Vulnerability Summary for the Week of December 12, 2016
Released
Dec 19, 2016
Document ID
SB16-354
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:
- High: vulnerabilities with a CVSS base score of 7.0–10.0
- Medium: vulnerabilities with a CVSS base score of 4.0–6.9
- Low: vulnerabilities with a CVSS base score of 0.0–3.9
Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.
High Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| 7-zip -- 7-zip | Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image. | 2016-12-13 | 9.3 | CVE-2016-2334 MISC CONFIRM BID SECTRACK MISC FEDORA FEDORA |
| adobe -- dng_converter | Adobe DNG Converter versions 9.7 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7856 BID CONFIRM |
| adobe -- animate | Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7866 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class related to bookmarking in searches. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7867 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class related to alternation functionality. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7868 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class related to backtrack search functionality. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7869 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable buffer overflow / underflow vulnerability in the RegExp class for specific search strategies. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7870 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Worker class. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7871 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to objects at multiple presentation levels. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7872 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the PSDK class related to ad policy functionality method. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7873 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the NetConnection class when handling the proxy types. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7874 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable integer overflow vulnerability in the BitmapData class. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7875 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the Clipboard class related to data handling functionality. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7876 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the Action Message Format serialization (AFM0). Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7877 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the PSDK's MediaPlayer class. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7878 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7879 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability when setting the length property of an array object. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7880 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class when handling conversion to an object. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7881 BID CONFIRM |
| adobe -- indesign | Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7886 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have security bypass vulnerability in the implementation of the same origin policy. | 2016-12-15 | 7.5 | CVE-2016-7890 BID CONFIRM |
| adobe -- flash_player | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution. | 2016-12-15 | 10.0 | CVE-2016-7892 BID CONFIRM |
| atlassian -- crowd | The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. | 2016-12-09 | 7.5 | CVE-2016-6496 BUGTRAQ BID CONFIRM CONFIRM MISC |
| bdwgc_project -- bdwgc | Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service (heap buffer overflow crash) and possibly execute arbitrary code via huge allocation. | 2016-12-11 | 7.5 | CVE-2016-9427 MLIST BID CONFIRM |
| bmc -- bladelogic_server_automation_console | BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly have unspecified other impact by leveraging a "logic flaw" in the authentication process. | 2016-12-13 | 7.5 | CVE-2016-4322 MISC BUGTRAQ BID |
| busybox -- busybox | The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop. | 2016-12-09 | 7.8 | CVE-2016-6301 MLIST BID CONFIRM CONFIRM |
| cisco -- hybrid_media_service | A vulnerability in the installation procedure of the Cisco Hybrid Media Service could allow an authenticated, local attacker to elevate privileges to the root level. More Information: CSCvb81344. Known Affected Releases: 1.0. | 2016-12-13 | 7.2 | CVE-2016-6470 BID CONFIRM |
| cisco -- anyconnect_secure_mobility_client | A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More Information: CSCvb68043. Known Affected Releases: 4.3(2039) 4.3(748). Known Fixed Releases: 4.3(4019) 4.4(225). | 2016-12-13 | 7.2 | CVE-2016-9192 BID CONFIRM |
| cisco -- ios_xr | A vulnerability in Cisco IOS XR Software could allow an authenticated, local attacker to log in to the device with the privileges of the root user. More Information: CSCva38434. Known Affected Releases: 6.1.1.BASE. | 2016-12-13 | 7.2 | CVE-2016-9215 BID CONFIRM |
| crowbar_project -- barclamp-trove | The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors. | 2016-12-09 | 7.5 | CVE-2016-6829 MLIST MLIST BID CONFIRM CONFIRM CONFIRM |
| djangoproject -- django | Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary. | 2016-12-09 | 7.5 | CVE-2016-9013 BID SECTRACK UBUNTU FEDORA FEDORA CONFIRM |
| fedoraproject -- fedora | The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data. | 2016-12-13 | 7.5 | CVE-2016-5407 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations. | 2016-12-13 | 7.5 | CVE-2016-7942 MLIST MLIST BID SECTRACK CONFIRM FEDORA MLIST |
| fedoraproject -- fedora | The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations. | 2016-12-13 | 7.5 | CVE-2016-7943 MLIST MLIST BID SECTRACK CONFIRM FEDORA MLIST |
| fedoraproject -- fedora | Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of INT_MAX, which triggers the client to stop reading data and get out of sync. | 2016-12-13 | 7.5 | CVE-2016-7944 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted response. | 2016-12-13 | 7.5 | CVE-2016-7947 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data. | 2016-12-13 | 7.5 | CVE-2016-7948 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors involving length fields. | 2016-12-13 | 7.5 | CVE-2016-7949 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths. | 2016-12-13 | 7.5 | CVE-2016-7950 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leveraging the lack of range checks. | 2016-12-13 | 7.5 | CVE-2016-7951 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string. | 2016-12-13 | 7.5 | CVE-2016-7953 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| google -- android | A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622. | 2016-12-13 | 9.3 | CVE-2016-6699 BID CONFIRM CONFIRM |
| google -- android | An elevation of privilege vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31385713. | 2016-12-13 | 9.3 | CVE-2016-6706 BID CONFIRM CONFIRM |
| google -- android | A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593765. | 2016-12-13 | 7.1 | CVE-2016-6711 BID CONFIRM CONFIRM |
| google -- android | A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30593752. | 2016-12-13 | 7.1 | CVE-2016-6712 BID CONFIRM CONFIRM |
| jfrog -- artifactory | JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, aka LDAP entry poisoning. | 2016-12-09 | 7.5 | CVE-2016-6501 BID MISC CONFIRM |
| joyent -- smartos | An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-9031. | 2016-12-14 | 7.2 | CVE-2016-8733 MISC |
| mailcwp_project -- mailcwp | Mailcwp remote file upload vulnerability incomplete fix v1.100 | 2016-12-14 | 7.5 | CVE-2016-1000156 MISC MISC |
| nagios -- nagios | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796. | 2016-12-15 | 7.5 | CVE-2016-9565 MISC FULLDISC BUGTRAQ BID MISC CONFIRM |
| nagios -- nagios | base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565. | 2016-12-15 | 7.2 | CVE-2016-9566 FULLDISC BID CONFIRM CONFIRM MISC CONFIRM |
| oracle -- solaris | The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecified impact via a crafted DDS file, which triggers an out-of-bounds read. | 2016-12-13 | 7.5 | CVE-2016-5687 MLIST MLIST CONFIRM BID MISC |
