alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2016-4396 (published 2016-10-28)
HPE System Management Homepage before v7.6 allows remote attackers to have an unspecified impact via unknown vectors, related to a "Buffer Overflow" issue.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-119
Affected vendors: hp
Affected products: system_management_homepage
CVE-2016-4397 (published 2018-08-06)
A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: hp
Affected products: network_node_manager_i
CVE-2016-4398 (published 2018-08-06)
A remote arbitrary code execution vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10 using Java Deserialization.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hp
Affected products: network_node_manager_i
CVE-2016-4399 (published 2018-08-06)
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: network_node_manager_i
CVE-2016-4400 (published 2018-08-06)
A security vulnerability was identified in HP Network Node Manager i (NNMi) Software 10.00, 10.01 (patch1), 10.01 (patch 2), 10.10. The vulnerability could result in cross-site scripting (XSS).
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: network_node_manager_i
CVE-2016-4401 (published 2019-11-06)
Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: arubanetworks
Affected products: clearpass
CVE-2016-4402 (published 2018-08-06)
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via buffer overflow.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: hp
Affected products: keyview
CVE-2016-4403 (published 2018-08-06)
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via memory corruption.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: hp
Affected products: keyview
CVE-2016-4404 (published 2018-08-06)
A security vulnerability was identified in the Filter SDK component of HP KeyView earlier than v11.2. The vulnerability could be exploited remotely to allow code execution via a memory allocation issue.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: hp
Affected products: keyview
CVE-2016-4405 (published 2018-08-06)
A remote code execution vulnerability was identified in HP Business Service Management (BSM) using Apache Commons Collection Java Deserialization versions v9.20-v9.26
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hp
Affected products: business_service_management
CVE-2016-4406 (published 2018-08-06)
A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hp
Affected products: integrated_lights-out, integrated_lights-out_3_firmware, integrated_lights-out_4_firmware
CVE-2016-4407 (published 2016-10-13)
The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-284
Affected vendors: sap
Affected products: sapcryptolib
CVE-2016-4412 (published 2016-12-11)
An issue was discovered in phpMyAdmin. A user can be tricked into following a link leading to phpMyAdmin, which after authentication redirects to another malicious site. The attacker must sniff the user's valid phpMyAdmin token. All 4.0.x versions (prior to 4.0.10.16) are affected.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-254
Affected vendors: phpmyadmin
Affected products: phpmyadmin
CVE-2016-4414 (published 2016-06-13)
The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via invalid handshake data.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: fedoraproject, opensuse, quassel-irc
Affected products: fedora, leap, opensuse, quassel
CVE-2016-4415 (published 2016-05-01)
wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 2.x before 2.0.2 incorrectly increases a certain octet count, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4416 (published 2016-05-01)
epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.2 mishandles the Grouping subfield, which allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4417 (published 2016-05-01)
Off-by-one error in epan/dissectors/packet-gsm_abis_oml.c in the GSM A-bis OML dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers a 0xff tag value.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4418 (published 2016-05-01)
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet that triggers an empty set.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4419 (published 2016-05-01)
epan/dissectors/packet-spice.c in the SPICE dissector in Wireshark 2.x before 2.0.2 mishandles capability data, which allows remote attackers to cause a denial of service (large loop) via a crafted packet.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4420 (published 2016-05-01)
The NFS dissector in Wireshark 2.x before 2.0.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4421 (published 2016-05-01)
epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.12.x before 1.12.10 and 2.x before 2.0.2 allows remote attackers to cause a denial of service (deep recursion, stack consumption, and application crash) via a packet that specifies deeply nested data.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: wireshark
Affected products: wireshark
CVE-2016-4422 (published 2016-05-06)
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: debian, libpam-sshauth_project
Affected products: debian_linux, libpam-sshauth
CVE-2016-4423 (published 2016-06-01)
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-399
Affected vendors: debian, sensiolabs
Affected products: debian_linux, symfony
CVE-2016-4425 (published 2016-05-17)
Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumption, and crash) via crafted JSON data.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: jansson_project
Affected products: jansson
CVE-2016-4426 (published 2022-07-28)
In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: zulip
Affected products: zulip
CVE-2016-4427 (published 2022-07-28)
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: zulip
Affected products: zulip
CVE-2016-4428 (published 2016-07-12)
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: debian, openstack, redhat
Affected products: debian_linux, enterprise_linux, horizon, openstack
