Skip to content
OpenAdvisories

Archive

November 2016

Vulnerabilities first published in this month (UTC), newest first.

← October 2016 2016 / November December 2016 →
  1. 11
  2. 21
  3. 322
  4. 421
  5. 5 
  6. 6 
  7. 72
  8. 835
  9. 9 
  10. 1075
  11. 119
  12. 122
  13. 13 
  14. 147
  15. 155
  16. 1613
  17. 175
  18. 186
  19. 1913
  20. 20 
  21. 21 
  22. 2210
  23. 236
  24. 2411
  25. 2578
  26. 26 
  27. 27 
  28. 2815
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

386 results · Feed

  • High 7.5
    CVE-2016-9177 Public exploit

    Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI

    Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

    com.sparkjava:spark-core Maven
  • Unscored —
    CVE-2016-9176

    Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by …

    Micro Focus Micro Focus Rumba 9.4
  • Unscored —
    CVE-2016-6453

    A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote …

  • Unscored —
    CVE-2016-6448

    A vulnerability in the Session Description Protocol (SDP) parser of Cisco Meeting Server could allow an unauthenticated…

  • Unscored —
    CVE-2016-6454

    A cross-site request forgery (CSRF) vulnerability in the web interface of the Cisco Hosted Collaboration Mediation Fulf…

  • Unscored —
    CVE-2016-6429

    A vulnerability in the web framework code of the Cisco IP Interoperability and Collaboration System (IPICS) could allow…

  • Unscored —
    CVE-2016-6451

    Multiple vulnerabilities in the web framework code of the Cisco Prime Collaboration Provisioning could allow an unauthe…

  • Unscored —
    CVE-2016-6447

    A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbi…

  • Unscored —
    CVE-2016-6452

    A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, rem…

  • Unscored —
    CVE-2016-6430

    A vulnerability in the command-line interface of the Cisco IP Interoperability and Collaboration System (IPICS) could a…

  • Unscored —
    CVE-2016-6441

    A vulnerability in the Transaction Language 1 (TL1) code of Cisco ASR 900 Series routers could allow an unauthenticated…

    iOS
  • Unscored —
    CVE-2016-6455

    A vulnerability in the Slowpath of StarOS for Cisco ASR 5500 Series routers with Data Processing Card 2 (DPC2) could al…

  • High 8.8
    CVE-2015-8968

    git-fastclone permits arbitrary shell command execution from .gitmodules

    git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an atta…

    git-fastclone RubyGems
  • Critical 9.8
    CVE-2015-8969

    Git-fastclone passes user modifiable strings directly to a shell command

    git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library.

    git-fastclone RubyGems
  • Unscored —
    CVE-2016-7452

    The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder…

  • Unscored —
    CVE-2016-7453

    The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.

  • Unscored —
    CVE-2016-7095

    Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the…

  • Unscored —
    CVE-2016-7160

    A vulnerability on Samsung Mobile M(6.0) devices exists because external access to SystemUI activities is not properly …

  • Unscored —
    CVE-2016-7402

    SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges…

  • Unscored —
    CVE-2016-4025

    Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.…

  • Unscored —
    CVE-2016-9135

    Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.ph…

  • Unscored —
    CVE-2016-9136

    Artifex Software, Inc. MuJS before a0ceaf5050faf419401fe1b83acfa950ec8a8a89 allows context-dependent attackers to obtai…

    mupdf Ubuntu
  • Unscored —
    CVE-2016-9134

    Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Imp…

  • Unscored —
    CVE-2016-9086

    GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Adde…

  • Unscored —
    CVE-2016-8864 EPSS 39%

    named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to …

    bind9 bind9 bind Debian Ubuntu Alpine
  • High 8.8
    CVE-2016-7855 Exploited Public exploit EPSS 25%

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Lin…

    flashplugin-nonfree Ubuntu
    KEV Mar 3, 2022