| oracle -- solaris | The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of NULL pointer checks. | 2016-12-13 | 7.5 | CVE-2016-5689 MLIST MLIST CONFIRM BID MISC CONFIRM CONFIRM CONFIRM |
| oracle -- solaris | The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table. | 2016-12-13 | 7.5 | CVE-2016-5690 MLIST MLIST CONFIRM BID MISC CONFIRM CONFIRM CONFIRM |
| oracle -- solaris | The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue. | 2016-12-13 | 7.5 | CVE-2016-5691 MLIST MLIST CONFIRM BID MISC CONFIRM CONFIRM CONFIRM |
| oracle -- solaris | Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fault) or possibly execute arbitrary code via vectors involving the offset variable. | 2016-12-13 | 7.5 | CVE-2016-5841 MLIST MLIST CONFIRM BID CONFIRM CONFIRM |
| pcre -- pcre | Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384. | 2016-12-13 | 7.5 | CVE-2015-3210 MLIST MLIST BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. Some data is passed to the PHP unserialize() function without verification that it's valid serialized data. The unserialization can result in code execution because of the interaction with object instantiation and autoloading. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 7.5 | CVE-2016-6620 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 10.0 | CVE-2016-6629 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations, a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 8.5 | CVE-2016-6631 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. It is possible to bypass AllowRoot restriction ($cfg['Servers'][$i]['AllowRoot']) and deny rules for username by using Null Byte in the username. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 7.5 | CVE-2016-9849 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. Due to a bug in serialized string parsing, it was possible to bypass the protection offered by PMA_safeUnserialize() function. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 7.5 | CVE-2016-9865 CONFIRM |
| redhat -- enterprise_linux_server | XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052. | 2016-12-14 | 7.5 | CVE-2014-8241 MLIST MLIST BID CONFIRM REDHAT |
| samsung -- samsung_mobile | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7119. | 2016-12-16 | 10.0 | CVE-2016-9965 CONFIRM |
| samsung -- samsung_mobile | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7120. | 2016-12-16 | 10.0 | CVE-2016-9966 CONFIRM |
| samsung -- samsung_mobile | Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges. The Samsung ID is SVE-2016-7121. | 2016-12-16 | 10.0 | CVE-2016-9967 CONFIRM |
Medium Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| adobe -- experience_manager | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-6933 BID CONFIRM |
| adobe -- livecycle | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-6934 BID CONFIRM |
| adobe -- experience_manager | Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-7882 BID CONFIRM |
| adobe -- experience_manager | Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-7883 BID CONFIRM |
| adobe -- experience_manager | Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-7884 BID CONFIRM |
| adobe -- experience_manager | Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks. | 2016-12-15 | 6.8 | CVE-2016-7885 BID CONFIRM |
| adobe -- coldfusion_builder | Adobe ColdFusion Builder versions 2016 update 2 and earlier, 3.0.3 and earlier have an important vulnerability that could lead to information disclosure. | 2016-12-15 | 5.0 | CVE-2016-7887 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak. | 2016-12-15 | 5.0 | CVE-2016-7888 BID CONFIRM |
| adobe -- digital_editions | Adobe Digital Editions versions 4.5.2 and earlier has an issue with parsing crafted XML entries that could lead to information disclosure. | 2016-12-15 | 5.0 | CVE-2016-7889 BID CONFIRM |
| adobe -- robohelp | Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks. | 2016-12-15 | 4.3 | CVE-2016-7891 BID CONFIRM |
| apache -- tika | Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header. | 2016-12-15 | 5.0 | CVE-2015-3271 MLIST MLIST |
| bottlepy -- bottle | redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call. | 2016-12-16 | 4.3 | CVE-2016-9964 CONFIRM CONFIRM |
| cisco -- web_security_appliance | A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA), Cisco Web Security Appliance (WSA), and Cisco Content Management Security Appliance (SMA) could allow an unauthenticated, remote attacker to impersonate the update server. More Information: CSCul88715, CSCul94617, CSCul94627. Known Affected Releases: 7.5.2-201 7.6.3-025 8.0.1-023 8.5.0-000 8.5.0-ER1-198 7.5.2-HP2-303 7.7.0-608 7.7.5-835 8.5.1-021 8.8.0-000 7.9.1-102 8.0.0-404 8.1.1-013 8.2.0-222. Known Fixed Releases: 8.0.2-069 8.0.2-074 8.5.7-042 9.1.0-032 8.5.2-027 9.6.1-019. | 2016-12-13 | 4.3 | CVE-2016-1411 BID CONFIRM |
| cisco -- fireamp_connector_endpoint_software | A vulnerability in the system management of certain FireAMP system processes in Cisco FireAMP Connector Endpoint software could allow an authenticated, local attacker to stop certain protected FireAMP processes without requiring a password. Stopping certain critical processes could cause a denial of service (DoS) condition, and certain security features could no longer be available. More Information: CSCvb40597. Known Affected Releases: 1. | 2016-12-13 | 4.6 | CVE-2016-6449 BID CONFIRM |
| cisco -- unified_communications_manager_im_and_presence_service | A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to view information on web pages that should be restricted. More Information: CSCva49629. Known Affected Releases: 11.5(1). Known Fixed Releases: 11.5(1.12000.2) 12.0(0.98000.181). | 2016-12-13 | 5.0 | CVE-2016-6464 BID CONFIRM |
| cisco -- email_security_appliance | A vulnerability in the content filtering functionality of Cisco AsyncOS Software for Cisco Email Security Appliances and Cisco Web Security Appliances could allow an unauthenticated, remote attacker to bypass user filters that are configured for an affected device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for both virtual and hardware versions of the following Cisco products: Cisco Email Security Appliances (ESAs) that are configured to use message or content filters that scan incoming email attachments; Cisco Web Security Appliances (WSAs) that are configured to use services that scan accessed web content. More Information: CSCva90076, CSCvb06764. Known Affected Releases: 10.0.0-125 8.5.7-042 9.7.2-047. | 2016-12-13 | 4.3 | CVE-2016-6465 BID CONFIRM |
| cisco -- asr_5000_series_software | A vulnerability in IPv6 packet fragment reassembly of StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Switch could allow an unauthenticated, remote attacker to cause an unexpected reload of the Network Processing Unit (NPU) process. More Information: CSCva84552. Known Affected Releases: 20.0.0 21.0.0 21.0.M0.64702. Known Fixed Releases: 21.0.0 21.0.0.65256 21.0.M0.64970 21.0.V0.65150 21.1.A0.64973 21.1.PP0.65270 21.1.R0.65130 21.1.R0.65135 21.1.VC0.65203. | 2016-12-13 | 5.0 | CVE-2016-6467 BID CONFIRM |
| cisco -- emergency_responder | A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. More Information: CSCvb06663. Known Affected Releases: 11.5(1.10000.4). Known Fixed Releases: 12.0(0.98000.14). | 2016-12-13 | 6.8 | CVE-2016-6468 BID CONFIRM |
| cisco -- web_security_appliance | A vulnerability in HTTP URL parsing of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) vulnerability due to the proxy process unexpectedly restarting. More Information: CSCvb04312. Known Affected Releases: 9.0.1-162 9.1.1-074. Known Fixed Releases: 10.1.0-129 9.1.2-010. | 2016-12-13 | 5.0 | CVE-2016-6469 BID CONFIRM |
| cisco -- firesight_system | A vulnerability in the web-based management interface of Cisco Firepower Management Center running FireSIGHT System software could allow an authenticated, remote attacker to view the Remote Storage Password. More Information: CSCvb19366. Known Affected Releases: 5.4.1.6. | 2016-12-13 | 4.0 | CVE-2016-6471 BID CONFIRM |
