CVEs from 2016
Total
8,431
critical
critical 1,165
high
high 3,521
medium
medium 3,172
low
low 248
% Critical
13.8%
% with KEV
0.7%
% with exploit
6.8%
Top vendors
Top products
- phpmyadmin 3,382
- php 1,748
- squid 1,549
- samba 1,093
- drupal 868
- firefox 757
- moodle 700
- openssl 664
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-10905 | unknown | — | — | — | An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry. | |||
| CVE-2016-10906 | unknown | — | — | — | An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean. | |||
| CVE-2016-10907 | unknown | — | — | — | An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt. | |||
| CVE-2016-20022 | unknown | — | — | — | In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. NOTE: This vulnerability only affects products th… | |||
| CVE-2016-9603 | unknown | — | — | — | A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a … | |||
| CVE-2016-9574 | unknown | — | — | — | nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA. | |||
| CVE-2016-7076 | unknown | — | — | — | sudo before version 1.8.18p1 is vulnerable to a bypass in the sudo noexec restriction if application run via sudo executed wordexp() C library function with a user supplied argument. A local user per… | |||
| CVE-2016-8626 | unknown | — | — | — | A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or sp… | |||
| CVE-2016-9069 | unknown | — | — | — | A use-after-free in nsINode::ReplaceOrInsertBefore during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50. | |||
| CVE-2016-9952 | unknown | — | — | — | The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-… | |||
| CVE-2016-9602 | unknown | — | — | — | Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder … | |||
| CVE-2016-4606 | unknown | — | — | — | Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass … | |||
| CVE-2016-9072 | unknown | — | — | — | When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default. Note: This issue only affects 64-bit Windows. 32-bit Windows and… | |||
| CVE-2016-9062 | unknown | — | — | — | Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited. Note: This issue onl… | |||
| CVE-2016-5295 | unknown | — | — | — | This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vuln… | |||
| CVE-2016-7523 | unknown | — | — | — | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. | |||
| CVE-2016-7524 | unknown | — | — | — | coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file. | |||
| CVE-2016-1585 | unknown | — | — | — | In all versions of AppArmor mount rules are accidentally widened when compiled. | |||
| CVE-2016-10764 | unknown | — | — | — | In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so t… | |||
| CVE-2016-5288 | unknown | — | — | — | Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability… | |||
| CVE-2016-5287 | unknown | — | — | — | A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2. | |||
| CVE-2016-9596 | unknown | — | — | — | libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (stack consumption) via a crafted XML document. NOTE: this … | |||
| CVE-2016-7069 | unknown | — | — | — | An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a backend. When dnsdist is configured to add EDNS Client Subnet to a query, the re… | |||
| CVE-2016-5293 | unknown | — | — | — | When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system acc… | |||
| CVE-2016-5294 | unknown | — | — | — | The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue o… | |||
| CVE-2016-9905 | unknown | — | — | — | A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR < 45.6 and Thunderbird < 45.6. | |||
| CVE-2016-15026 | unknown | — | — | 3y ago | dd-plist XML External Entitly vulnerability | |||
| CVE-2016-15011 | unknown | — | — | 4y ago | dssp vulnerable to Improper Restriction of XML External Entity Reference | |||
| CVE-2016-1000273 | unknown | — | — | 4y ago | Java Melody vulnerable to cross-site scripting | |||
| CVE-2016-1000027 | unknown | — | — | 4y ago | Pivotal Spring Framework contains unsafe Java deserialization methods | |||
| CVE-2016-10750 | unknown | — | — | 4y ago | Deserialization of Untrusted Data in Hazelcast | |||
| CVE-2016-7043 | unknown | — | — | 4y ago | Password in config file in KIE server | |||
| CVE-2016-9606 | unknown | — | — | 4y ago | JBoss RESTEasy vulnerable to Improper Input Validation | |||
| CVE-2016-8747 | unknown | — | — | 4y ago | Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request | |||
| CVE-2016-6810 | unknown | — | — | 4y ago | Improper Neutralization of Input During Web Page Generation Apache ActiveMQ | |||
| CVE-2016-9589 | unknown | — | — | 4y ago | Red Hat Wildfly DoS | |||
| CVE-2016-6814 | unknown | — | — | 4y ago | Deserialization of Untrusted Data in Groovy | |||
| CVE-2016-11024 | unknown | — | — | 5y ago | SQL Injection in odata4j | |||
| CVE-2016-3674 | unknown | — | — | 6y ago | XML External Entity Injection in XStream | |||
| CVE-2016-8750 | unknown | — | — | 8y ago | Moderate severity vulnerability that affects org.apache.karaf:apache-karaf | |||
| CVE-2016-10726 | unknown | — | — | 8y ago | High severity vulnerability that affects org.dspace:dspace-xmlui | |||
| CVE-2016-1000345 | unknown | — | — | 8y ago | Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 | |||
| CVE-2016-1000344 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode | |||
| CVE-2016-8609 | unknown | — | — | 8y ago | Improper Authentication in org.keycloak:keycloak-core | |||
| CVE-2016-8629 | unknown | — | — | 8y ago | Moderate severity vulnerability that affects org.keycloak:keycloak-core | |||
| CVE-2016-1000352 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode | |||
| CVE-2016-1000346 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider the other party DH public key is not fully validated | |||
| CVE-2016-1000343 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values | |||
| CVE-2016-1000342 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification | |||
| CVE-2016-1000341 | unknown | — | — | 8y ago | Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 | |||
| CVE-2016-1000340 | unknown | — | — | 8y ago | The Bouncy Castle JCE Provider carry a propagation bug | |||
| CVE-2016-1000339 | unknown | — | — | 8y ago | Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 | |||
| CVE-2016-1000338 | unknown | — | — | 8y ago | In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate | |||
| CVE-2016-10707 | unknown | — | — | 9y ago | Denial of Service in jquery | |||
| CVE-2016-10931 | unknown | — | — | 10y ago | An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for host… |