Skip to content
OpenAdvisories

Archive

September 2016

Vulnerabilities first published in this month (UTC), newest first.

← August 2016 2016 / September October 2016 →
  1. 116
  2. 219
  3. 38
  4. 4 
  5. 5 
  6. 66
  7. 737
  8. 84
  9. 914
  10. 101
  11. 1161
  12. 1224
  13. 13 
  14. 1476
  15. 15 
  16. 1615
  17. 1716
  18. 1828
  19. 199
  20. 2022
  21. 2143
  22. 2230
  23. 23 
  24. 2411
  25. 2577
  26. 2657
  27. 279
  28. 283
  29. 296
  30. 305
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 8.1
    CVE-2016-7191 EPSS 29%

    Authentication Bypass in passport-azure-ad

    The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x before 1.4.6 and 2.x before 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.

    passport-azure-ad npm
  • High 7.2
    CVE-2016-4978

    Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain

    The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Art…

    org.apache.activemq:artemis-pom Maven
  • High 7.5
    CVE-2016-3110

    mod_cluster Denial of Service vulnerability

    mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of = (equals) characters after a legitimate element.

    org.jboss.mod_cluster:mod_cluster-parent Maven
  • High —
    CVE-2016-4464

    High severity vulnerability that affects org.apache.cxf.fediz:fediz-spring and org.apache.cxf.fediz:fediz-spring2

    The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified o…

    org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-spring Maven
  • High 8.8
    CVE-2016-6801

    Apache Jackrabbit Authentication Hijacking Vulnerability

    Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows re…

    jackrabbit jackrabbit org.apache.jackrabbit:jackrabbit-webdav Debian Ubuntu Maven
  • High 7.5
    CVE-2016-6802

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

    shiro shiro org.apache.shiro:shiro-web org.apache.shiro:shiro-all Debian Ubuntu Maven
  • High 7.5
    CVE-2016-6415 Exploited Public exploit EPSS 88%

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.…

    KEV May 19, 2023
  • High 7.5
    CVE-2016-3350 EPSS 15%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-3377 EPSS 16%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CV…

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-6211

    Drupal Saving user accounts can sometimes grant the user all roles

    The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.

    drupal/core drupal/drupal drupal7 Ubuntu Packagist
  • High 7.5
    CVE-2016-6317 Public exploit

    ActiveRecord in Ruby on Rails allows database-query bypass

    Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and …

    rails activerecord Debian RubyGems
  • High 7.5
    CVE-2016-6346

    Denial of service in JBoss resteasy

    RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.

    resteasy resteasy3.0 org.jboss.resteasy:resteasy-jaxrs Debian Ubuntu Maven
  • High 7.5
    CVE-2016-2183 Public exploit EPSS 95%

    The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…

    openjdk-8 openjdk-7 openssl openssl Ubuntu Alpine