| cisco -- ios | A vulnerability in Cisco IOS on Catalyst Switches and Nexus 9300 Series Switches could allow an unauthenticated, adjacent attacker to cause a Layer 2 network storm. More Information: CSCuu69332, CSCux07028. Known Affected Releases: 15.2(3)E. Known Fixed Releases: 12.2(50)SE4 12.2(50)SE5 12.2(50)SQ5 12.2(50)SQ6 12.2(50)SQ7 12.2(52)EY4 12.2(52)SE1 12.2(53)EX 12.2(53)SE 12.2(53)SE1 12.2(53)SE2 12.2(53)SG10 12.2(53)SG11 12.2(53)SG2 12.2(53)SG9 12.2(54)SG1 12.2(55)EX3 12.2(55)SE 12.2(55)SE1 12.2(55)SE10 12.2(55)SE2 12.2(55)SE3 12.2(55)SE4 12.2(55)SE5 12.2(55)SE6 12.2(55)SE7 12.2(55)SE8 12.2(55)SE9 12.2(58)EZ 12.2(58)SE1 12.2(58)SE2 12.2(60)EZ 12.2(60)EZ1 12.2(60)EZ2 12.2(60)EZ3 12.2(60)EZ4 12.2(60)EZ5 12.2(60)EZ6 12.2(60)EZ7 12.2(60)EZ8 15.0(1)EY2 15.0(1)SE 15.0(1)SE2 15.0(1)SE3 15.0(2)EA 15.0(2)EB 15.0(2)EC 15.0(2)ED 15.0(2)EH 15.0(2)EJ 15.0(2)EJ1 15.0(2)EK1 15.0(2)EX 15.0(2)EX1 15.0(2)EX3 15.0(2)EX4 15.0(2)EX5 15.0(2)EY 15.0(2)EY1 15.0(2)EY2 15.0(2)EZ 15.0(2)SE 15.0(2)SE1 15.0(2)SE2 15.0(2)SE3 15.0(2)SE4 15.0(2)SE5 15.0(2)SE6 15.0(2)SE7 15.0(2)SE9 15.0(2)SG10 15.0(2)SG3 15.0(2)SG6 15.0(2)SG7 15.0(2)SG8 15.0(2)SG9 15.0(2a)EX5 15.1(2)SG 15.1(2)SG1 15.1(2)SG2 15.1(2)SG3 15.1(2)SG4 15.1(2)SG5 15.1(2)SG6 15.2(1)E 15.2(1)E1 15.2(1)E2 15.2(1)E3 15.2(1)EY 15.2(2)E 15.2(2)E3 15.2(2b)E. | 2016-12-13 | 6.1 | CVE-2016-6473 BID CONFIRM |
| cisco -- ios | A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on an affected system. More Information: CSCuv89417. Known Affected Releases: 15.5(2.25)T. Known Fixed Releases: 15.2(4)E1 15.2(4)E2 15.2(4)E3 15.2(4)EA4 15.2(4.0r)EB 15.2(4.1.27)EB 15.2(4.4.2)EA4 15.2(4.7.1)EC 15.2(4.7.2)EC 15.2(5.1.1)E 15.2(5.5.63)E 15.2(5.5.64)E 15.4(1)IA1.80 15.5(3)M1.1 15.5(3)M2 15.5(3)S1.4 15.5(3)S2 15.6(0.22)S0.12 15.6(1)T0.1 15.6(1)T1 15.6(1.15)T 15.6(1.17)S0.7 15.6(1.17)SP 15.6(1.22.1a)T0 15.6(2)S 15.6(2)SP 16.1(1.24) 16.1.2 16.2(0.247) 16.3(0.11) 3.8(1)E Denali-16.1.2. | 2016-12-13 | 5.8 | CVE-2016-6474 BID CONFIRM |
| cisco -- firepower_management_center | A vulnerability in the malicious file detection and blocking features of Cisco Firepower Management Center and Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass malware detection mechanisms on an affected system. Affected Products: Cisco Firepower Management Center and FireSIGHT System Software are affected when they are configured to use a file policy that has the Block Malware action. More Information: CSCvb27494. Known Affected Releases: 6.0.1.1 6.1.0. | 2016-12-13 | 5.0 | CVE-2016-9193 BID CONFIRM |
| cisco -- identity_services_engine | A vulnerability in the Active Directory integration component of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform a denial of service (DoS) attack. More Information: CSCuw15041. Known Affected Releases: 1.2(1.199). | 2016-12-13 | 5.0 | CVE-2016-9198 BID CONFIRM |
| cisco -- iox | A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a targeted system. Affected Products: This vulnerability affects specific releases of the Cisco IOx subsystem of Cisco IOS and IOS XE Software. More Information: CSCvb23331. Known Affected Releases: 15.2(6.0.57i)E CAF-1.1.0.0. | 2016-12-13 | 6.8 | CVE-2016-9199 BID CONFIRM |
| cisco -- prime_collaboration_assurance | A vulnerability in the web framework code of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface. More Information: CSCut43268. Known Affected Releases: 10.5(1) 10.6. | 2016-12-13 | 4.3 | CVE-2016-9200 BID CONFIRM |
| cisco -- ios | A vulnerability in the Zone-Based Firewall feature of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to pass traffic that should otherwise have been dropped based on the configuration. More Information: CSCuz21015. Known Affected Releases: 15.3(3)M3. Known Fixed Releases: 15.6(2)T0.1 15.6(2.0.1a)T0 15.6(2.19)T 15.6(3)M. | 2016-12-13 | 5.0 | CVE-2016-9201 BID CONFIRM |
| cisco -- email_security_appliance | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) Switches could allow an unauthenticated, remote attacker to conduct a persistent cross-site scripting (XSS) attack against a user of the affected interface on an affected device. More Information: CSCvb37346. Known Affected Releases: 9.1.1-036 9.7.1-066. | 2016-12-13 | 4.3 | CVE-2016-9202 BID CONFIRM |
| cisco -- asr_5000_series_software | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco ASR 5000 Series Software could allow an unauthenticated, remote attacker to cause a reload of the ipsecmgr process. More Information: CSCvb38398. Known Affected Releases: 20.2.3 20.2.3.65026. Known Fixed Releases: 21.1.M0.65431 21.1.PP0.65733 21.1.R0.65467 21.1.R0.65496 21.1.VC0.65434 21.1.VC0.65489 21.2.A0.65437. | 2016-12-13 | 5.0 | CVE-2016-9203 BID CONFIRM |
| cisco -- nexus_1000v_intercloud_firmware | A vulnerability in the Cisco Intercloud Fabric (ICF) Director could allow an unauthenticated, remote attacker to connect to internal services with an internal account. Affected Products: Cisco Nexus 1000V InterCloud is affected. More Information: CSCus99379. Known Affected Releases: 2.2(1). | 2016-12-13 | 6.4 | CVE-2016-9204 BID CONFIRM |
| cisco -- ios_xr | A vulnerability in the HTTP 2.0 request handling code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash, resulting in a denial of service (DoS) condition. More Information: CSCvb14425. Known Affected Releases: 6.1.1.BASE. Known Fixed Releases: 6.1.2.6i.MGBL 6.1.22.9i.MGBL 6.2.1.14i.MGBL. | 2016-12-13 | 5.0 | CVE-2016-9205 BID CONFIRM |
| cisco -- unified_communications_manager | A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting (XSS) attacks. More Information: CSCvb64641. Known Affected Releases: 11.5(1.10000.6) 11.5(1.11007.2). Known Fixed Releases: 11.5(1.12900.7) 11.5(1.12900.8) 12.0(0.98000.155) 12.0(0.98000.178) 12.0(0.98000.366) 12.0(0.98000.468) 12.0(0.98000.536) 12.0(0.98500.6). | 2016-12-13 | 4.3 | CVE-2016-9206 BID CONFIRM |
| cisco -- expressway | A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitrary hosts. This does not allow for full traffic proxy through the Expressway. Affected Products: This vulnerability affects Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS). More Information: CSCvc10834. Known Affected Releases: X8.7.2 X8.8.3. Known Fixed Releases: X8.9. | 2016-12-13 | 6.4 | CVE-2016-9207 BID CONFIRM |
| cisco -- emergency_responder | A vulnerability in the File Management Utility, the Download File form, and the Serviceability application of Cisco Emergency Responder could allow an authenticated, remote attacker to access files in arbitrary locations on the file system of an affected device. More Information: CSCva98951 CSCva98954 CSCvb57494. Known Affected Releases: 11.5(2.10000.5). Known Fixed Releases: 12.0(0.98000.14) 12.0(0.98000.16). | 2016-12-13 | 4.0 | CVE-2016-9208 BID CONFIRM |
| cisco -- firepower_services_for_adaptive_security_appliance | A vulnerability in TCP processing in Cisco FirePOWER system software could allow an unauthenticated, remote attacker to download files that would normally be blocked. Affected Products: The following Cisco products are vulnerable: Adaptive Security Appliance (ASA) 5500-X Series with FirePOWER Services, Advanced Malware Protection (AMP) for Networks - 7000 Series Appliances, Advanced Malware Protection (AMP) for Networks - 8000 Series Appliances, FirePOWER 7000 Series Appliances, FirePOWER 8000 Series Appliances, FirePOWER Threat Defense for Integrated Services Routers (ISRs), Next Generation Intrusion Prevention System (NGIPS) for Blue Coat X-Series, Sourcefire 3D System Appliances, Virtual Next-Generation Intrusion Prevention System (NGIPSv) for VMware. More Information: CSCvb20102. Known Affected Releases: 2.9.7.10. | 2016-12-13 | 4.3 | CVE-2016-9209 BID CONFIRM |
| cisco -- unified_communications_manager | A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to modify arbitrary files on the file system. More Information: CSCvb61698. Known Affected Releases: 11.5(1.11007.2). Known Fixed Releases: 12.0(0.98000.168) 12.0(0.98000.178) 12.0(0.98000.399) 12.0(0.98000.510) 12.0(0.98000.536) 12.0(0.98500.7). | 2016-12-13 | 5.0 | CVE-2016-9210 BID CONFIRM |
| cisco -- ons_15454_sdh_multiservice_platform_software | A vulnerability in TCP port management in Cisco ONS 15454 Series Multiservice Provisioning Platforms could allow an unauthenticated, remote attacker to cause the controller card to unexpectedly reload. More Information: CSCuw26032. Known Affected Releases: 10.51. | 2016-12-13 | 5.0 | CVE-2016-9211 BID CONFIRM |
