Search
Total
201818 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-9179 | 1 Lynx | 1 Lynx | 2016-12-23 | 5.0 MEDIUM | 7.5 HIGH |
| lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. | |||||
| CVE-2016-9193 | 1 Cisco | 2 Firepower Management Center, Firesight System Software | 2016-12-23 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass malware detection mechanisms on an affected system. Affected Products: Cisco Firepower Management Center and FireSIGHT System Software are affected when they are configured to use a file policy that has the Block Malware action. More Information: CSCvb27494. Known Affected Releases: 6.0.1.1 6.1.0. | |||||
| CVE-2016-9155 | 1 Siemens | 30 Ccid1445-dn18, Ccid1445-dn18 Firmware, Ccid1445-dn28 and 27 more | 2016-12-23 | 5.0 MEDIUM | 9.8 CRITICAL |
| The following SIEMENS branded IP Camera Models CCMW3025, CVMW3025-IR, CFMW3025 prior to version 1.41_SP18_S1; CCPW3025, CCPW5025 prior to version 0.1.73_S1; CCMD3025-DN18 prior to version v1.394_S1; CCID1445-DN18, CCID1445-DN28, CCID1145-DN36, CFIS1425, CCIS1425, CFMS2025, CCMS2025, CVMS2025-IR, CFMW1025, CCMW1025 prior to version v2635_SP1 could allow an attacker with network access to the web server to obtain administrative credentials under certain circumstances. | |||||
| CVE-2015-3271 | 1 Apache | 1 Tika | 2016-12-23 | 5.0 MEDIUM | 5.3 MEDIUM |
| Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header. | |||||
| CVE-2015-6574 | 1 Sisco | 4 Ax-s4 Iccp, Ax-s4 Iccp Firmware, Mms-ease and 1 more | 2016-12-23 | 7.8 HIGH | 7.5 HIGH |
| The SNAP Lite component in certain SISCO MMS-EASE and AX-S4 ICCP products allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet. | |||||
| CVE-2016-2355 | 1 Dotcms | 1 Dotcms | 2016-12-23 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1. | |||||
| CVE-2016-2873 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-12-23 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | |||||
| CVE-2016-2874 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-12-23 | 3.5 LOW | 3.1 LOW |
| IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 mishandles authorization, which allows remote authenticated users to obtain sensitive information via unspecified vectors. | |||||
| CVE-2016-2876 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-12-23 | 8.5 HIGH | 7.5 HIGH |
| IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 executes unspecified processes at an incorrect privilege level, which makes it easier for remote authenticated users to obtain root access by leveraging a command-injection issue. | |||||
| CVE-2016-2877 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-12-23 | 2.1 LOW | 3.3 LOW |
| IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 uses weak permissions for unspecified directories under the web root, which allows local users to modify data by writing to a file. | |||||
| CVE-2016-2878 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2016-12-23 | 6.0 MEDIUM | 8.0 HIGH |
| Multiple cross-site request forgery (CSRF) vulnerabilities in IBM QRadar SIEM 7.1 before MR2 Patch 13 and 7.2 before 7.2.7 allow remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. | |||||
| CVE-2016-5303 | 1 Horde | 1 Groupware | 2016-12-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute. | |||||
| CVE-2016-6933 | 1 Adobe | 2 Experience Manager, Livecycle | 2016-12-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks. | |||||
| CVE-2016-7065 | 1 Redhat | 1 Jboss Enterprise Application Platform | 2016-12-23 | 6.5 MEDIUM | 8.8 HIGH |
| The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object. | |||||
| CVE-2016-8102 | 1 Intel | 1 Wireless Bluetooth Drivers | 2016-12-23 | 7.2 HIGH | 7.8 HIGH |
| Unquoted service path vulnerability in Intel Wireless Bluetooth Drivers 16.x, 17.x, and before 18.1.1607.3129 allows local users to launch processes with elevated privileges. | |||||
| CVE-2016-7889 | 1 Adobe | 1 Digital Editions | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure. | |||||
