Skip to content
OpenAdvisories

Archive

September 2016

Vulnerabilities first published in this month (UTC), newest first.

← August 2016 2016 / September October 2016 →
  1. 116
  2. 219
  3. 38
  4. 4 
  5. 5 
  6. 66
  7. 737
  8. 84
  9. 914
  10. 101
  11. 1161
  12. 1224
  13. 13 
  14. 1476
  15. 15 
  16. 1615
  17. 1716
  18. 1828
  19. 199
  20. 2022
  21. 2143
  22. 2230
  23. 23 
  24. 2411
  25. 2577
  26. 2657
  27. 279
  28. 283
  29. 296
  30. 305
All Critical High Medium Low Exploited only Public exploit

597 results · Feed

  • Unscored —
    CVE-2016-5430

    The RSA 1.5 algorithm implementation in the JOSE_JWE class in JWE.php in jose-php before 2.2.1 lacks the Random Filling…

  • Unscored —
    CVE-2016-5429

    jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attac…

  • Unscored —
    CVE-2016-0772 Public exploit EPSS 15%

    The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an …

    python3.4 python3.5 python2.7 python-py Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2016-7123

    Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote a…

  • Unscored —
    CVE-2016-4952

    QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-6893

    Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remo…

    mailman Ubuntu
  • Unscored —
    CVE-2016-5699 Public exploit

    CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) bef…

    python3.4 python2.7 python-py python2.7 Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2016-5107

    The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, all…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5105

    The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5636 Public exploit EPSS 25%

    Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3…

    python3.4 python3.5 python2.7 python-py Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2016-5106

    The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Ad…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5879

    MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted …

  • Unscored —
    CVE-2016-4848

    Cross-site scripting (XSS) vulnerability in ClipBucket before 2.8.1 RC2 allows remote attackers to inject arbitrary web…

  • Unscored —
    CVE-2016-4853

    AKABEi SOFT2 games allow remote attackers to execute arbitrary OS commands via crafted saved data, as demonstrated by H…

  • Unscored —
    CVE-2016-4851

    Cross-site scripting (XSS) vulnerability in Let's PHP! simple chat before 2016-08-15 allows remote attackers to inject …

  • Unscored —
    CVE-2016-6483 Public exploit EPSS 13%

    The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch L…

  • Unscored —
    CVE-2016-1472

    The web-based management interface on Cisco Small Business 220 devices with firmware before 1.0.1.1 allows remote attac…

  • Unscored —
    CVE-2016-1470

    Cross-site request forgery (CSRF) vulnerability in the web-based management interface on Cisco Small Business 220 devic…

  • Unscored —
    CVE-2016-1471

    Cross-site scripting (XSS) vulnerability in the web-based management interface on Cisco Small Business 220 devices with…

  • Unscored —
    CVE-2016-1473

    Cisco Small Business 220 devices with firmware before 1.0.1.1 have a hardcoded SNMP community, which allows remote atta…

  • Unscored —
    CVE-2016-6376

    The Adaptive Wireless Intrusion Prevention System (wIPS) feature on Cisco Wireless LAN Controller (WLC) devices before …

  • Unscored —
    CVE-2016-4264 Public exploit EPSS 69%

    The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attac…

  • Medium 5.3
    CVE-2016-6298

    jwcrypto lacks the Random Filling protection mechanism

    The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).

    python-jwcrypto python-jwcrypto jwcrypto Debian Ubuntu PyPI
  • Unscored —
    CVE-2016-0385

    Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10…

  • Unscored —
    CVE-2016-3005

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before …

  • Unscored —
    CVE-2016-3008

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remo…

  • Unscored —
    CVE-2016-3010

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before …

  • Unscored —
    CVE-2016-2954

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remo…

  • Unscored —
    CVE-2016-2997

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before …

  • Unscored —
    CVE-2016-2995

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before …

  • Unscored —
    CVE-2016-2998

    Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, an…

  • Unscored —
    CVE-2016-2956

    Cross-site scripting (XSS) vulnerability in the Web UI in IBM Connections 5.0 before CR4 and 5.5 before CR1 allows remo…

  • Unscored —
    CVE-2016-5047

    NetApp OnCommand System Manager 8.3.x before 8.3.2P5 allows remote authenticated users to cause a denial of service via…

  • Unscored —
    CVE-2016-0370

    Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote aut…

  • Unscored —
    CVE-2016-0293

    Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and…

  • Unscored —
    CVE-2016-3064

    NetApp Clustered Data ONTAP before 8.2.4P4 and 8.3.x before 8.3.2P2 allows remote authenticated users to obtain sensiti…

  • High 7.5
    CVE-2016-2183 Public exploit EPSS 95%

    The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…

    openjdk-8 openssl openjdk-7 openssl Ubuntu Alpine