Skip to content
OpenAdvisories

Archive

7 April 2016

Vulnerabilities first published on this day (UTC), newest first.

← March 2016 2016 / April /7 May 2016 →
  1. 16
  2. 2 
  3. 3 
  4. 46
  5. 56
  6. 622
  7. 736
  8. 831
  9. 923
  10. 10 
  11. 1140
  12. 1275
  13. 1354
  14. 1421
  15. 1519
  16. 162
  17. 17 
  18. 1855
  19. 1914
  20. 2010
  21. 21118
  22. 2229
  23. 23 
  24. 24 
  25. 2529
  26. 265
  27. 2728
  28. 285
  29. 29 
  30. 3019
All Critical High Medium Low Exploited only Public exploit

36 results · Feed

  • Critical 9.8
    CVE-2016-0791

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.3
    CVE-2016-0790

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

    org.jenkins-ci.main:jenkins-core Maven
  • High 8.8
    CVE-2016-0792 Public exploit EPSS 83%

    Jenkins allows Deserialization of Untrusted Data via an XML File

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.1
    CVE-2016-0789

    Jenkins has CRLF Injection Vulnerability in the CLI

    CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Critical 9.8
    CVE-2016-0788 EPSS 12%

    Jenkins allows Execution of Code by Opening a JRMP Listener

    The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

    org.jenkins-ci.main:jenkins-core Maven
  • Unscored —
    CVE-2016-1531 Public exploit

    Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

    exim4 exim4 Debian Ubuntu
  • High 7.5
    CVE-2016-3976 Exploited Public exploit EPSS 47%

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fi…

    KEV Nov 3, 2021
  • Medium 5.3
    CVE-2016-2097

    actionview contains Path Traversal vulnerability

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pa…

    rails actionpack actionview Debian RubyGems
  • Unscored —
    CVE-2016-2563 Public exploit EPSS 33%

    Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows …

    putty Debian
  • Unscored —
    CVE-2016-2851 Public exploit EPSS 24%

    Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of ser…

    libotr libotr Debian Ubuntu
  • High 7.3
    CVE-2016-2098 Public exploit EPSS 81%

    actionpack allows remote code execution via application's unrestricted use of render method

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

    rails actionpack Debian RubyGems
  • Unscored —
    CVE-2016-2789

    Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling…

  • Unscored —
    CVE-2015-2774

    Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easie…

    erlang erlang Debian Ubuntu
  • Unscored —
    CVE-2016-0729

    Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser…

    xerces-c xerces-c Debian Ubuntu
  • Unscored —
    CVE-2016-2086

    Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to …

    nodejs nodejs Debian Ubuntu
  • Unscored —
    CVE-2016-2511

    Cross-site scripting (XSS) vulnerability in WebSVN 2.3.3 and earlier allows remote attackers to inject arbitrary web sc…

    websvn Ubuntu
  • Unscored —
    CVE-2016-2216

    The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x befor…

    nodejs nodejs Debian Ubuntu
  • Unscored —
    CVE-2015-8319

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, G…

  • Unscored —
    CVE-2015-8679

    The Maxim_smartpa_dev driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GR…

  • Unscored —
    CVE-2015-8680

    The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92…

  • Unscored —
    CVE-2015-8681

    The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B23…

  • Unscored —
    CVE-2015-8318

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, G…

  • Unscored —
    CVE-2015-8307

    The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92…

  • High 8.1
    CVE-2016-2510 EPSS 70%

    Improper Input Validation in BeanShell

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    bsh org.apache-extras.beanshell:bsh bsh Debian Ubuntu Maven
  • Unscored —
    CVE-2015-8305

    Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system …

  • Medium 6.1
    CVE-2016-0734

    Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ

    The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME e…

    org.apache.activemq:activemq-client Maven
  • Unscored —
    CVE-2016-1714

    The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmwar…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-3973

    The chat feature in the Real-Time Collaboration (RTC) services 7.3 and 7.4 in SAP NetWeaver Java AS 7.1 through 7.5 all…

  • Unscored —
    CVE-2016-3975

    Cross-site scripting (XSS) vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to inject arb…

  • Unscored —
    CVE-2016-3974 Public exploit EPSS 14%

    XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows rem…

  • Unscored —
    CVE-2016-2858

    QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-3948 EPSS 35%

    Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause…

    squid squid3 Debian Ubuntu
  • Unscored —
    CVE-2016-3947 EPSS 15%

    Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 an…

    squid squid3 Debian Ubuntu
  • Unscored —
    CVE-2016-0888

    EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to …

  • High 7.8
    CVE-2016-1019 Exploited · Ransomware EPSS 22%

    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or p…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • Unscored —
    CVE-2016-1563

    NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the…