CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
5901 CVE-2016-9584 416 DoS 2017-01-18 2017-01-20
6.4
None Remote Low Not required Partial None Partial
libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.
5902 CVE-2016-9583 125 2018-08-01 2019-04-26
6.8
None Remote Medium Not required Partial Partial Partial
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
5903 CVE-2016-9581 119 Overflow 2018-08-01 2018-10-02
6.8
None Remote Medium Not required Partial Partial Partial
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
5904 CVE-2016-9580 190 Overflow 2018-08-01 2018-10-11
6.8
None Remote Medium Not required Partial Partial Partial
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
5905 CVE-2016-9577 119 Exec Code Overflow 2018-07-27 2018-09-24
6.5
None Remote Low Single system Partial Partial Partial
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
5906 CVE-2016-9575 285 2018-03-13 2018-04-13
6.5
None Remote Low Single system Partial Partial Partial
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
5907 CVE-2016-9563 284 2016-11-22 2018-12-10
6.0
None Remote Medium Single system Partial Partial Partial
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
5908 CVE-2016-9560 119 Overflow 2017-02-15 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
5909 CVE-2016-9496 306 2018-07-13 2018-09-06
6.1
None Local Network Low Not required None None Complete
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.
5910 CVE-2016-9491 200 +Info 2018-07-13 2018-09-10
6.8
None Remote Low Single system Complete None None
ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /register.do page (most likely limited to administrator), to browse the filesystem and read the system files, including Applications Manager configuration, stored private keys, etc. By default Application Manager is running with administrative privileges, therefore it is possible to access every directory on the underlying operating system.
5911 CVE-2016-9487 611 2018-07-13 2018-09-07
6.8
None Remote Medium Not required Partial Partial Partial
EpubCheck 4.0.1 does not properly restrict resolving external entities when parsing XML in EPUB files during validation. An attacker who supplies a specially crafted EPUB file may be able to exploit this behavior to read arbitrary files, or have the victim execute arbitrary requests on his behalf, abusing the victim's trust relationship with other entities.
5912 CVE-2016-9480 119 DoS Overflow +Info 2016-11-29 2016-12-22
6.4
None Remote Low Not required Partial None Partial
libdwarf 2016-10-21 allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component, aka DW201611-006.
5913 CVE-2016-9463 287 Bypass 2017-03-27 2017-03-30
6.8
None Remote Medium Not required Partial Partial Partial
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. Note: The SMB backend is disabled by default and requires manual configuration in the Nextcloud/ownCloud config file. If you have not configured the SMB backend then you're not affected by this vulnerability.
5914 CVE-2016-9456 352 CSRF 2017-03-27 2017-03-29
6.8
None Remote Medium Not required Partial Partial Partial
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The Revive Adserver team conducted a security audit of the admin interface scripts in order to identify and fix other potential CSRF vulnerabilities. Over 20+ such issues were fixed.
5915 CVE-2016-9455 352 CSRF 2017-03-27 2017-03-29
6.8
None Remote Medium Not required Partial Partial Partial
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). A number of scripts in Revive Adserver's user interface are vulnerable to CSRF attacks: `www/admin/banner-acl.php`, `www/admin/banner-activate.php`, `www/admin/banner-advanced.php`, `www/admin/banner-modify.php`, `www/admin/banner-swf.php`, `www/admin/banner-zone.php`, `www/admin/tracker-modify.php`.
5916 CVE-2016-9453 787 DoS Exec Code 2017-01-27 2018-10-30
6.8
None Remote Medium Not required Partial Partial Partial
The t2p_readwrite_pdf_image_tile function in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a JPEG file with a TIFFTAG_JPEGTABLES of length one.
5917 CVE-2016-9447 125 DoS Exec Code 2017-01-23 2018-01-04
6.8
None Remote Medium Not required Partial Partial Partial
The ROM mappings in the NSF decoder in gstreamer 0.10.x allow remote attackers to cause a denial of service (out-of-bounds read or write) and possibly execute arbitrary code via a crafted NSF music file.