| cisco -- web_security_appliance | A vulnerability in the Decrypt for End-User Notification configuration parameter of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to connect to a secure website over Secure Sockets Layer (SSL) or Transport Layer Security (TLS), even if the WSA is configured to block connections to the website. Affected Products: This vulnerability affects Cisco Web Security Appliances if the HTTPS decryption options are enabled and configured for the device to block connections to certain websites. More Information: CSCvb49012. Known Affected Releases: 9.0.1-162 9.1.1-074. | 2016-12-13 | 5.0 | CVE-2016-9212 BID CONFIRM |
| cisco -- identity_services_engine_software | Cisco Identity Services Engine (ISE) contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvb86332 CSCvb86760. Known Affected Releases: 2.0(101.130). | 2016-12-13 | 4.3 | CVE-2016-9214 BID CONFIRM |
| debian -- debian_linux | The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits. | 2016-12-13 | 5.0 | CVE-2016-6313 DEBIAN DEBIAN BID UBUNTU UBUNTU CONFIRM MLIST |
| djangoproject -- django | Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS. | 2016-12-09 | 6.8 | CVE-2016-9014 BID SECTRACK UBUNTU FEDORA FEDORA CONFIRM |
| dotclear -- dotclear | Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) link_type parameter to admin/media.php. | 2016-12-09 | 4.3 | CVE-2016-6523 MLIST MLIST BID CONFIRM CONFIRM |
| fedoraproject -- fedora | Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or infinite loop) via vectors involving length fields. | 2016-12-13 | 5.0 | CVE-2016-7945 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields. | 2016-12-13 | 5.0 | CVE-2016-7946 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| fedoraproject -- fedora | X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, (2) XRecordEndOfData, or (3) XRecordClientDied category without a client sequence and with attached data. | 2016-12-13 | 5.0 | CVE-2016-7952 MLIST MLIST BID SECTRACK CONFIRM FEDORA FEDORA MLIST |
| gnu -- tar | Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. | 2016-12-09 | 5.0 | CVE-2016-6321 CONFIRM MLIST MISC FULLDISC FULLDISC BID MISC |
| google -- android | An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-29422020. | 2016-12-13 | 4.3 | CVE-2016-6720 BID CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| google -- android | An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Android ID: A-31091777. | 2016-12-13 | 4.3 | CVE-2016-6722 BID CONFIRM CONFIRM |
| ibm -- powerkvm | Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis. | 2016-12-13 | 6.4 | CVE-2015-5073 CONFIRM CONFIRM CONFIRM MLIST MLIST BID SECTRACK CONFIRM |
| imagemagick -- imagemagick | Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image. | 2016-12-13 | 6.8 | CVE-2016-6491 MLIST MLIST CONFIRM BID SECTRACK CONFIRM CONFIRM |
| imagemagick -- imagemagick | Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology. | 2016-12-13 | 6.4 | CVE-2016-6520 CONFIRM MLIST MLIST SECTRACK CONFIRM |
| joomla -- joomla! | An issue was discovered in templates/beez3/html/com_content/article/default.php in Joomla! before 3.6.5. Inadequate permissions checks in the Beez3 layout override of the com_content article view allow users to view articles that should not be publicly accessible, as demonstrated by an index.php?option=com_content&view=article&id=1&template=beez3 request. | 2016-12-16 | 5.0 | CVE-2016-9837 CONFIRM |
| joomla -- joomla! | An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and password, as demonstrated by submitting a form that targets the `registration.register` task. | 2016-12-16 | 5.0 | CVE-2016-9838 CONFIRM |
| joyent -- smartos | An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-8733. | 2016-12-14 | 6.9 | CVE-2016-9031 MISC |
| joyent -- smartos | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9034. | 2016-12-14 | 6.9 | CVE-2016-9032 MISC |
| joyent -- smartos | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9035. | 2016-12-14 | 6.9 | CVE-2016-9033 MISC |
| joyent -- smartos | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with 32-bit file systems. An attacker can craft an input that can cause a buffer overflow in the nm variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9032. | 2016-12-14 | 6.9 | CVE-2016-9034 MISC |
| joyent -- smartos | An exploitable buffer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer overflow in the path variable leading to an out of bounds memory access and could result in potential privilege escalation. This vulnerability is distinct from CVE-2016-9033. | 2016-12-14 | 6.9 | CVE-2016-9035 MISC |
| naver -- ngrinder | Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) description, (2) email, or (3) username parameter to user/save. | 2016-12-13 | 4.3 | CVE-2016-5060 MISC FULLDISC CONFIRM CONFIRM |
| open-xchange -- ox_guard | An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader. | 2016-12-15 | 4.0 | CVE-2015-8542 CONFIRM CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange Server 6 / OX AppSuite before 7.8.0-rev26. The "session" parameter for file-download requests can be used to inject script code that gets reflected through the subsequent status page. Malicious script code can be executed within a trusted domain's context. While no OX App Suite specific data can be manipulated, the vulnerability can be exploited without being authenticated and therefore used for social engineering attacks, stealing cookies or redirecting from trustworthy to malicious hosts. | 2016-12-15 | 4.3 | CVE-2016-2840 CONFIRM CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The "defer" servlet offers to redirect a client to a specified URL. Since some checks were missing, arbitrary URLs could be provided as redirection target. Users can be tricked to follow a link to a trustworthy domain but end up at an unexpected service later on. This vulnerability can be used to prepare and enhance phishing attacks. | 2016-12-15 | 4.3 | CVE-2016-3174 CONFIRM CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicious content in case invalid HTML code is provided. In such cases the filter will output a unsanitized representation of the content. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Attackers can use this issue for filter evasion to inject script code later on. | 2016-12-15 | 4.3 | CVE-2016-4026 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Script code can be embedded to RSS feeds using a URL notation. In case a user clicks the corresponding link at the RSS reader of App Suite, code gets executed at the context of the user. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). The attacker needs to reside within the same context to make this attack work. | 2016-12-15 | 4.3 | CVE-2016-4045 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The API to configure external mail accounts can be abused to map and access network components within the trust boundary of the operator. Users can inject arbitrary hosts and ports to API calls. Depending on the response type, content and latency, information about existence of hosts and services can be gathered. Attackers can get internal configuration information about the infrastructure of an operator to prepare subsequent attacks. | 2016-12-15 | 5.0 | CVE-2016-4046 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev8. References to external Open XML document type definitions (.dtd resources) can be placed within .docx and .xslx files. Those resources were requested when parsing certain parts of the generated document. As a result an attacker can track access to a manipulated document. Usage of a document may get tracked and information about internal infrastructure may get exposed. | 2016-12-15 | 4.0 | CVE-2016-4047 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected by third parties as part of social engineering attacks. | 2016-12-15 | 4.3 | CVE-2016-4048 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially crafted website and add it to HTML editor areas of OX App Suite, for example E-Mail Compose or OX Text. This specific attack circumvents typical XSS filters and detection mechanisms since the code is not loaded from an external service but injected locally. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). To exploit this vulnerability, a attacker needs to convince a user to follow specific steps (social-engineering). | 2016-12-15 | 4.3 | CVE-2016-5124 CONFIRM CONFIRM BID SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev5. JavaScript code can be used as part of ical attachments within scheduling E-Mails. This content, for example an appointment's location, will be presented to the user at the E-Mail App, depending on the invitation workflow. This code gets executed within the context of the user's current session. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-5740 CONFIRM CONFIRM BID EXPLOIT-DB |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Setting the user's name to JS code makes that code execute when selecting that user's "Templates" folder from OX Documents settings. This requires the folder to be shared to the victim. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6842 BID CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code can be injected to contact names. When adding those contacts to a group, the script code gets executed in the context of the user which creates or changes the group by using autocomplete. In most cases this is a user with elevated permissions. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6843 BID CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within SVG files is maintained when opening such files "in browser" based on our Mail or Drive app. In case of "a" tags, this may include link targets with base64 encoded "data" references. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6844 BID CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when using base64 encoded "data" resources. This allows an attacker to provide hyperlinks that may execute script code instead of directing to a proper location. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6845 BID CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as mp3 album covers. In case their XML structure contains script code, that code may get executed when calling the related cover URL. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6847 BID CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6850 BID CONFIRM |
| open-xchange -- ox_guard | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already. | 2016-12-15 | 4.3 | CVE-2016-6851 CONFIRM CONFIRM BID EXPLOIT-DB |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give hints about whether the provided file exists or not. Attackers may discover specific system files or library versions on the middleware server to prepare further attacks. | 2016-12-15 | 4.3 | CVE-2016-6852 BID CONFIRM |
| open-xchange -- ox_guard | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites, users might get lured into a phishing scheme. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6853 CONFIRM CONFIRM BID EXPLOIT-DB |
| open-xchange -- ox_guard | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). | 2016-12-15 | 4.3 | CVE-2016-6854 CONFIRM CONFIRM BID EXPLOIT-DB |
| oracle -- solaris | The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter. | 2016-12-09 | 6.8 | CVE-2015-8786 CONFIRM BID CONFIRM CONFIRM |
| oracle -- solaris | The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions. | 2016-12-13 | 6.8 | CVE-2016-5688 MLIST MLIST CONFIRM BID MISC CONFIRM CONFIRM CONFIRM CONFIRM |
| oracle -- solaris | MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the q variable, which triggers an out-of-bounds read. | 2016-12-13 | 5.0 | CVE-2016-5842 MLIST MLIST CONFIRM BID CONFIRM CONFIRM |
| pcre -- pcre | PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/. | 2016-12-13 | 5.0 | CVE-2015-3217 CONFIRM CONFIRM MLIST BID CONFIRM CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 5.0 | CVE-2016-6606 BID CONFIRM |
| phpmyadmin -- phpmyadmin | XSS issues were discovered in phpMyAdmin. This affects Zoom search (specially crafted column content can be used to trigger an XSS attack); GIS editor (certain fields in the graphical GIS editor are not properly escaped and can be used to trigger an XSS attack); Relation view; the following Transformations: Formatted, Imagelink, JPEG: Upload, RegexValidation, JPEG inline, PNG inline, and transformation wrapper; XML export; MediaWiki export; Designer; When the MySQL server is running with a specially-crafted log_bin directive; Database tab; Replication feature; and Database search. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.3 | CVE-2016-6607 BID CONFIRM |
| phpmyadmin -- phpmyadmin | XSS issues were discovered in phpMyAdmin. This affects the database privilege check and the "Remove partitioning" functionality. Specially crafted database names can trigger the XSS attack. All 4.6.x versions (prior to 4.6.4) are affected. | 2016-12-10 | 4.3 | CVE-2016-6608 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 6.5 | CVE-2016-6609 BID CONFIRM |
| phpmyadmin -- phpmyadmin | A full path disclosure vulnerability was discovered in phpMyAdmin where a user can trigger a particular error in the export mechanism to discover the full path of phpMyAdmin on the disk. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6610 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 5.1 | CVE-2016-6611 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6612 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.3 | CVE-2016-6614 BID CONFIRM |
| phpmyadmin -- phpmyadmin | XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the "Tracking" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected. | 2016-12-10 | 4.3 | CVE-2016-6615 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. In the "User group" and "Designer" features, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected. | 2016-12-10 | 6.8 | CVE-2016-6616 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A specially crafted database and/or table name can be used to trigger an SQL injection attack through the export functionality. All 4.6.x versions (prior to 4.6.4) are affected. | 2016-12-10 | 6.8 | CVE-2016-6617 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. The transformation feature allows a user to trigger a denial-of-service (DoS) attack against the server. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6618 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. In the user interface preference feature, a user can execute an SQL injection attack against the account of the control user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 6.5 | CVE-2016-6619 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.3 | CVE-2016-6622 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6623 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin involving improper enforcement of the IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy server environment, and the proxy server is in the allowed range but the attacking computer is not allowed, this vulnerability can allow the attacking computer to connect despite the IP rules. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.3 | CVE-2016-6624 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An attacker can determine whether a user is logged in to phpMyAdmin. The user's session, username, and password are not compromised by this vulnerability. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6625 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An attacker could redirect a user to a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 5.8 | CVE-2016-6626 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An attacker can determine the phpMyAdmin host location through the file url.php. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 5.0 | CVE-2016-6627 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An attacker may be able to trigger a user to download a specially crafted malicious SVG file. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 6.8 | CVE-2016-6628 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An authenticated user can trigger a denial-of-service (DoS) attack by entering a very long password at the change password dialog. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.0 | CVE-2016-6630 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin where, under certain conditions, phpMyAdmin may not delete temporary files during the import of ESRI files. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 4.3 | CVE-2016-6632 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 6.8 | CVE-2016-6633 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9847 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. phpinfo (phpinfo.php) shows PHP information including values of HttpOnly cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9848 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. Username matching for the allow/deny rules may result in wrong matches and detection of the username in the rule due to non-constant execution time. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9850 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to bypass the logout timeout. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. | 2016-12-10 | 5.0 | CVE-2016-9851 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the curl wrapper issue. | 2016-12-10 | 5.0 | CVE-2016-9852 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue. | 2016-12-10 | 5.0 | CVE-2016-9853 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the json_decode issue. | 2016-12-10 | 5.0 | CVE-2016-9854 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the PMA_shutdownDuringExport issue. | 2016-12-10 | 5.0 | CVE-2016-9855 CONFIRM |
| phpmyadmin -- phpmyadmin | An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 4.3 | CVE-2016-9856 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 4.3 | CVE-2016-9857 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in saved searches feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9858 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a crafted request parameter value it is possible to initiate a denial of service attack in import feature. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9859 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. An unauthenticated user can execute a denial of service attack when phpMyAdmin is running with $cfg['AllowArbitraryServer']=true. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 4.3 | CVE-2016-9860 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. Due to the limitation in URL matching, it was possible to bypass the URL white-list protection. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 5.0 | CVE-2016-9861 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a crafted login request it is possible to inject BBCode in the login page. All 4.6.x versions (prior to 4.6.5) are affected. | 2016-12-10 | 5.0 | CVE-2016-9862 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected. | 2016-12-10 | 5.0 | CVE-2016-9863 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. With a crafted username or a table name, it was possible to inject SQL statements in the tracking functionality that would run with the privileges of the control user. This gives read and write access to the tables of the configuration storage database, and if the control user has the necessary privileges, read access to some tables of the MySQL database. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 6.0 | CVE-2016-9864 CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected. | 2016-12-10 | 6.8 | CVE-2016-9866 CONFIRM |
| postgresql -- postgresql | PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types. | 2016-12-09 | 6.5 | CVE-2016-5423 DEBIAN BID SECTRACK CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| postgresql -- postgresql | PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges via a (1) " (double quote), (2) \ (backslash), (3) carriage return, or (4) newline character in a (a) database or (b) role name that is mishandled during an administrative operation. | 2016-12-09 | 4.6 | CVE-2016-5424 DEBIAN BID SECTRACK CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM |
| pwc -- ace-advanced_business_application_programming | PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS, as demonstrated by WEBGUI or Report. | 2016-12-09 | 6.5 | CVE-2016-9832 MISC BID |
| qemu -- qemu | The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state. | 2016-12-09 | 4.9 | CVE-2016-4964 CONFIRM MLIST MLIST MLIST |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. The feed_table_tag function in w3m doesn't properly validate the value of table span, which allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9422 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9423 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service (heap buffer overflow crash) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9424 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9425 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code due to bdwgc's bug (CVE-2016-9427) via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9426 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9428 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Buffer overflow in the formUpdateBuffer function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page. | 2016-12-11 | 6.8 | CVE-2016-9429 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9430 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9431 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (memory corruption, segmentation fault, and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9432 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (out-of-bounds array access) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9433 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9434 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) and possibly memory corruption via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9437 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9438 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9439 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9440 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9441 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause memory corruption in certain conditions via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9442 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9443 MLIST BID CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9622 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9623 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9624 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9625 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. Infinite recursion vulnerability in w3m allows remote attackers to cause a denial of service via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9626 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (heap buffer overflow and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9627 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9628 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9629 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9630 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9631 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (global buffer overflow and crash) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9632 MLIST CONFIRM CONFIRM |
| w3m_project -- w3m | An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-33. w3m allows remote attackers to cause a denial of service (infinite loop and resource consumption) via a crafted HTML page. | 2016-12-11 | 4.3 | CVE-2016-9633 MLIST CONFIRM CONFIRM |
| x.org -- xorg-server | The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial of service (divide-by-zero and crash) via a zero-height PutImage request. | 2016-12-13 | 5.0 | CVE-2015-3418 BID CONFIRM MLIST |
Low Vulnerabilities
