Skip to content
OpenAdvisories

Archive

February 2016

Vulnerabilities first published in this month (UTC), newest first.

← January 2016 2016 / February March 2016 →
  1. 121
  2. 2 
  3. 312
  4. 42
  5. 52
  6. 66
  7. 720
  8. 827
  9. 94
  10. 1071
  11. 111
  12. 1214
  13. 1314
  14. 146
  15. 1530
  16. 1613
  17. 1727
  18. 1814
  19. 196
  20. 209
  21. 214
  22. 2227
  23. 236
  24. 243
  25. 257
  26. 262
  27. 278
  28. 2812
  29. 2912
All Critical High Medium Low Exploited only Public exploit

380 results · Feed

  • Unscored —
    CVE-2016-2397

    The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 all…

  • Unscored —
    CVE-2015-7795

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2015-7796

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2015-7797

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2015-7798

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2015-8484

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions v…

  • Unscored —
    CVE-2015-8487

    Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different v…

  • Unscored —
    CVE-2015-8486

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read ar…

  • Unscored —
    CVE-2015-8489

    customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessi…

  • Unscored —
    CVE-2015-8483

    Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitra…

  • Unscored —
    CVE-2015-8488

    Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerabilit…

  • Unscored —
    CVE-2015-8485

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read ar…

  • Unscored —
    CVE-2016-1150

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2016-1152

    Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read o…

  • Unscored —
    CVE-2016-1153

    customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unsp…

  • Unscored —
    CVE-2016-1149

    Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitr…

  • Unscored —
    CVE-2016-1151

    Multiple cross-site request forgery (CSRF) vulnerabilities in Cybozu Office 9.9.0 through 10.3.0 allow remote attackers…

  • Unscored —
    CVE-2016-2389 Public exploit Scanner template EPSS 41%

    Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xM…

  • Critical 9.8
    CVE-2016-2386 Exploited Public exploit EPSS 72%

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arb…

    KEV Jun 9, 2022
  • Medium 5.3
    CVE-2016-2388 Exploited Public exploit EPSS 52%

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user info…

    KEV Jun 9, 2022
  • Unscored —
    CVE-2016-2387

    Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 …

  • Low 3.7
    CVE-2015-7576

    actionpack is vulnerable to remote bypass authentication

    The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, a…

    rails actionpack Debian RubyGems
  • Medium 6.1
    CVE-2015-7578

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 6.1
    CVE-2015-7579

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • High 7.5
    CVE-2015-7581

    actionpack is vulnerable to denial of service because of a wildcard controller route

    actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application'…

    rails actionpack Debian RubyGems
  • Medium 5.3
    CVE-2015-7577

    Active Record Improper Access Control

    activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, wh…

    rails activerecord Debian RubyGems
  • Medium 6.1
    CVE-2015-7580

    rails-html-sanitizer Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

    rails-html-sanitizer ruby-rails-html-sanitizer Debian RubyGems
  • Medium 5.3
    CVE-2016-0753

    activemodel contains Improper Input Validation

    Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

    rails activemodel Debian RubyGems
  • High 7.5
    CVE-2016-0752 Exploited Public exploit EPSS 96%

    Directory traversal vulnerability in Action View in Ruby on Rails

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted …

    rails actionpack actionview Debian RubyGems
    KEV Mar 25, 2022
  • High 7.5
    CVE-2016-0751

    actionpack is vulnerable to denial of service via a crafted HTTP Accept header

    actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote at…

    rails actionpack Debian RubyGems
  • Unscored —
    CVE-2016-0231

    IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 bef…

  • Unscored —
    CVE-2016-0232

    IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 bef…

  • Unscored —
    CVE-2016-1321

    Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, wh…

  • Unscored —
    CVE-2016-1331

    Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 11.5(0.99833.5) allow remote attackers…

  • Unscored —
    CVE-2016-1330

    Cisco IOS 15.2(4)E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service (device rel…

  • Unscored —
    CVE-2016-0747

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remot…

    nginx nginx Debian Ubuntu
  • Unscored —
    CVE-2016-0746

    Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attack…

    nginx nginx Debian Ubuntu
  • Unscored —
    CVE-2016-0742 EPSS 82%

    The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invali…

    nginx nginx Debian Ubuntu
  • Unscored —
    CVE-2015-7398

    Cross-site scripting (XSS) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x an…

  • Unscored —
    CVE-2015-7408

    The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does no…