CVE-2016-4429 (published 2016-06-10)
Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: canonical, gnu, opensuse
Affected products: glibc, leap, opensuse, ubuntu_linux
CVE-2016-4430 (published 2016-07-04)
Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: apache
Affected products: struts
CVE-2016-4431 (published 2016-07-04)
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: apache
Affected products: struts
CVE-2016-4432 (published 2016-06-01)
The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-287
Affected vendors: apache
Affected products: qpid_broker-j
CVE-2016-4433 (published 2016-07-04)
Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: apache
Affected products: struts
CVE-2016-4434 (published 2017-09-30)
Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-611
Affected vendors: apache
Affected products: tika
CVE-2016-4435 (published 2017-05-25)
An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: pivotal
Affected products: bosh_stemcell
CVE-2016-4436 (published 2016-10-03)
Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: apache
Affected products: struts
CVE-2016-4437 (published 2016-06-07)
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-321
Affected vendors: apache, redhat
Affected products: aurora, fuse, jboss_middleware_text-only_advisories, shiro
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2016-4438 (published 2016-07-04)
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apache
Affected products: struts
CVE-2016-4439 (published 2016-05-20)
The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the QEMU host via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: canonical, debian, qemu
Affected products: debian_linux, qemu, ubuntu_linux
CVE-2016-4440 (published 2016-06-27)
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: linux
Affected products: linux_kernel
CVE-2016-4441 (published 2016-05-20)
The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: canonical, debian, qemu
Affected products: debian_linux, qemu, ubuntu_linux
CVE-2016-4442 (published 2017-05-02)
The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging incorrect ordering of security checks.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: miniprofiler
Affected products: rack-mini-profiler
CVE-2016-4443 (published 2016-12-14)
Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-532
Affected vendors: redhat
Affected products: enterprise_virtualization
CVE-2016-4444 (published 2017-04-11)
The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: redhat, setroubleshoot_project
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_server, enterprise_linux_workstation, setroubleshoot
CVE-2016-4445 (published 2017-04-11)
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: redhat, setroubleshoot_project
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_server, enterprise_linux_workstation, setroubleshoot
CVE-2016-4446 (published 2017-04-11)
The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: redhat, setroubleshoot_project
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_server, enterprise_linux_workstation, setroubleshoot
CVE-2016-4447 (published 2016-06-09)
The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: apple, canonical, debian, hp, mcafee, microsoft, oracle, xmlsoft
Affected products: debian_linux, icewall_federation_agent, iphone_os, itunes, libxml2, mac_os_x, tvos, ubuntu_linux, vm_server, watchos, web_gateway, windows
CVE-2016-4448 (published 2016-06-09)
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-134
Affected vendors: apple, hp, mcafee, microsoft, oracle, redhat, slackware, tenable, xmlsoft
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_server_tus, enterprise_linux_workstation, icewall_federation_agent, icloud, iphone_os, itunes, libxml2, linux, log_correlation_engine, mac_os_x, slackware_linux, tvos, vm_server, watchos, web_gateway, windows
CVE-2016-4449 (published 2016-06-09)
XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-20
Affected vendors: canonical, debian, xmlsoft
Affected products: debian_linux, libxml2, ubuntu_linux
CVE-2016-4450 (published 2016-06-07)
os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: canonical, debian, f5
Affected products: debian_linux, nginx, ubuntu_linux
CVE-2016-4451 (published 2016-08-19)
The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-254
Affected vendors: theforeman
Affected products: foreman
CVE-2016-4453 (published 2016-06-01)
The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: canonical, debian, qemu
Affected products: debian_linux, qemu, ubuntu_linux
CVE-2016-4454 (published 2016-06-01)
The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggers an out-of-bounds read.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-119
Affected vendors: canonical, debian, qemu
Affected products: debian_linux, qemu, ubuntu_linux
CVE-2016-4455 (published 2017-04-14)
The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-264
Affected vendors: redhat
Affected products: enterprise_linux_desktop, enterprise_linux_hpc_node, enterprise_linux_server, enterprise_linux_workstation, subscription-manager
CVE-2016-4456 (published 2017-08-08)
The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesystem.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-20
Affected vendors: gnu
Affected products: gnutls
CVE-2016-4457 (published 2017-06-08)
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-310
Affected vendors: redhat
Affected products: cloudforms_management_engine
CVE-2016-4459 (published 2017-04-12)
Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: redhat
Affected products: enterprise_linux, mod_cluster
CVE-2016-4460 (published 2017-08-22)
Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: apache
Affected products: pony_mail
CVE-2016-4461 (published 2017-10-16)
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apache, netapp
Affected products: oncommand_balance, struts
CVE-2016-4462 (published 2017-08-30)
