Archive

16 February 2017

Vulnerabilities first published on this day (UTC), newest first.

← January 2017 2017 / February /16 March 2017 →

1143
215
344
43
53
632
734
886
952
109
11
126
13124
144
1592
1628
1759
183
19
20154
2121
2241
2311
2434
25
261
2730
2812

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

Unscored —

CVE-2016-4311 Public exploit

Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote a…

Feb 16, 2017
Unscored —

CVE-2016-4312 Public exploit

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATC…

Feb 16, 2017
Medium 4.9

CVE-2016-4314 Public exploit EPSS 12%

WSO2 Carbon directory traversal vulnerability

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.

org.wso2.carbon.commons:org.wso2.carbon.logging.view.ui Maven

Feb 16, 2017
Unscored —

CVE-2016-4315 Public exploit

Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authenticati…

Feb 16, 2017
Medium 6.1

CVE-2016-4316 Public exploit

WSO2 Carbon vulnerable to Cross-site Scripting

Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-lis…

org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui Maven

Feb 16, 2017
Critical 9.8

CVE-2016-4861 Public exploit

Zend Framework Allows SQL Injection

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

zendframework/zendframework zend-framework Ubuntu Packagist

Feb 16, 2017
Unscored —

CVE-2016-10134 Public exploit Scanner template EPSS 83%

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary S…

zabbix zabbix zabbix Debian Ubuntu Alpine

Feb 16, 2017