Skip to content
OpenAdvisories

Archive

June 2016

Vulnerabilities first published in this month (UTC), newest first.

← May 2016 2016 / June July 2016 →
  1. 117
  2. 2 
  3. 38
  4. 49
  5. 536
  6. 61
  7. 721
  8. 840
  9. 912
  10. 1022
  11. 11 
  12. 12 
  13. 1374
  14. 146
  15. 15 
  16. 1694
  17. 176
  18. 183
  19. 1937
  20. 207
  21. 21 
  22. 22 
  23. 239
  24. 246
  25. 2514
  26. 2611
  27. 2714
  28. 283
  29. 2918
  30. 3042
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2016-2141

    Improper Input Validation in JGroups

    It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the …

    org.jgroups:jgroups libjgroups-java libjgroups-java Debian Ubuntu Maven
  • Critical 9.1
    CVE-2015-8914

    OpenStack Neutron allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism

    The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended ICMPv6-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a link-local source …

    neutron neutron Debian PyPI
  • Critical 9.8
    CVE-2016-3720

    jackson-dataformat-xml vulnerable to XML external entity (XXE)

    XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

    com.fasterxml.jackson.dataformat:jackson-dataformat-xml jackson-dataformat-xml jackson-dataformat-xml Debian Ubuntu Maven
  • Critical 9.8
    CVE-2016-2785

    Puppet Improper Access Control

    Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

    puppet RubyGems
  • Critical 9.8
    CVE-2016-3087 Public exploit EPSS 82%

    Apache Struts vulnerable to arbitrary remote code execution due to improper input validation

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

    org.apache.struts:struts2-core Maven
  • Critical 9.8
    CVE-2015-7695

    Zend Framework SQL injection vector using null byte for PDO

    The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL commands via a crafted query.

    zendframework/zendframework1 zend-framework Ubuntu Packagist
  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.1
    CVE-2016-4432

    AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication

    The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.

    qpid-cpp org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol org.apache.qpid:qpid-broker-plugins-amqp-1-0-protocol Ubuntu Maven
  • Critical 9.8
    CVE-2016-3088 Exploited Public exploit Scanner template EPSS 98%

    Improper Input Validation in Apache ActiveMQ

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

    activemq activemq org.apache.activemq:activemq-client Debian Ubuntu Maven
    KEV Feb 10, 2022