Skip to content
OpenAdvisories

Archive

November 2016

Vulnerabilities first published in this month (UTC), newest first.

← October 2016 2016 / November December 2016 →
  1. 11
  2. 21
  3. 322
  4. 421
  5. 5 
  6. 6 
  7. 72
  8. 835
  9. 9 
  10. 1075
  11. 119
  12. 122
  13. 13 
  14. 147
  15. 155
  16. 1613
  17. 175
  18. 186
  19. 1913
  20. 20 
  21. 21 
  22. 2210
  23. 236
  24. 2411
  25. 2578
  26. 26 
  27. 27 
  28. 2815
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 8.8
    CVE-2016-5393

    Improper Access Control in Apache Hadoop

    In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.

    org.apache.hadoop:hadoop-common Maven
  • High 7.5
    CVE-2016-9450

    Drupal Incorrect cache context on password reset page

    The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.

    drupal/core drupal/drupal Packagist
  • High 7.5
    CVE-2016-8562 Exploited

    A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions <…

    KEV Mar 3, 2022
  • High 7.0
    CVE-2015-8963

    Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a …

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 7.0
    CVE-2016-5195 Exploited Public exploit EPSS 84%

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by le…

    linux-raspi2 linux linux linux-lts-xenial Debian Ubuntu
    KEV Mar 3, 2022
  • High 7.5
    CVE-2016-7203 Public exploit EPSS 65%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-7202 Public exploit EPSS 74%

    ChakraCore RCE Vulnerability

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerabilit…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-7243 EPSS 15%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
  • High 7.8
    CVE-2016-7255 Exploited · Ransomware Public exploit EPSS 81%

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,…

    KEV Nov 3, 2021
  • High 8.8
    CVE-2016-7200 Exploited Public exploit EPSS 83%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
    KEV Mar 28, 2022
  • High 8.8
    CVE-2016-7201 Exploited Public exploit EPSS 80%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
    KEV Mar 28, 2022
  • High 7.5
    CVE-2016-7240 Public exploit EPSS 66%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
  • High 8.8
    CVE-2016-7256 Exploited EPSS 65%

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1…

    KEV May 25, 2022
  • High 7.5
    CVE-2016-7208 EPSS 15%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
  • High 7.5
    CVE-2016-7242 EPSS 16%

    ChakraCore RCE Vulnerability

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerabili…

    Microsoft.ChakraCore NuGet
  • High 7.8
    CVE-2016-9190

    Arbitrary code using "crafted image file" approach affecting Pillow

    Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.

    pillow pillow pillow Debian Ubuntu PyPI
  • High 8.8
    CVE-2016-9187

    Moodle Unrestricted file upload vulnerability

    Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified ve…

    moodle/moodle moodle Ubuntu Packagist
  • High 7.5
    CVE-2016-9177 Public exploit

    Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

    Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

    com.sparkjava:spark-core Maven
  • High 8.8
    CVE-2015-8968

    git-fastclone permits arbitrary shell command execution from .gitmodules

    git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an atta…

    git-fastclone RubyGems
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022