5918 CVE-2016-9429 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Buffer overflow in the formUpdateBuffer function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
5919 CVE-2016-9428 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
5920 CVE-2016-9426 190 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Integer overflow vulnerability in the renderTable function in w3m allows remote attackers to cause a denial of service (OOM) and possibly execute arbitrary code due to bdwgc's bug (CVE-2016-9427) via a crafted HTML page.
5921 CVE-2016-9425 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in the addMultirowsForm function in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
5922 CVE-2016-9424 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service (heap buffer overflow crash) and possibly execute arbitrary code via a crafted HTML page.
5923 CVE-2016-9423 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. Heap-based buffer overflow in w3m allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML page.
5924 CVE-2016-9422 119 DoS Exec Code Overflow 2016-12-11 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. The feed_table_tag function in w3m doesn't properly validate the value of table span, which allows remote attackers to cause a denial of service (stack and/or heap buffer overflow) and possibly execute arbitrary code via a crafted HTML page.
5925 CVE-2016-9387 190 Overflow 2017-03-23 2018-06-28
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
5926 CVE-2016-9381 362 +Priv 2017-01-23 2017-06-30
6.9
None Local Medium Not required Complete Complete Complete
Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability.
5927 CVE-2016-9365 352 CSRF 2017-02-13 2017-02-17
6.8
None Remote Medium Not required Partial Partial Partial
An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort 5400 Series versions prior to 3.11, NPort 5600 Series versions prior to 3.7, NPort 5100A Series & NPort P5150A versions prior to 1.3, NPort 5200A Series versions prior to 1.3, NPort 5150AI-M12 Series versions prior to 1.2, NPort 5250AI-M12 Series versions prior to 1.2, NPort 5450AI-M12 Series versions prior to 1.2, NPort 5600-8-DT Series versions prior to 2.4, NPort 5600-8-DTL Series versions prior to 2.4, NPort 6x50 Series versions prior to 1.13.11, NPort IA5450A versions prior to v1.4. Requests are not verified to be intentionally submitted by the proper user (CROSS-SITE REQUEST FORGERY).
5928 CVE-2016-9362 287 2017-02-13 2017-06-28
6.4
None Remote Low Not required Partial Partial None
An issue was discovered in WAGO 750-8202/PFC200 prior to FW04 (released August 2015), WAGO 750-881 prior to FW09 (released August 2016), and WAGO 0758-0874-0000-0111. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to edit and to view settings without authenticating.
5929 CVE-2016-9351 22 Dir. Trav. 2017-02-13 2017-08-11
6.0
None Remote Medium Single system Partial Partial Partial
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. The directory traversal/file upload error allows an attacker to upload and unpack a zip file.
5930 CVE-2016-9318 611 2016-11-15 2018-08-15
6.8
None Remote Medium Not required Partial Partial Partial
libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened, which makes it easier for remote attackers to conduct XML External Entity (XXE) attacks via a crafted document.
5931 CVE-2016-9310 400 2017-01-13 2019-01-24
6.4
None Remote Low Not required Partial None Partial
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.
5932 CVE-2016-9304 119 Exec Code Overflow 2017-01-25 2017-01-27
6.8
None Remote Medium Not required Partial Partial Partial
Multiple buffer overflows in the Autodesk FBX-SDK before 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DFX format files.
5933 CVE-2016-9272 89 DoS Sql 2016-11-11 2016-11-29
6.4
None Remote Low Not required Partial None Partial
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
5934 CVE-2016-9256 362 2017-05-09 2017-05-15
6.0
None Remote Medium Single system Partial Partial Partial
In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change.
5935 CVE-2016-9251 264 2017-05-09 2017-07-07
6.5
None Remote Low Single system Partial Partial Partial
In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection.
5936 CVE-2016-9242 89 Exec Code Sql 2016-11-07 2016-11-29
6.5
None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.
5937 CVE-2016-9224 20 2016-12-26 2017-01-03
6.4
None Remote Low Not required Partial Partial None
A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information: CSCvc31635. Known Affected Releases: 10.6(9). Known Fixed Releases: 11.0(0).
