CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6151 CVE-2016-1286 20 DoS 2016-03-09 2017-11-20
5.0
None Remote Low Not required None None Partial
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
6152 CVE-2016-1270 19 DoS 2016-04-15 2016-04-20
5.0
None Remote Low Not required None None Partial
The rpd daemon in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R6, 14.1 before 14.1R4, and 14.2 before 14.2R2, when configured with BGP-based L2VPN or VPLS, allows remote attackers to cause a denial of service (daemon restart) via a crafted L2VPN family BGP update.
6153 CVE-2016-1260 399 DoS 2016-01-15 2016-12-02
5.0
None Remote Low Not required None None Partial
Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-D25, and 15.2 before 15.2R1 on EX4300 series switches allow remote attackers to cause a denial of service (network loop and bandwidth consumption) via unspecified vectors related to Spanning Tree Protocol (STP) traffic.
6154 CVE-2016-1258 20 DoS 2016-01-15 2016-12-02
5.0
None Remote Low Not required None None Partial
Embedthis Appweb, as used in J-Web in Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D45, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2X51 before 13.2X51-D20, 13.3 before 13.3R8, 14.1 before 14.1R6, and 14.2 before 14.2R5, allows remote attackers to cause a denial of service (J-Web crash) via unspecified vectors.
6155 CVE-2016-1256 399 DoS 2016-01-15 2016-12-02
5.0
None Remote Low Not required None None Partial
Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D40, 13.3 before 13.3R7, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D18 or 14.1X53-D30, 14.1X55 before 14.1X55-D25, 14.2 before 14.2R4, 15.1 before 15.1R2, and 15.1X49 before 15.1X49-D10 allow remote attackers to cause a denial of service via a malformed IGMPv3 packet, aka a "multicast denial of service."
6156 CVE-2016-1254 119 DoS Overflow 2017-12-05 2018-10-30
5.0
None Remote Low Not required None None Partial
Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.
6157 CVE-2016-1246 119 DoS Overflow 2016-10-05 2017-11-13
5.0
None Remote Low Not required None None Partial
Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.
6158 CVE-2016-1234 119 DoS Overflow 2016-06-01 2018-10-30
5.0
None Remote Low Not required None None Partial
Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name.
6159 CVE-2016-1232 2016-01-12 2016-06-09
5.0
None Remote Low Not required Partial None None
The mod_dialback module in Prosody before 0.9.9 does not properly generate random values for the secret token for server-to-server dialback authentication, which makes it easier for attackers to spoof servers via a brute force attack.
6160 CVE-2016-1225 200 +Info 2016-06-19 2016-11-29
5.0
None Remote Low Not required Partial None None
Trend Micro Internet Security 8 and 10 allows remote attackers to read arbitrary files via unspecified vectors.
6161 CVE-2016-1223 22 Dir. Trav. 2016-06-18 2016-06-21
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors.
6162 CVE-2016-1213 601 2017-04-20 2017-04-25
5.8
None Remote Medium Not required Partial Partial None
The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.
6163 CVE-2016-1208 200 +Info 2016-05-14 2016-05-19
5.0
None Remote Low Not required Partial None None
The server in Apple FileMaker before 14.0.4 on OS X allows remote attackers to read PHP source code via unspecified vectors.
6164 CVE-2016-1199 200 Bypass +Info 2016-04-30 2016-05-05
5.0
None Remote Low Not required Partial None None
The login page in the management screen in LOCKON EC-CUBE 3.0.0 through 3.0.9 allows remote attackers to bypass intended IP address restrictions via unspecified vectors, a different vulnerability than CVE-2016-1200.
6165 CVE-2016-1195 2016-06-19 2016-06-20
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
6166 CVE-2016-1193 200 +Info 2016-06-25 2016-06-27
5.0
None Remote Low Not required Partial None None
Cybozu Garoon 3.7 through 4.2 allows remote attackers to obtain sensitive email-reading information via unspecified vectors.
6167 CVE-2016-1191 22 Dir. Trav. 2016-06-19 2016-06-21
5.0
None Remote Low Not required None Partial None
Directory traversal vulnerability in the Files function in Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote attackers to modify settings via unspecified vectors.
6168 CVE-2016-1189 Bypass 2016-06-25 2016-06-27
5.5
None Remote Low Single system Partial Partial None
Cybozu Garoon 3.x and 4.x before 4.2.1 allows remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
6169 CVE-2016-1175 352 CSRF 2016-04-05 2016-04-06
5.8
None Remote Medium Not required None Partial Partial
Cross-site request forgery (CSRF) vulnerability in AQUOS Photo Player HN-PP150 1.02.00.04 through 1.03.01.04 allows remote attackers to hijack the authentication of arbitrary users.
