 1.5 | 5y ago | ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading. | |
| CVE-2016-3718 | unknown | — | 1.5 | 5y ago | ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image. | |
| CVE-2016-3976 | unknown | — | 1.5 | 5y ago | SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote at… | |
| CVE-2016-8641 | unknown | — | — | — | ||
| CVE-2016-8880 | unknown | — | — | — | ||
| CVE-2016-10711 | unknown | — | — | — | Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. | |
| CVE-2016-1000030 | unknown | — | — | — | Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can res… | |
| CVE-2016-1000002 | unknown | — | — | — | gdm3 3.14.2 and possibly later has an information leak before screen lock | |
| CVE-2016-4975 | unknown | — | — | — | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into … | |
| CVE-2016-1000037 | unknown | — | — | — | Pagure: XSS possible in file attachment endpoint | |
| CVE-2016-8601 | unknown | — | — | — | ||
| CVE-2016-9572 | unknown | — | — | — | A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openj… | |
| CVE-2016-9074 | unknown | — | — | — | An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird … | |
| CVE-2016-4983 | unknown | — | — | — | A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files. | |
| CVE-2016-9579 | unknown | — | — | — | A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw … | |
| CVE-2016-10749 | unknown | — | — | — | parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \ character. | |
| CVE-2016-1000107 | unknown | — | — | — | inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable… | |
| CVE-2016-9601 | unknown | — | — | — | ghostscript before version 9.21 is vulnerable to a heap based buffer overflow that was found in the ghostscript jbig2_decode_gray_scale_image function which is used to decode halftone segments in a J… | |
| CVE-2016-8729 | unknown | — | — | — | An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corrup… | |
| CVE-2016-20022 | unknown | — | — | — | In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products th… | |
| CVE-2016-1000212 | unknown | — | — | — | ||
| CVE-2016-10764 | unknown | — | — | — | In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so t… | |
| CVE-2016-10743 | unknown | — | — | — | hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call. | |
| CVE-2016-7524 | unknown | — | — | — | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. | |
| CVE-2016-7523 | unknown | — | — | — | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. | |
| CVE-2016-9598 | unknown | — | — | — | libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted XML document. NOTE: this vuln… | |
| CVE-2016-9602 | unknown | — | — | — | Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder … | |
| CVE-2016-9603 | unknown | — | — | — | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a … | |
| CVE-2016-10894 | unknown | — | — | — | xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrol… | |
| CVE-2016-9577 | unknown | — | — | — | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to … | |
| CVE-2016-3182 | unknown | — | — | — | The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file. | |
| CVE-2016-9597 | unknown | — | — | — | It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found in libxml2, making it vulnerable to a Denial of Service att… | |
| CVE-2016-10727 | unknown | — | — | — | camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS … | |
| CVE-2016-9583 | unknown | — | — | — | ||
| CVE-2016-9578 | unknown | — | — | — | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to … | |
| CVE-2016-8654 | unknown | — | — | — | ||
| CVE-2016-9065 | unknown | — | — | — | The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. Note: This issu… | |
| CVE-2016-9069 | unknown | — | — | — | A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. | |
| CVE-2016-9905 | unknown | — | — | — | A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6. | |
| CVE-2016-7075 | unknown | — | — | — | It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authenticat… | |
| CVE-2016-10746 | unknown | — | — | — | libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability… | |
| CVE-2016-9969 | unknown | — | — | — | In libwebp 0.5.1, there is a double free bug in libwebpmux. | |
| CVE-2016-1000110 | unknown | — | — | — | The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests. | |
| CVE-2016-10741 | unknown | — | — | — | In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated w… | |
| CVE-2016-10907 | unknown | — | — | — | An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt. | |
| CVE-2016-10723 | unknown | — | — | — | An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up t… | |
| CVE-2016-10906 | unknown | — | — | — | An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean. |