Skip to content
OpenAdvisories

Archive

May 2016

Vulnerabilities first published in this month (UTC), newest first.

← April 2016 2016 / May June 2016 →
  1. 18
  2. 236
  3. 34
  4. 4 
  5. 525
  6. 67
  7. 718
  8. 8 
  9. 941
  10. 105
  11. 11156
  12. 125
  13. 1325
  14. 1425
  15. 153
  16. 1627
  17. 1713
  18. 184
  19. 191
  20. 2084
  21. 212
  22. 2240
  23. 2328
  24. 241
  25. 2513
  26. 2614
  27. 27 
  28. 283
  29. 292
  30. 307
  31. 3115
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.8
    CVE-2016-2157

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of adminis…

    moodle/moodle moodle Ubuntu Packagist
  • High 7.5
    CVE-2015-7558

    librsvg DoS via Cyclic References

    librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.

    librsvg librsvg Debian crates.io
  • High 8.1
    CVE-2016-3693

    safemode gem allows context-dependent attackers to obtain sensitive information via the inspect method

    The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.

    safemode RubyGems
  • High 7.8
    CVE-2016-1834 Public exploit

    Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X …

    libxml2 libxml2 Debian Ubuntu
  • High 7.5
    CVE-2016-3627 Public exploit

    The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-de…

    libxml2 libxml2 Debian Ubuntu
  • High 7.4
    CVE-2016-3726

    Jenkins affected by Open Redirect Vulnerability

    Multiple open redirect vulnerabilities in Jenkins before 2.3 and LTS before 1.651.2 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors related to "scheme-relative" URLs.

    org.jenkins-ci.main:jenkins-core Maven
  • High 7.5
    CVE-2016-3674

    XML External Entity Injection in XStream

    Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary fil…

    libxstream-java libxstream-java com.thoughtworks.xstream:xstream Debian Ubuntu Maven
  • High 7.5
    CVE-2016-0189 Exploited · Ransomware Public exploit EPSS 94%

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other…

    KEV Mar 28, 2022
  • High 7.8
    CVE-2016-0185 Exploited Public exploit EPSS 70%

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrar…

    KEV Nov 3, 2021
  • High 7.5
    CVE-2016-0186 EPSS 19%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-0191 EPSS 28%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-0193 EPSS 20%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 7.8
    CVE-2016-4117 Exploited · Ransomware Public exploit EPSS 94%

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022
  • High 8.8
    CVE-2016-3105

    Mercurial vulnerable to arbitrary code execution when converting Git repos

    The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • High 8.4
    CVE-2016-3714 Exploited Public exploit EPSS 97%

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
    KEV Sep 9, 2024
  • High 7.8
    CVE-2015-8325

    The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM i…

    openssh openssh openssh Debian Ubuntu Alpine