Skip to content
OpenAdvisories

Archive

3 October 2016

Vulnerabilities first published on this day (UTC), newest first.

← September 2016 2016 / October /3 November 2016 →
  1. 13
  2. 2 
  3. 345
  4. 4 
  5. 552
  6. 642
  7. 713
  8. 8 
  9. 91
  10. 10108
  11. 11 
  12. 12 
  13. 1399
  14. 1438
  15. 15 
  16. 1614
  17. 178
  18. 18 
  19. 19 
  20. 20 
  21. 2110
  22. 229
  23. 23 
  24. 24 
  25. 25162
  26. 266
  27. 2718
  28. 2835
  29. 296
  30. 306
  31. 3113
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.9
    CVE-2016-7046

    Undertow Uncaught Exception vulnerability

    Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • Medium 4.3
    CVE-2016-7570

    Drupal Users without "Administer comments" can set comment visibility on nodes they can edit

    Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.

    drupal/core drupal/drupal Packagist
  • Medium 4.3
    CVE-2016-7572

    Drupal Unprivileged access to config export

    The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.

    drupal/core drupal/drupal Packagist
  • Medium 6.1
    CVE-2016-7571

    Drupal Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.

    drupal/core drupal/drupal Packagist