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| mariadb -- mariadb | The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover AES keys by leveraging cache-bank timing differences. | 2016-12-13 | 2.1 | CVE-2016-7440 CONFIRM BID CONFIRM CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX AppSuite before 7.8.0-rev27. The aria-label parameter of tiles at the Portal can be used to inject script code. Those labels use the name of the file (e.g. an image) which gets displayed at the portal application. Using script code at the file name leads to script execution. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). Users actively need to add a file to the portal to enable this attack. In case of shared files however, a internal attacker may modify a previously embedded file to carry a malicious file name. Furthermore this vulnerability can be used to persistently execute code that got injected by a temporary script execution vulnerability. | 2016-12-15 | 3.5 | CVE-2016-3173 CONFIRM CONFIRM |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store cookies that exceed the session duration. This functionality is useful when logging in from clients with reduced privileges or shared environments. However the setting was incorrectly recognized and cookies were stored regardless of this setting when the login was performed using a non-interactive login method. In case the setting was enforced by middleware configuration or the user went through the interactive login page, the workflow was correct. Cookies with authentication information may become available to other users on shared environments. In case the user did not properly log out from the session, third parties with access to the same client can access a user's account. | 2016-12-15 | 3.5 | CVE-2016-4027 CONFIRM CONFIRM SECTRACK |
| open-xchange -- ox_guard | An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest users credentials. The OX Guard API acts as a padding oracle by responding with different error codes depending on whether the provided token matches the encryption padding. In combination with AES-CBC, this allows attackers to guess the correct padding. Attackers may run brute-forcing attacks on the content of the guest authentication token and discover user credentials. For a practical attack vector, the guest users needs to have logged in, the content of the guest user's "OxReaderID" cookie and the value of the "auth" parameter needs to be known to the attacker. | 2016-12-15 | 3.5 | CVE-2016-4028 CONFIRM SECTRACK |
| open-xchange -- open-xchange_appsuite | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution. | 2016-12-15 | 1.9 | CVE-2016-6848 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected. | 2016-12-10 | 3.6 | CVE-2016-4412 BID CONFIRM |
| phpmyadmin -- phpmyadmin | An issue was discovered in phpMyAdmin. A user can specially craft a symlink on disk, to a file which phpMyAdmin is permitted to read but the user is not, which phpMyAdmin will then expose to the user. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected. | 2016-12-10 | 2.1 | CVE-2016-6613 BID CONFIRM |
| qemu -- qemu | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the descriptor buffer. | 2016-12-09 | 2.1 | CVE-2016-6490 CONFIRM MLIST MLIST MLIST |
| qemu -- qemu | Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active. | 2016-12-09 | 2.1 | CVE-2016-6833 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The net_tx_pkt_do_sw_fragmentation function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a zero length for the current fragment length. | 2016-12-09 | 2.1 | CVE-2016-6834 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (buffer over-read) by leveraging failure to check IP header length. | 2016-12-09 | 2.1 | CVE-2016-6835 CONFIRM MLIST MLIST MLIST |
| qemu -- qemu | The vmxnet3_complete_packet function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host memory information by leveraging failure to initialize the txcq_descr object. | 2016-12-09 | 2.1 | CVE-2016-6836 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference. | 2016-12-09 | 2.1 | CVE-2016-6888 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string. | 2016-12-09 | 2.1 | CVE-2016-7116 CONFIRM MLIST MLIST BID MLIST MLIST |
| qemu -- qemu | hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds access or infinite loop, and QEMU process crash) via a crafted page count for descriptor rings. | 2016-12-09 | 2.1 | CVE-2016-7155 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast. | 2016-12-09 | 2.1 | CVE-2016-7156 CONFIRM MLIST MLIST BID MLIST MLIST |
| qemu -- qemu | The (1) mptsas_config_manufacturing_1 and (2) mptsas_config_ioc_0 functions in hw/scsi/mptconfig.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via vectors involving MPTSAS_CONFIG_PACK. | 2016-12-09 | 2.1 | CVE-2016-7157 CONFIRM MLIST MLIST BID MLIST MLIST |
| qemu -- qemu | The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to cursor.mask[] and cursor.image[] array sizes when processing a DEFINE_CURSOR svga command. | 2016-12-09 | 2.1 | CVE-2016-7170 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The pvscsi_ring_pop_req_descr function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit process IO loop to the ring size. | 2016-12-09 | 2.1 | CVE-2016-7421 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via a large I/O descriptor buffer length value. | 2016-12-09 | 2.1 | CVE-2016-7422 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device. | 2016-12-09 | 2.1 | CVE-2016-7466 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands. | 2016-12-09 | 2.1 | CVE-2016-7994 MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes. | 2016-12-09 | 2.1 | CVE-2016-7995 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device. | 2016-12-09 | 2.1 | CVE-2016-9101 MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a large number of Txattrcreate messages with the same fid number. | 2016-12-09 | 2.1 | CVE-2016-9102 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host heap memory information by reading xattribute values before writing to them. | 2016-12-09 | 2.1 | CVE-2016-9103 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU process crash) via a crafted offset, which triggers an out-of-bounds access. | 2016-12-09 | 2.1 | CVE-2016-9104 MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the v9fs_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors involving a reference to the source fid object. | 2016-12-09 | 2.1 | CVE-2016-9105 CONFIRM MLIST MLIST BID MLIST |
| qemu -- qemu | Memory leak in the v9fs_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) by leveraging failure to free an IO vector. | 2016-12-09 | 2.1 | CVE-2016-9106 CONFIRM MLIST MLIST BID MLIST |
| redhat -- enterprise_virtualization | Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file. | 2016-12-14 | 2.1 | CVE-2016-4443 REDHAT BID SECTRACK CONFIRM |
| sap -- download_manager | SAP Download Manager 2.1.142 and earlier uses a hardcoded encryption key to protect stored data, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of this key, aka SAP Security Note 2282338. | 2016-12-14 | 1.9 | CVE-2016-3684 MISC FULLDISC MISC BUGTRAQ |
| sap -- download_manager | SAP Download Manager 2.1.142 and earlier generates an encryption key from a small key space on Windows and Mac systems, which allows context-dependent attackers to obtain sensitive configuration information by leveraging knowledge of a hardcoded key in the program code and a computer BIOS serial number, aka SAP Security Note 2282338. | 2016-12-14 | 1.9 | CVE-2016-3685 MISC FULLDISC MISC BUGTRAQ |
| wolfssl -- wolfssl | The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences. | 2016-12-13 | 2.1 | CVE-2016-7438 CONFIRM |
| wolfssl -- wolfssl | The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leveraging cache-bank hit differences. | 2016-12-13 | 2.1 | CVE-2016-7439 CONFIRM |
Severity Not Yet Assigned
| Primary Vendor -- Product | Description | Published | CVSS Score | Source & Patch Info |
|---|---|---|---|---|
| apport -- apport | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK. | 2016-12-16 | not yet calculated | CVE-2016-9951 MISC MISC MISC |
| apport -- apport | An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code. | 2016-12-16 | not yet calculated | CVE-2016-9949 MISC MISC MISC |
| apport -- apport | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system. | 2016-12-16 | not yet calculated | CVE-2016-9950 MISC MISC MISC |
| asterisk -- open_source | An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you. | 2016-12-12 | not yet calculated | CVE-2016-9938 CONFIRM BID |
| asterisk -- open_source | An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs. | 2016-12-12 | not yet calculated | CVE-2016-9937 CONFIRM CONFIRM CONFIRM BID CONFIRM |
| blackberry -- good_enterprise_mobility_server | A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell. | 2016-12-16 | not yet calculated | CVE-2016-3129 CONFIRM |