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: apache
Affected products: ofbiz
CVE-2016-4463 (published 2016-07-08)
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: apache, debian
Affected products: debian_linux, xerces-c\+\+
CVE-2016-4464 (published 2016-09-21)
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: apache
Affected products: cxf_fediz
CVE-2016-4465 (published 2016-07-04)
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Weakness: CWE-20
Affected vendors: apache
Affected products: struts
CVE-2016-4467 (published 2017-05-02)
The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-295
Affected vendors: apache
Affected products: qpid_proton
CVE-2016-4468 (published 2017-04-11)
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: cloudfoundry, pivotal_software
Affected products: cloud_foundry, cloud_foundry_elastic_runtime, cloud_foundry_ops_manager, cloud_foundry_uaa, cloud_foundry_uaa_bosh
CVE-2016-4469 (published 2016-07-28)
Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: apache
Affected products: archiva
CVE-2016-4470 (published 2016-06-27)
The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: linux, novell, oracle, redhat
Affected products: enterprise_linux, enterprise_linux_desktop, enterprise_linux_for_real_time, enterprise_linux_hpc_node, enterprise_linux_hpc_node_eus, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_eus, enterprise_linux_workstation, enterprise_mrg, linux, linux_kernel, suse_linux_enterprise_real_time_extension, vm_server
CVE-2016-4471 (published 2017-06-08)
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: redhat
Affected products: cloudforms
CVE-2016-4472 (published 2016-06-30)
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: canonical, libexpat_project, mcafee, python
Affected products: libexpat, policy_auditor, python, ubuntu_linux
CVE-2016-4473 (published 2017-06-08)
/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code.  NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: php, suse
Affected products: linux_enterprise_module_for_web_scripting, linux_enterprise_software_development_kit, php
CVE-2016-4474 (published 2016-06-30)
The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: redhat
Affected products: openstack
CVE-2016-4475 (published 2016-08-19)
The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-254
Affected vendors: theforeman
Affected products: foreman
CVE-2016-4476 (published 2016-05-09)
hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: canonical, w1.fi
Affected products: hostapd, ubuntu_linux, wpa_supplicant
CVE-2016-4477 (published 2016-05-09)
wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-19
Affected vendors: google
Affected products: android
CVE-2016-4478 (published 2016-06-13)
Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to cause a denial of service via vectors related to XMLRPC response encoding.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: atheme, debian, opensuse
Affected products: atheme, debian_linux, leap, opensuse
CVE-2016-4480 (published 2016-05-18)
The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: oracle, xen
Affected products: vm_server, xen
CVE-2016-4482 (published 2016-05-23)
The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: canonical, fedoraproject, linux, novell
Affected products: fedora, linux_kernel, suse_linux_enterprise_debuginfo, suse_linux_enterprise_desktop, suse_linux_enterprise_live_patching, suse_linux_enterprise_module_for_public_cloud, suse_linux_enterprise_real_time_extension, suse_linux_enterprise_server, suse_linux_enterprise_software_development_kit, suse_linux_enterprise_workstation_extension, ubuntu_linux
CVE-2016-4483 (published 2017-04-11)
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.  NOTE: this vulnerability may be a duplicate of CVE-2016-3627.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-502
Affected vendors: debian, oracle, xmlsoft
Affected products: debian_linux, libxml2, solaris
CVE-2016-4484 (published 2017-01-23)
The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: cryptsetup_project
Affected products: cryptsetup
CVE-2016-4485 (published 2016-05-23)
The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: canonical, linux, novell
Affected products: linux_kernel, suse_linux_enterprise_debuginfo, suse_linux_enterprise_server, suse_linux_enterprise_software_development_kit, ubuntu_linux
CVE-2016-4486 (published 2016-05-23)
The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: canonical, linux, novell
Affected products: linux_kernel, suse_linux_enterprise_debuginfo, suse_linux_enterprise_desktop, suse_linux_enterprise_live_patching, suse_linux_enterprise_module_for_public_cloud, suse_linux_enterprise_real_time_extension, suse_linux_enterprise_server, suse_linux_enterprise_software_development_kit, suse_linux_enterprise_workstation_extension, ubuntu_linux
CVE-2016-4487 (published 2017-02-24)
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "btypevec."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4488 (published 2017-02-24)
Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to "ktypevec."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4489 (published 2017-02-24)
Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to the "demangling of virtual tables."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4490 (published 2017-02-24)
Integer overflow in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, related to inconsistent use of the long and int types for lengths.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4491 (published 2017-02-24)
The d_print_comp function in cp-demangle.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary, which triggers infinite recursion and a buffer overflow, related to a node having "itself as ancestor more than once."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4492 (published 2017-02-24)
Buffer overflow in the do_type function in cplus-dem.c in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted binary.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4493 (published 2017-02-24)
