Skip to content
OpenAdvisories

Archive

26 September 2016

Vulnerabilities first published on this day (UTC), newest first.

← August 2016 2016 / September /26 October 2016 →
  1. 116
  2. 219
  3. 38
  4. 4 
  5. 5 
  6. 66
  7. 737
  8. 84
  9. 914
  10. 101
  11. 1161
  12. 1224
  13. 13 
  14. 1476
  15. 15 
  16. 1615
  17. 1716
  18. 1828
  19. 199
  20. 2022
  21. 2143
  22. 2230
  23. 23 
  24. 2411
  25. 2577
  26. 2657
  27. 279
  28. 283
  29. 296
  30. 305
All Critical High Medium Low Exploited only Public exploit

57 results · Feed

  • Unscored —
    CVE-2016-7052 EPSS 29%

    crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference…

    openssl openssl Debian Alpine
  • Unscored —
    CVE-2016-6309 EPSS 70%

    statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote att…

  • Unscored —
    CVE-2016-6980

    Use-after-free vulnerability in Adobe Digital Editions before 4.5.2 allows attackers to execute arbitrary code via unsp…

  • Unscored —
    CVE-2016-6038

    Directory traversal vulnerability in Eclipse Help in IBM Tivoli Lightweight Infrastructure (aka LWI), as used in AIX 5.…

  • Critical 9.8
    CVE-2016-4972

    OpenStack Murano Code Execution

    OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from …

    murano murano python-muranoclient murano-dashboard Debian Ubuntu PyPI
  • Unscored —
    CVE-2016-6901

    Format string vulnerability in Huawei AR100, AR120, AR150, AR200, AR500, AR550, AR1200, AR2200, AR2500, AR3200, and AR3…

  • Unscored —
    CVE-2016-6142

    SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to inject arbitrary audit trail fields into the SY…

  • Unscored —
    CVE-2016-6913

    Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to i…

  • Unscored —
    CVE-2016-6826

    Huawei AnyMail before 2.6.0301.0060 allows remote attackers to cause a denial of service (application crash) via a craf…

  • Unscored —
    CVE-2016-6172

    PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary DNS servers to cause a denial of service (m…

    pdns pdns Debian Ubuntu
  • Unscored —
    CVE-2016-6827

    Huawei FusionCompute before V100R005C10CP7002 stores cleartext AES keys in a file, which allows remote authenticated us…

  • Unscored —
    CVE-2016-3639

    SAP HANA DB 1.00.091.00.1418659308 allows remote attackers to obtain sensitive topology information via an unspecified …

  • Unscored —
    CVE-2016-7162

    The _g_file_remove_directory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to de…

    file-roller file-roller Debian Ubuntu
  • Unscored —
    CVE-2016-7142

    The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allow…

    inspircd inspircd Debian Ubuntu
  • Unscored —
    CVE-2016-6518

    Memory leak in Huawei S9300, S5300, S5700, S6700, S7700, S9700, and S12700 devices allows remote attackers to cause a d…

  • Unscored —
    CVE-2016-5746

    libstorage, libstorage-ng, and yast-storage improperly store passphrases for encrypted storage devices in a temporary f…

  • Unscored —
    CVE-2016-7098 Public exploit

    Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allo…

    wget wget Debian Ubuntu
  • Unscored —
    CVE-2016-4303

    The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to …

    iperf3 iperf3 Debian Ubuntu
  • Medium 6.1
    CVE-2016-4993

    Improper Neutralization of CRLF Sequences in Wildfly Undertow

    CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi…

    undertow undertow org.wildfly:wildfly-undertow Debian Ubuntu Maven
  • Unscored —
    CVE-2016-6840

    Cross-site scripting (XSS) vulnerability in the management interface in Huawei OceanStor ISM before V200R001C04SPC200 a…

  • Unscored —
    CVE-2016-6276

    Citrix Linux Virtual Delivery Agent (aka VDA, formerly Linux Virtual Desktop) before 1.4.0 allows local users to gain r…

  • High 7.5
    CVE-2016-3110

    mod_cluster Denial of Service vulnerability

    mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.

    org.jboss.mod_cluster:mod_cluster-parent Maven
  • Unscored —
    CVE-2016-8279

    The video driver in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B362, CRR-UL20 before CRR-UL20C0…

  • Medium 4.8
    CVE-2016-5395

    Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

    Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.

    org.apache.ranger:ranger Maven
  • Unscored —
    CVE-2016-5406

    The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticat…

  • Unscored —
    CVE-2016-0379

    IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated…

  • Unscored —
    CVE-2016-0248

    IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query…

  • Unscored —
    CVE-2016-3040

    IBM WebSphere Application Server (WAS) Liberty, as used in IBM Security Privileged Identity Manager (ISPIM) Virtual App…

  • Unscored —
    CVE-2016-3000

    The help service in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated…

  • Unscored —
    CVE-2016-3006

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 …

  • Unscored —
    CVE-2016-3001

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 …

  • Unscored —
    CVE-2016-3007

    Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before …

  • Unscored —
    CVE-2016-3003

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 …

  • Unscored —
    CVE-2016-2999

    IBM Connections 4.x through 4.5 CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to obtain sen…

  • Unscored —
    CVE-2016-5946

    Directory traversal vulnerability in IBM Spectrum Control (formerly Tivoli Storage Productivity Center) 5.2.x before 5.…

  • Unscored —
    CVE-2016-5976

    The web portal in IBM Tealeaf Customer Experience before 8.7.1.8847 FP10, 8.8 before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 be…

  • Unscored —
    CVE-2016-5974

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security Privileged Identity Manager (ISPIM) Virtual Appl…

  • Unscored —
    CVE-2016-5972

    IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 uses weak permissions for unspe…

  • Unscored —
    CVE-2016-5975

    Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.…

  • Unscored —
    CVE-2016-5978

    Cross-site scripting (XSS) vulnerability in the Web UI in the web portal in IBM Tealeaf Customer Experience before 8.7.…