| google -- chrome | A heap use after free in PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android allows a remote attacker to potentially exploit heap corruption via crafted PDF files. | 2016-12-17 | not yet calculated | CVE-2016-5183 CONFIRM CONFIRM CONFIRM |
| google -- chrome | Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5192 CONFIRM CONFIRM |
| google -- chrome | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5182 CONFIRM CONFIRM |
| google -- chrome | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(), which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5185 CONFIRM CONFIRM |
| google -- chrome | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5181 CONFIRM CONFIRM CONFIRM |
| google -- chrome | Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL. | 2016-12-17 | not yet calculated | CVE-2016-5191 CONFIRM CONFIRM CONFIRM |
| google -- chrome | Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files. | 2016-12-17 | not yet calculated | CVE-2016-5186 CONFIRM CONFIRM |
| google -- chrome | Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5193 CONFIRM CONFIRM |
| google -- chrome | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5190 CONFIRM CONFIRM |
| google -- chrome | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5189 CONFIRM CONFIRM |
| google -- chrome | Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5187 CONFIRM CONFIRM |
| google -- chrome | Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. | 2016-12-17 | not yet calculated | CVE-2016-5188 CONFIRM CONFIRM |
| google -- chrome | PDFium in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles in CFFL_FormFillter::KillFocusForAnnot, which allowed a remote attacker to potentially exploit heap corruption via crafted PDF files. | 2016-12-17 | not yet calculated | CVE-2016-5184 CONFIRM CONFIRM |
| intel -- graphics_driver | The igdkmd64 module in the Intel Graphics Driver through 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Windows allows local users to cause a denial of service (crash) or gain privileges via a crafted D3DKMTEscape request. | 2016-12-13 | not yet calculated | CVE-2016-5647 BID MISC CONFIRM CONFIRM |
| netgear -- r6250 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly other routers allow remote attackers to execute arbitrary commands via shell metacharacters in the path info to cgi-bin/. | 2016-12-14 | not yet calculated | CVE-2016-6277 CONFIRM MISC MISC EXPLOIT-DB CERT-VN |
| nvidia -- geforce_experience_3 | NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks proper access control and parameter validation, allowing for information disclosure via a directory traversal attack. | 2016-12-16 | not yet calculated | CVE-2016-8827 CONFIRM |
| nvidia -- gpu_display_driver | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service. | 2016-12-16 | not yet calculated | CVE-2016-8826 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a pointer passed from a user to the driver is used without validation, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8818 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x600000E, 0x600000F, and 0x6000010 where a value passed from a user to the driver is used without validation as the index to an internal array, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8822 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure. | 2016-12-16 | not yet calculated | CVE-2016-8820 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the index to an array, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8815 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the index to an array, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8816 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a value passed from a user to the driver is used without validation as the size input to memcpy(), causing a buffer overflow, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8817 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where improper access controls allow a regular user to write a part of the registry intended for privileged users only, leading to escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8824 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple pointers are used without checking for NULL, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8813 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where multiple pointers are used without checking for NULL, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8814 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8825 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a handle to a kernel object may be returned to the user, leading to possible denial of service or escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8819 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where improper access controls may allow a user to access arbitrary physical memory, leading to an escalation of privileges. | 2016-12-16 | not yet calculated | CVE-2016-8821 CONFIRM |
| nvidia -- windows_gpu_display_driver | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated leading to a denial of service or possible escalation of privileges | 2016-12-16 | not yet calculated | CVE-2016-8823 CONFIRM |
| oracle -- mysql | mysqld_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17, when using file-based logging, allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files. | 2016-12-13 | not yet calculated | CVE-2016-6664 MISC MISC FULLDISC CONFIRM BID EXPLOIT-DB CONFIRM |
| oracle -- mysql | Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52 and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table. | 2016-12-13 | not yet calculated | CVE-2016-6663 FULLDISC MLIST CONFIRM BID BID CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM CONFIRM MISC CONFIRM CONFIRM CONFIRM EXPLOIT-DB CONFIRM |
| pivotal -- cloud_foundry_elastic_runtime | An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later. | 2016-12-16 | not yet calculated | CVE-2016-6657 CONFIRM |
| pivotal -- greenplum | An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table. | 2016-12-16 | not yet calculated | CVE-2016-6656 CONFIRM |
| siemens -- simatic_s7-300 | A vulnerability in SIEMENS SIMATIC S7-300 PN CPUs (all versions including V3.2.12) and SIMATIC S7-400 PN CPUs (all versions including V7) could allow a remote attacker to obtain credentials from the PLC if protection-level 2 is configured on the affected devices. | 2016-12-16 | not yet calculated | CVE-2016-9159 CONFIRM |
| siemens -- simatic_s7-300 | A vulnerability in SIEMENS SIMATIC S7-300 PN CPUs (all versions including V3.2.12) and SIMATIC S7-400 PN CPUs (V6 and V7) could allow a remote attacker to cause a Denial of Service condition by sending specially crafted packets to port 80/TCP. | 2016-12-16 | not yet calculated | CVE-2016-9158 CONFIRM |
| siemens -- simatic_wincc | A vulnerability in SIEMENS SIMATIC WinCC (All versions < SIMATIC WinCC V7.2) and SIEMENS SIMATIC PCS 7 (All versions < SIMATIC PCS 7 V8.0 SP1) could allow a remote attacker to crash an ActiveX component or leak parts of the application memory if a user is tricked into clicking on a malicious link under certain conditions. | 2016-12-16 | not yet calculated | CVE-2016-9160 CONFIRM |
| sisco -- snaplite | The SNAP Lite component in certain SISCO MMS-EASE and AX-S4 ICCP products allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet. | 2016-12-15 | not yet calculated | CVE-2015-6574 MISC CONFIRM |
| spip -- spip_3.1 | SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL. | 2016-12-16 | not yet calculated | CVE-2016-9998 CONFIRM |
| spip -- spip_3.1 | SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL. | 2016-12-16 | not yet calculated | CVE-2016-9997 CONFIRM |
| technicolor -- tc_dpc3914t | CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST allows an attacker to change the Wi-Fi password, open the remote management interface, or reset the router. | 2016-12-16 | not yet calculated | CVE-2016-7454 MISC |
| xrdp -- xrdp | An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key. | 2016-12-16 | not yet calculated | CVE-2013-1430 CONFIRM CONFIRM |
Please share your thoughts
We recently updated our anonymous product survey; we’d welcome your feedback.