Skip to content
OpenAdvisories

Archive

July 2016

Vulnerabilities first published in this month (UTC), newest first.

← June 2016 2016 / July August 2016 →
  1. 15
  2. 221
  3. 346
  4. 412
  5. 58
  6. 66
  7. 77
  8. 812
  9. 9 
  10. 10 
  11. 11100
  12. 1217
  13. 13131
  14. 14 
  15. 1527
  16. 16 
  17. 175
  18. 18 
  19. 1910
  20. 20 
  21. 21192
  22. 2268
  23. 2318
  24. 24 
  25. 2510
  26. 264
  27. 27 
  28. 2810
  29. 29 
  30. 30 
  31. 31 
All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • High 8.8
    CVE-2016-5131

    Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote atta…

    chromium-browser oxide-qt libxml2 libxml2 Debian Ubuntu Alpine
  • High 8.1
    CVE-2016-5388 EPSS 51%

    Improper Access Control in Apache Tomcat

    Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might…

    tomcat8 tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven
  • High 8.1
    CVE-2016-5385 EPSS 50%

    HTTP Proxy header vulnerability

    PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redi…

    php5 php7.0 drupal/core guzzlehttp/guzzle Ubuntu Packagist
  • High 7.5
    CVE-2016-4974

    Improper Input Validation in Apache Qpid AMQP 0-x JMS

    Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and e…

    qpid-cpp org.apache.qpid:qpid-jms-client Ubuntu Maven
  • High 7.5
    CVE-2016-4216

    Moderate severity vulnerability that affects com.adobe.xmp:xmpcore

    XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

    com.adobe.xmp:xmpcore libxmpcore-java Ubuntu Maven
  • High 8.8
    CVE-2016-3269 EPSS 21%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-3248 EPSS 24%

    ChakraCore RCE Vulnerability

    The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrup…

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-3260 EPSS 24%

    ChakraCore RCE Vulnerability

    The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via …

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-3265 EPSS 21%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-3259 EPSS 35%

    ChakraCore RCE Vulnerability

    The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corrup…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-4985

    OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor

    The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node…

    ironic ironic ironic Debian Ubuntu PyPI
  • High 7.5
    CVE-2015-0899 EPSS 21%

    Improper Input Validation in Apache Struts

    The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.

    struts:struts org.apache.struts:struts-core Maven
  • High 8.1
    CVE-2016-1181 EPSS 13%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a rela…

    struts:struts org.apache.struts:struts-core Maven
  • High 8.2
    CVE-2016-1182 EPSS 26%

    Improper Input Validation in Apache Struts

    ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE…

    struts:struts org.apache.struts:struts-core Maven
  • High 7.5
    CVE-2016-4433

    Apache Struts Open Redirect

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.

    org.apache.struts.xwork:xwork-core Maven
  • High 7.5
    CVE-2016-4431

    Apache Struts Access Control Redirect

    Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.

    org.apache.struts:struts-parent Maven
  • High 8.8
    CVE-2016-4430

    Apache Struts CSRF Vulnerability

    Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.

    org.apache.struts.xwork:xwork-core Maven
  • High 7.5
    CVE-2016-3092 EPSS 37%

    High severity vulnerability that affects commons-fileupload:commons-fileupload

    The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consu…

    tomcat8 tomcat7 tomcat6 commons-fileupload:commons-fileupload Debian Ubuntu Maven
  • High 7.5
    CVE-2016-5739

    phpMyAdmin vulnerable to Cross-Site Request Forgery

    The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF a…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • High 7.5
    CVE-2016-5706

    phpMyAdmin Denial Of Service (DOS) attack

    js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin Debian Ubuntu Packagist
  • High —
    CVE-2016-3956

    npm Token Leak in npm

    The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, which allows remote HTTP servers to obtain sensitive informati…

    npm npm npm Debian Ubuntu npm