| CVE-2016-7960 | 1 Siemens | 1 Simatic Step 7 | 2016-12-22 | 1.9 LOW | 2.5 LOW |
| Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors. | |||||
| CVE-2016-8826 | 3 Linux, Microsoft, Nvidia | 3 Linux Kernel, Windows, Gpu Driver | 2016-12-22 | 4.9 MEDIUM | 5.5 MEDIUM |
| All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service. | |||||
| CVE-2016-8825 | 2 Microsoft, Nvidia | 2 Windows, Gpu Driver | 2016-12-22 | 7.2 HIGH | 7.8 HIGH |
| All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges. | |||||
| CVE-2016-9208 | 1 Cisco | 1 Emergency Responder | 2016-12-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected device. More Information: CSCva98951 CSCva98954 CSCvb57494. Known Affected Releases: 11.5(2.10000.5). Known Fixed Releases: 12.0(0.98000.14) 12.0(0.98000.16). | |||||
| CVE-2016-9212 | 1 Cisco | 1 Web Security Appliance | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to connect to a secure website over Secure Sockets Layer (SSL) or Transport Layer Security (TLS), even if the WSA is configured to block connections to the website. Affected Products: This vulnerability affects Cisco Web Security Appliances if the HTTPS decryption options are enabled and configured for the device to block connections to certain websites. More Information: CSCvb49012. Known Affected Releases: 9.0.1-162 9.1.1-074. | |||||
| CVE-2016-9203 | 1 Cisco | 2 Asr 5000, Asr 5000 Series Software | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco ASR 5000 Series Software could allow an unauthenticated, remote attacker to cause a reload of the ipsecmgr process. More Information: CSCvb38398. Known Affected Releases: 20.2.3 20.2.3.65026. Known Fixed Releases: 21.1.M0.65431 21.1.PP0.65733 21.1.R0.65467 21.1.R0.65496 21.1.VC0.65434 21.1.VC0.65489 21.2.A0.65437. | |||||
| CVE-2016-9206 | 1 Cisco | 1 Unified Communications Manager | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting (XSS) attacks. More Information: CSCvb64641. Known Affected Releases: 11.5(1.10000.6) 11.5(1.11007.2). Known Fixed Releases: 11.5(1.12900.7) 11.5(1.12900.8) 12.0(0.98000.155) 12.0(0.98000.178) 12.0(0.98000.366) 12.0(0.98000.468) 12.0(0.98000.536) 12.0(0.98500.6). | |||||
| CVE-2016-9207 | 1 Cisco | 1 Expressway | 2016-12-22 | 6.4 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitrary hosts. This does not allow for full traffic proxy through the Expressway. Affected Products: This vulnerability affects Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS). More Information: CSCvc10834. Known Affected Releases: X8.7.2 X8.8.3. Known Fixed Releases: X8.9. | |||||
| CVE-2016-9211 | 1 Cisco | 2 Ons 15454 Sdh Multiservice Platform, Ons 15454 Sdh Multiservice Platform Software | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote attacker to cause the controller card to unexpectedly reload. More Information: CSCuw26032. Known Affected Releases: 10.51. | |||||
| CVE-2016-9480 | 1 Libdwarf Project | 1 Libdwarf | 2016-12-22 | 6.4 MEDIUM | 9.1 CRITICAL |
| libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006. | |||||
| CVE-2016-9214 | 1 Cisco | 1 Identity Services Engine Software | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvb86332 CSCvb86760. Known Affected Releases: 2.0(101.130). | |||||
| CVE-2016-9215 | 1 Cisco | 1 Ios Xr | 2016-12-22 | 7.2 HIGH | 7.8 HIGH |
| A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the root user. More Information: CSCva38434. Known Affected Releases: 6.1.1.BASE. | |||||
| CVE-2016-9201 | 1 Cisco | 1 Ios | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the Zone-Based Firewall feature of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to pass traffic that should otherwise have been dropped based on the configuration. More Information: CSCuz21015. Known Affected Releases: 15.3(3)M3. Known Fixed Releases: 15.6(2)T0.1 15.6(2.0.1a)T0 15.6(2.19)T 15.6(3)M. | |||||