The demangle_template_value_parm and do_hpacc_template_literal functions in cplus-dem.c in libiberty allow remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted binary.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: gnu
Affected products: libiberty
CVE-2016-4494 (published 2016-06-10)
Cross-site request forgery (CSRF) vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: kmc_controls
Affected products: bac-5051e, bac-5051e_firmware
CVE-2016-4495 (published 2016-06-10)
KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allow remote attackers to bypass intended access restrictions and read a configuration file via unspecified vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: kmc_controls
Affected products: bac-5051e, bac-5051e_firmware
CVE-2016-4496 (published 2016-05-12)
Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by triggering a crafted index value, as demonstrated by an integer overflow.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-119
Affected vendors: panasonic
Affected products: fpwin_pro
CVE-2016-4497 (published 2016-05-12)
Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: panasonic
Affected products: fpwin_pro
CVE-2016-4498 (published 2016-05-12)
Panasonic FPWIN Pro 5.x through 7.x before 7.130 accesses an uninitialized pointer, which allows local users to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-20
Affected vendors: panasonic
Affected products: fpwin_pro
CVE-2016-4499 (published 2016-05-12)
Heap-based buffer overflow in Panasonic FPWIN Pro 5.x through 7.x before 7.130 allows local users to cause a denial of service (application crash) via unspecified vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Weakness: CWE-119
Affected vendors: panasonic
Affected products: fpwin_pro
CVE-2016-4500 (published 2016-06-01)
Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-254
Affected vendors: moxa
Affected products: uc-7408_lx-plus, uc-7408_lx-plus_firmware
CVE-2016-4501 (published 2016-05-31)
Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, which allows remote attackers to bypass authentication and make arbitrary configuration changes via unspecified vectors.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-284
Affected vendors: envirosys
Affected products: esc_8832_data_controller
CVE-2016-4502 (published 2016-05-31)
Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-284
Affected vendors: envirosys
Affected products: esc_8832_data_controller
CVE-2016-4503 (published 2016-07-12)
Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to reading a cookie parameter containing a UserId value.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: moxa
Affected products: device_server_web_console_5232-n, device_server_web_console_5232-n_firmware
CVE-2016-4504 (published 2017-03-21)
A Cross-Site Request Forgery issue was discovered in Meteocontrol WEB'log Basic 100 all versions, Light all versions, Pro all versions, and Pro Unlimited all versions. There is no CSRF Token generated per page or per function.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: meteocontrol
Affected products: weblog
CVE-2016-4505 (published 2016-05-31)
Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: resourcedm
Affected products: intuitive_650_tdb_controller
CVE-2016-4506 (published 2016-05-31)
Cross-site request forgery (CSRF) vulnerability on Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: resourcedm
Affected products: intuitive_650_tdb_controller
CVE-2016-4507 (published 2016-07-06)
SQL injection vulnerability in Rexroth Bosch BLADEcontrol-WebVIS 3.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-89
Affected vendors: bosch
Affected products: bladecontrol-webvis
CVE-2016-4508 (published 2016-07-06)
Cross-site scripting (XSS) vulnerability in Rexroth Bosch BLADEcontrol-WebVIS 3.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bosch
Affected products: bladecontrol-webvis
CVE-2016-4509 (published 2016-07-03)
Heap-based buffer overflow in elcsoft.exe in Eaton ELCSoft 2.4.01 and earlier allows remote authenticated users to execute arbitrary code via a crafted file.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L)
Weakness: CWE-119
Affected vendors: eaton
Affected products: elcsoft
CVE-2016-4510 (published 2016-06-09)
The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-287
Affected vendors: trihedral
Affected products: vtscada
CVE-2016-4511 (published 2016-06-10)
ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
Weakness: CWE-310
Affected vendors: abb
Affected products: pcm600
CVE-2016-4512 (published 2016-07-03)
Stack-based buffer overflow in ELCSimulator in Eaton ELCSoft 2.4.01 and earlier allows remote attackers to execute arbitrary code via a long packet.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-119
Affected vendors: eaton
Affected products: elcsoft
CVE-2016-4513 (published 2016-06-26)
Cross-site scripting (XSS) vulnerability in the Schneider Electric PowerLogic PM8ECC module before 2.651 for PowerMeter 800 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: schneider-electric
Affected products: powerlogic_pm8ecc, powerlogic_pm8ecc_firmware
CVE-2016-4514 (published 2016-06-19)
Moxa PT-7728 devices with software 3.4 build 15081113 allow remote authenticated users to change the configuration via vectors involving a local proxy.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L)
Weakness: CWE-863
Affected vendors: moxa
Affected products: pt-7728, pt-7728_firmware
CVE-2016-4516 (published 2016-06-10)
ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors.
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: abb
Affected products: pcm600
CVE-2016-4518 (published 2016-06-19)
OSIsoft PI AF Server before 2016 2.8.0 allows remote authenticated users to cause a denial of service (service outage) via a message.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: osisoft
Affected products: pi_af_server_2016