Skip to content
OpenAdvisories

Archive

12 April 2016

Vulnerabilities first published on this day (UTC), newest first.

← March 2016 2016 / April /12 May 2016 →
  1. 16
  2. 2 
  3. 3 
  4. 46
  5. 56
  6. 622
  7. 736
  8. 831
  9. 923
  10. 10 
  11. 1140
  12. 1275
  13. 1354
  14. 1421
  15. 1519
  16. 162
  17. 17 
  18. 1855
  19. 1914
  20. 2010
  21. 21118
  22. 2229
  23. 23 
  24. 24 
  25. 2529
  26. 265
  27. 2728
  28. 285
  29. 29 
  30. 3019
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.3
    CVE-2016-0162 Exploited EPSS 22%

    Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaSc…

    KEV May 24, 2022
  • Medium 6.1
    CVE-2016-4003 EPSS 12%

    Cross-site Scripting in Apache Struts

    Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters…

    org.apache.struts:struts2-core Maven
  • Medium 6.1
    CVE-2016-2162

    Apache Struts XSS Vulnerability

    Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.

    org.apache.struts:struts2-core Maven
  • Medium 5.3
    CVE-2016-3170

    Drupal sensitive information disclosure

    The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a mod…

    drupal/core drupal/drupal drupal7 Ubuntu Packagist
  • Medium 5.9
    CVE-2016-3166

    Drupal CRLF injection vulnerability in the drupal_set_header function

    CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows …

    drupal/core drupal/drupal Packagist
  • Medium 6.4
    CVE-2016-3168

    Drupal Reflected file download vulnerability

    The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulne…

    drupal/core drupal/drupal drupal7 Ubuntu Packagist
  • Medium 6.5
    CVE-2015-5167

    Apache Ranger allows users to bypass intended access restrictions via the REST API

    The Policy Admin Tool in Apache Ranger before 0.5.1 allows remote authenticated users to bypass intended access restrictions via the REST API.

    org.apache.ranger:ranger Maven
  • Medium 5.3
    CVE-2016-2140

    OpenStack Nova host data access through resize/migration

    The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an eph…

    nova nova nova Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2016-2166

    Moderate severity vulnerability that affects org.apache.qpid:proton-j

    The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might a…

    qpid-proton org.apache.qpid:proton-j Ubuntu Maven