| CVE-2016-9202 | 1 Cisco | 1 Email Security Appliance | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the affected interface on an affected device. More Information: CSCvb37346. Known Affected Releases: 9.1.1-036 9.7.1-066. | |||||
| CVE-2016-9965 | 1 Samsung | 1 Samsung Mobile | 2016-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119. | |||||
| CVE-2016-9200 | 1 Cisco | 1 Prime Collaboration Assurance | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface. More Information: CSCut43268. Known Affected Releases: 10.5(1) 10.6. | |||||
| CVE-2016-9966 | 1 Samsung | 1 Samsung Mobile | 2016-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120. | |||||
| CVE-2016-9967 | 1 Samsung | 1 Samsung Mobile | 2016-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121. | |||||
| CVE-2016-9199 | 1 Cisco | 1 Iox | 2016-12-22 | 6.8 MEDIUM | 6.5 MEDIUM |
| A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a targeted system. Affected Products: This vulnerability affects specific releases of the Cisco IOx subsystem of Cisco IOS and IOS XE Software. More Information: CSCvb23331. Known Affected Releases: 15.2(6.0.57i)E CAF-1.1.0.0. | |||||
| CVE-2016-9198 | 1 Cisco | 1 Identity Services Engine | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| A vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack. More Information: CSCuw15041. Known Affected Releases: 1.2(1.199). | |||||
| CVE-2016-6657 | 1 Pivotal Software | 2 Cloud Foundry Elastic Runtime, Cloud Foundry Ops Manager | 2016-12-22 | 5.8 MEDIUM | 7.4 HIGH |
| An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later. | |||||
| CVE-2016-8733 | 1 Joyent | 1 Smartos | 2016-12-22 | 7.2 HIGH | 8.8 HIGH |
| An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-9031. | |||||
| CVE-2016-9031 | 1 Joyent | 1 Smartos | 2016-12-22 | 6.9 MEDIUM | 7.8 HIGH |
| An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-8733. | |||||
| CVE-2016-9032 | 1 Joyent | 1 Smartos | 2016-12-22 | 6.9 MEDIUM | 7.0 HIGH |
| An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9034. | |||||
| CVE-2016-9033 | 1 Joyent | 1 Smartos | 2016-12-22 | 6.9 MEDIUM | 7.0 HIGH |
| An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9035. | |||||
| CVE-2016-9034 | 1 Joyent | 1 Smartos | 2016-12-22 | 6.9 MEDIUM | 7.0 HIGH |
| An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9032. | |||||
| CVE-2016-9035 | 1 Joyent | 1 Smartos | 2016-12-22 | 6.9 MEDIUM | 7.0 HIGH |
| An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9033. | |||||
| CVE-2016-9837 | 1 Joomla | 1 Joomla\! | 2016-12-22 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in templates/beez3/html/com_content/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout override of the com_content article view allow users to view articles that should not be publicly accessible, as demonstrated by an index.php?option=com_content&view=article&id=1&template=beez3 request. | |||||
| CVE-2016-0618 | 1 Oracle | 1 Solaris | 2016-12-22 | 1.4 LOW | N/A |
| Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality via unknown vectors related to Zones. | |||||
| CVE-2016-0868 | 1 Rockwellautomation | 9 1763-l16awa Series A, 1763-l16awa Series B, 1763-l16bbb Series A and 6 more | 2016-12-22 | 10.0 HIGH | 9.8 CRITICAL |
| Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request. | |||||
| CVE-2016-1000003 | 1 Mirror Manager Project | 1 Mirror Manager | 2016-12-22 | 7.5 HIGH | 9.8 CRITICAL |
| Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code. | |||||
| CVE-2016-1000142 | 1 Parsi-font Project | 1 Parsi-font | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS in wordpress plugin parsi-font v4.2.5 | |||||
| CVE-2016-1000145 | 1 Pondol-carousel Project | 1 Pondol-carousel | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS in wordpress plugin pondol-carousel v1.0 | |||||
| CVE-2016-1000155 | 1 Wpsolr | 1 Wpsolr-search-engine | 2016-12-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected XSS in wordpress plugin wpsolr-search-engine v7.6 | |||||