5938 CVE-2016-9218 352 CSRF 2017-01-26 2017-01-27
6.8
None Remote Medium Not required Partial Partial Partial
A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against the user of the web interface. More Information: CSCvc28662. Known Affected Releases: 1.0.
5939 CVE-2016-9217 285 2016-12-26 2016-12-29
6.5
None Remote Low Single system Partial Partial Partial
A vulnerability in Cisco Intercloud Fabric for Business and Cisco Intercloud Fabric for Providers could allow an unauthenticated, remote attacker to connect to the database used by these products. More Information: CSCus99394. Known Affected Releases: 7.3(0)ZN(0.99).
5940 CVE-2016-9207 20 2016-12-13 2016-12-22
6.4
None Remote Low Not required Partial None Partial
A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitrary hosts. This does not allow for full traffic proxy through the Expressway. Affected Products: This vulnerability affects Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS). More Information: CSCvc10834. Known Affected Releases: X8.7.2 X8.8.3. Known Fixed Releases: X8.9.
5941 CVE-2016-9204 255 2016-12-13 2017-01-04
6.4
None Remote Low Not required Partial Partial None
A vulnerability in the Cisco Intercloud Fabric (ICF) Director could allow an unauthenticated, remote attacker to connect to internal services with an internal account. Affected Products: Cisco Nexus 1000V InterCloud is affected. More Information: CSCus99379. Known Affected Releases: 2.2(1).
5942 CVE-2016-9199 22 Dir. Trav. 2016-12-13 2016-12-22
6.8
None Remote Low Single system Complete None None
A vulnerability in the Cisco application-hosting framework (CAF) of Cisco IOx could allow an authenticated, remote attacker to read arbitrary files on a targeted system. Affected Products: This vulnerability affects specific releases of the Cisco IOx subsystem of Cisco IOS and IOS XE Software. More Information: CSCvb23331. Known Affected Releases: 15.2(6.0.57i)E CAF-1.1.0.0.
5943 CVE-2016-9194 399 DoS 2017-04-06 2017-07-11
6.1
None Local Network Low Not required None None Complete
A vulnerability in 802.11 Wireless Multimedia Extensions (WME) action frame processing in Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the 802.11 WME packet header. An attacker could exploit this vulnerability by sending malformed 802.11 WME frames to a targeted device. A successful exploit could allow the attacker to cause the WLC to reload unexpectedly. The fixed versions are 8.0.140.0, 8.2.130.0, and 8.3.111.0. Cisco Bug IDs: CSCva86353.
5944 CVE-2016-9190 284 Exec Code 2016-11-04 2017-06-30
6.8
None Remote Medium Not required Partial Partial Partial
Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the "crafted image file" approach, related to an "Insecure Sign Extension" issue affecting the ImagingNew in Storage.c component.
5945 CVE-2016-9187 434 Exec Code 2016-11-04 2016-11-29
6.5
None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
5946 CVE-2016-9186 434 Exec Code 2016-11-04 2016-11-29
6.5
None Remote Low Single system Partial Partial Partial
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
5947 CVE-2016-9180 611 2016-12-22 2016-12-23
6.4
None Remote Low Not required Partial None Partial
perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.
5948 CVE-2016-9127 352 CSRF 2017-03-27 2017-03-29
6.8
None Remote Medium Not required Partial Partial Partial
Revive Adserver before 3.2.3 suffers from Cross-Site Request Forgery (CSRF). The password recovery form in Revive Adserver is vulnerable to CSRF attacks. This vulnerability could be exploited to send a large number of password recovery emails to the registered users, especially in conjunction with a bug that caused recovery emails to be sent to all the users at once. Both issues have been fixed.
5949 CVE-2016-9121 326 2017-03-27 2017-03-29
6.4
None Remote Low Not required Partial Partial None
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
5950 CVE-2016-9094 20 2018-04-16 2018-05-22
6.8
None Remote Medium Not required Partial Partial Partial
Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.