6170 CVE-2016-1158 352 CSRF 2016-03-03 2016-03-10
5.1
None Remote High Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability on Corega CG-WLBARGMH and CG-WLBARGNL devices allows remote attackers to hijack the authentication of administrators for requests that perform administrative functions.
6171 CVE-2016-1152 264 Bypass 2016-02-16 2016-02-22
5.5
None Remote Low Single system Partial None Partial
Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.
6172 CVE-2016-1137 2016-01-30 2016-02-10
5.8
None Remote Medium Not required Partial Partial None
Open redirect vulnerability on KDDI HOME SPOT CUBE devices before 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
6173 CVE-2016-1132 295 2017-04-13 2017-04-20
5.0
None Remote Low Not required None Partial None
Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.
6174 CVE-2016-1115 20 2016-05-10 2016-11-30
5.8
None Remote Medium Not required Partial Partial None
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
6175 CVE-2016-1092 200 +Info 2016-05-11 2016-11-30
5.0
None Remote Low Not required Partial None None
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1079.
6176 CVE-2016-1079 200 +Info 2016-05-11 2016-11-30
5.0
None Remote Low Not required Partial None None
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1092.
6177 CVE-2016-1035 200 +Info 2016-04-12 2016-12-02
5.0
None Remote Low Not required Partial None None
Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors.
6178 CVE-2016-0950 20 2016-02-10 2016-12-05
5.0
None Remote Low Not required None Partial None
Adobe Connect before 9.5.2 allows remote attackers to spoof the user interface via unspecified vectors.
6179 CVE-2016-0930 362 2016-09-17 2016-11-28
5.0
None Remote Low Not required Partial None None
Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.
6180 CVE-2016-0929 200 +Info 2016-09-17 2016-11-28
5.0
None Remote Low Not required Partial None None
The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials from a command line.
6181 CVE-2016-0928 601 2016-09-17 2016-11-28
5.8
None Remote Medium Not required Partial Partial None
Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
6182 CVE-2016-0922 285 2016-09-17 2016-11-28
5.0
None Remote Low Not required Partial None None
EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.
6183 CVE-2016-0915 264 DoS 2016-08-22 2017-08-15
5.5
None Remote Low Single system None Partial Partial
The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request, related to a "direct object reference vulnerability."
6184 CVE-2016-0904 310 +Info 2016-09-20 2017-07-29
5.0
None Remote Low Not required Partial None None
Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.
6185 CVE-2016-0902 Http R.Spl. 2016-05-07 2016-11-30
5.0
None Remote Low Not required None Partial None
CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
6186 CVE-2016-0898 532 2018-03-29 2018-04-27
5.0
None Remote Low Not required Partial None None
MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM.
6187 CVE-2016-0883 287 Bypass 2016-09-17 2016-10-03
5.0
None Remote Low Not required Partial None None
Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.
6188 CVE-2016-0882 2016-02-11 2017-01-10
5.5
None Remote Low Single system Partial None Partial
EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
6189 CVE-2016-0876 200 +Info 2016-05-30 2016-06-01
5.0
None Remote Low Not required Partial None None
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.
6190 CVE-2016-0875 200 +Info 2016-05-30 2016-05-31
5.0
None Remote Low Not required Partial None None
Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.
6191 CVE-2016-0872 255 2017-11-07 2017-11-29
5.0
None Remote Low Not required Partial None None
A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.
6192 CVE-2016-0871 200 +Info 2016-04-06 2016-04-07
5.0
None Remote Low Not required Partial None None
Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.
6193 CVE-2016-0870 200 +Info 2016-09-18 2016-11-28
5.0
None Remote Low Not required Partial None None
The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.
6194 CVE-2016-0864 200 +Info 2016-02-12 2016-05-09
5.0
None Remote Low Not required Partial None None
Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors.
6195 CVE-2016-0855 22 Dir. Trav. 2016-01-14 2016-12-02
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.
6196 CVE-2016-0853 200 +Info 2016-01-14 2016-01-21
5.0
None Remote Low Not required Partial None None
Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.
6197 CVE-2016-0852 264 Bypass 2016-01-14 2016-01-21
5.0
None Remote Low Not required Partial None None
Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.
6198 CVE-2016-0850 264 Bypass 2016-04-17 2016-04-21
5.8
None Local Network Low Not required Partial Partial Partial
The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752.
6199 CVE-2016-0829 254 Bypass +Info 2016-03-12 2016-11-28
5.0
None Remote Low Not required Partial None None
The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering a QUEUE_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338109.
6200 CVE-2016-0828 254 Bypass +Info 2016-03-12 2016-11-28
5.0
None Remote Low Not required Partial None None
The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.
Total number of vulnerabilities : 21598   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 (This Page)125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.