CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6051 CVE-2016-8737 352 Exec Code CSRF 2017-09-13 2017-09-21
6.8
None Remote Medium Not required Partial Partial Partial
In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.
6052 CVE-2016-8730 787 Exec Code Mem. Corr. 2018-04-24 2018-06-13
6.8
None Remote Medium Not required Partial Partial Partial
An of bound write / memory corruption vulnerability exists in the GIF parsing functionality of Core PHOTO-PAINT X8 18.1.0.661. A specially crafted GIF file can cause a vulnerability resulting in potential memory corruption resulting in code execution. An attacker can send the victim a specific GIF file to trigger this vulnerability.
6053 CVE-2016-8729 119 Exec Code Overflow Mem. Corr. 2018-04-24 2018-06-13
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable memory corruption vulnerability exists in the JBIG2 parser of Artifex MuPDF 1.9. A specially crafted PDF can cause a negative number to be passed to a memset resulting in memory corruption and potential code execution. An attacker can specially craft a PDF and send to the victim to trigger this vulnerability.
6054 CVE-2016-8728 787 Exec Code Mem. Corr. 2018-04-24 2018-06-13
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap out of bounds write vulnerability exists in the Fitz graphical library part of the MuPDF renderer. A specially crafted PDF file can cause a out of bounds write resulting in heap metadata and sensitive process memory corruption leading to potential code execution. Victim needs to open the specially crafted file in a vulnerable reader in order to trigger this vulnerability.
6055 CVE-2016-8718 352 CSRF 2017-04-12 2017-04-20
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable Cross-Site Request Forgery vulnerability exists in the Web Application functionality of Moxa AWK-3131A Wireless Access Point running firmware 1.1. A specially crafted form can trick a client into making an unintentional request to the web server which will be treated as an authentic request.
6056 CVE-2016-8715 119 Exec Code Overflow 2017-02-28 2017-03-01
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap corruption vulnerability exists in the loadTrailer functionality of Iceni Argus version 6.6.05. A specially crafted PDF file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide a malicious PDF file to trigger this vulnerability.
6057 CVE-2016-8714 119 Overflow Mem. Corr. 2017-03-10 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable buffer overflow vulnerability exists in the LoadEncoding functionality of the R programming language version 3.3.0. A specially crafted R script can cause a buffer overflow resulting in a memory corruption. An attacker can send a malicious R script to trigger this vulnerability.
6058 CVE-2016-8713 787 Mem. Corr. 2017-02-10 2017-02-28
6.8
None Remote Medium Not required Partial Partial Partial
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10.5.9.9. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
6059 CVE-2016-8711 20 Exec Code 2017-02-10 2017-02-28
6.8
None Remote Medium Not required Partial Partial Partial
A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A specially crafted PDF file can cause a vulnerability resulting in potential code execution. An attacker can send the victim a specific PDF file to trigger this vulnerability.
6060 CVE-2016-8710 787 Exec Code 2017-01-26 2018-10-17
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be triggered via attempting to decode a crafted BPG image using Libbpg.
6061 CVE-2016-8709 119 Overflow Mem. Corr. 2017-02-10 2017-02-28
6.8
None Remote Medium Not required Partial Partial Partial
A remote out of bound write / memory corruption vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption. An attacker can send the victim a specific PDF file to trigger this vulnerability.
6062 CVE-2016-8707 787 Exec Code 2016-12-23 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.
6063 CVE-2016-8706 190 Exec Code Overflow 2017-01-06 2017-07-27
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
6064 CVE-2016-8703 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8702.
6065 CVE-2016-8702 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, and CVE-2016-8703.
6066 CVE-2016-8701 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8700, CVE-2016-8702, and CVE-2016-8703.
6067 CVE-2016-8700 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8699, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
6068 CVE-2016-8699 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8698, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
6069 CVE-2016-8698 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image, a different vulnerability than CVE-2016-8699, CVE-2016-8700, CVE-2016-8701, CVE-2016-8702, and CVE-2016-8703.
6070 CVE-2016-8693 415 DoS Exec Code 2017-02-15 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
6071 CVE-2016-8686 119 Overflow 2017-01-31 2017-02-05
6.8
None Remote Medium Not required Partial Partial Partial
The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.
6072 CVE-2016-8684 119 Overflow 2017-02-15 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
The MagickMalloc function in magick/memory.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
6073 CVE-2016-8683 119 Overflow 2017-02-15 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
The ReadPCXImage function in coders/pcx.c in GraphicsMagick 1.3.25 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure and a "file truncation error for corrupt file."
6074 CVE-2016-8677 119 Overflow 2017-02-15 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
The AcquireQuantumPixels function in MagickCore/quantum.c in ImageMagick before 7.0.3-1 allows remote attackers to have unspecified impact via a crafted image file, which triggers a memory allocation failure.
6075 CVE-2016-8673 352 CSRF 2016-11-23 2017-03-16
6.8
None Remote Medium Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in the integrated web server on Siemens SIMATIC CP 343-1 Advanced prior to version 3.0.53, SIMATIC CP 443-1 Advanced prior to version 3.2.17, SIMATIC S7-300 CPU, and SIMATIC S7-400 CPU devices allows remote attackers to hijack the authentication of arbitrary users.
6076 CVE-2016-8659 264 +Priv 2017-02-13 2017-02-16
6.9
None Local Medium Not required Complete Complete Complete
Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.
6077 CVE-2016-8654 119 Overflow 2018-08-01 2018-10-10
6.8
None Remote Medium Not required Partial Partial Partial
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
6078 CVE-2016-8648 502 Exec Code 2018-08-01 2018-10-16
6.5
None Remote Low Single system Partial Partial Partial
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
6079 CVE-2016-8638 384 2017-07-12 2018-01-04
6.4
None Remote Low Not required Partial None Partial
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
6080 CVE-2016-8633 119 Exec Code Overflow 2016-11-27 2019-05-14
6.2
None Local High Not required Complete Complete Complete
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.
6081 CVE-2016-8626 20 DoS 2018-07-31 2018-10-09
6.8
None Remote Low Single system None None Complete
A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests.
6082 CVE-2016-8602 704 DoS Exec Code 2017-04-14 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack.
6083 CVE-2016-8593 22 Exec Code Dir. Trav. 2017-04-28 2017-05-10
6.5
None Remote Low Single system Partial Partial Partial
Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.
6084 CVE-2016-8588 284 Exec Code 2017-04-28 2017-05-10
6.0
None Remote Medium Single system Partial Partial Partial
The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.
6085 CVE-2016-8587 284 Exec Code 2017-04-28 2017-05-24
6.0
None Remote Medium Single system Partial Partial Partial
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
6086 CVE-2016-8565 284 2016-10-13 2017-07-28
6.4
None Remote Low Not required None Partial Partial
Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets.
6087 CVE-2016-8564 89 Exec Code Sql 2016-10-13 2017-07-28
6.4
None Remote Low Not required Partial Partial None
SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410.
6088 CVE-2016-8561 264 +Priv 2016-11-18 2016-12-21
6.0
None Remote Medium Single system Partial Partial Partial
Siemens SIMATIC CP 1543-1 before 2.0.28 allows remote authenticated users to gain privileges by leveraging certain TIA-Portal access and project-data access.
6089 CVE-2016-8534 264 2018-02-15 2018-03-02
6.5
None Remote Low Single system Partial Partial Partial
A remote privilege elevation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
6090 CVE-2016-8533 264 2018-02-15 2018-03-02
6.5
None Remote Low Single system Partial Partial Partial
A remote priviledge escalation vulnerability in HPE Matrix Operating Environment version 7.6 was found.
6091 CVE-2016-8528 264 2018-02-15 2018-03-07
6.5
None Remote Low Single system Partial Partial Partial
A Remote Escalation of Privilege vulnerability in HPE Helion Eucalyptus version 3.3.0 through 4.3.1 was found.
6092 CVE-2016-8520 275 2018-02-15 2018-03-13
6.5
None Remote Low Single system Partial Partial Partial
HPE Helion Eucalyptus v4.3.0 and earlier does not correctly check IAM user's permissions for accessing versioned objects and ACLs. In some cases, authenticated users with S3 permissions could also access versioned data.
6093 CVE-2016-8515 434 2018-02-15 2018-03-06
6.5
None Remote Low Single system Partial Partial Partial
A remote malicious file upload vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6.
6094 CVE-2016-8513 352 CSRF 2018-02-15 2018-03-07
6.0
None Remote Medium Single system Partial Partial Partial
A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versions prior to 7.6.
6095 CVE-2016-8494 264 Exec Code 2017-02-09 2017-02-28
6.5
None Remote Low Single system Partial Partial Partial
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
6096 CVE-2016-8390 787 2018-06-04 2018-07-27
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with specific section headers to trigger this vulnerability.
6097 CVE-2016-8384 119 Overflow 2018-04-24 2018-06-04
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap corruption vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter.
6098 CVE-2016-8383 119 Exec Code Overflow 2018-04-24 2018-06-04
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap corruption vulnerability exists in the Doc_GetFontTable functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send/provide malicious doc file to trigger this vulnerability.
6099 CVE-2016-8382 119 Exec Code Overflow 2018-04-24 2018-06-04
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable heap corruption vulnerability exists in the Doc_SetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send a malicious doc file to trigger this vulnerability.
6100 CVE-2016-8377 119 Exec Code Overflow 2017-02-13 2017-09-15
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vulnerability exists when the software application connects to a malicious server, resulting in a stack buffer overflow. This causes an exploitable Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.