Skip to content
OpenAdvisories

Archive

December 2016

Vulnerabilities first published in this month (UTC), newest first.

← November 2016 2016 / December January 2017 →
  1. 111
  2. 22
  3. 39
  4. 4 
  5. 57
  6. 62
  7. 7 
  8. 813
  9. 919
  10. 1017
  11. 1148
  12. 1234
  13. 1342
  14. 1442
  15. 1559
  16. 1625
  17. 179
  18. 1813
  19. 192
  20. 2044
  21. 213
  22. 226
  23. 2329
  24. 244
  25. 252
  26. 263
  27. 272
  28. 2813
  29. 2943
  30. 309
  31. 316
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.8
    CVE-2016-10045 Public exploit EPSS 98%

    Remote code execution in PHPMailer

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping perf…

    phpmailer/phpmailer libphp-phpmailer php-phpmailer php5-phpmailer Ubuntu Alpine Packagist
  • Critical 9.8
    CVE-2016-10034 Public exploit EPSS 38%

    zend-mail remote code execution via Sendmail adapter

    The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute ar…

    zendframework/zend-mail Packagist
  • Critical 9.8
    CVE-2016-10033 Exploited Public exploit Scanner template EPSS 100%

    Remote code execution in PHPMailer

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

    phpmailer/phpmailer libphp-phpmailer libphp-phpmailer php-phpmailer Debian Ubuntu Alpine Packagist
    KEV Jul 7, 2025
  • Critical 9.8
    CVE-2016-10074 Public exploit EPSS 44%

    Swift Mailer mail transport Command Injection

    The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address…

    swiftmailer/swiftmailer libphp-swiftmailer libphp-swiftmailer Debian Ubuntu Packagist
  • Critical 9.8
    CVE-2016-7954

    Bundler allows attacker to inject arbitrary code via secondary Gem source

    Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.

    bundler bundler Ubuntu RubyGems
  • Critical 9.8
    CVE-2016-6629

    phpMyAdmin Authentication Bypass

    An issue was discovered in phpMyAdmin involving the $cfg['ArbitraryServerRegexp'] configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Critical 9.8
    CVE-2016-9866

    phpMyAdmin CSRF Vulnerability

    An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.…

    phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist
  • Critical 9.8
    CVE-2016-9013

    Django user with hardcoded password created when running tests on Oracle

    Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database se…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI