Skip to content
OpenAdvisories

Archive

September 2016

Vulnerabilities first published in this month (UTC), newest first.

← August 2016 2016 / September October 2016 →
  1. 116
  2. 219
  3. 38
  4. 4 
  5. 5 
  6. 66
  7. 737
  8. 84
  9. 914
  10. 101
  11. 1161
  12. 1224
  13. 13 
  14. 1476
  15. 15 
  16. 1615
  17. 1716
  18. 1828
  19. 199
  20. 2022
  21. 2143
  22. 2230
  23. 23 
  24. 2411
  25. 2577
  26. 2657
  27. 279
  28. 283
  29. 296
  30. 305
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2016-4993

    Improper Neutralization of CRLF Sequences in Wildfly Undertow

    CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi…

    undertow undertow org.wildfly:wildfly-undertow Debian Ubuntu Maven
  • Medium 4.8
    CVE-2016-5395

    Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

    Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies.

    org.apache.ranger:ranger Maven
  • Medium 6.5
    CVE-2016-3351 Exploited · Ransomware EPSS 26%

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via …

    KEV May 24, 2022
  • Medium 5.3
    CVE-2016-6212

    Drupal Views can allow unauthorized users to see Statistics information

    The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.

    drupal/core drupal/drupal Packagist
  • Medium 4.4
    CVE-2016-1242

    Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter

    file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.

    trytond tryton-server tryton-server tryton Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2016-1241

    Tryton allows users to read the hashed password

    Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.

    trytond tryton-server tryton-server tryton Debian Ubuntu PyPI
  • Medium 6.1
    CVE-2016-6316

    actionview Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute…

    rails actionview Debian RubyGems
  • Medium 6.5
    CVE-2016-6345

    Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy

    RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.

    resteasy resteasy3.0 org.jboss.resteasy:resteasy-client Debian Ubuntu Maven
  • Medium 5.3
    CVE-2016-6298

    jwcrypto lacks the Random Filling protection mechanism

    The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

    python-jwcrypto python-jwcrypto jwcrypto Debian Ubuntu PyPI