deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-6692
Published: 2016-10-10
Description: drivers/video/msm/mdss/mdss_mdp_pp.c in the Qualcomm MDSS driver in Android before 2016-10-05 allows attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via unknown vectors, aka Qualcomm internal bug CR 1004933.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=0f0e7047d39f9fb3a1a7f389918ff79cdb4a50b3
CVE: CVE-2016-6693
Published: 2016-10-10
Description: sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via an invalid data length, aka Qualcomm internal bug CR 1027585.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=ac328eb631fa74a63d5d2583e6bfeeb5a7a2df65
CVE: CVE-2016-6694
Published: 2016-10-10
Description: sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via crafted parameter data, aka Qualcomm internal bug CR 1033525.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=961e38553aae8ba9b1af77c7a49acfbb7b0b6f62
CVE: CVE-2016-6695
Published: 2016-10-10
Description: sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted visualizer data length, aka Qualcomm internal bug CR 1033540.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=c319c2b0926d1ea5edb4d0778d88bd3ce37c4b95
CVE: CVE-2016-6696
Published: 2016-10-10
Description: sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a large negative value for the data length, aka Qualcomm internal bug CR 1041130.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=c3c9341bfdf93606983f893a086cb33a487306e5
CVE: CVE-2016-7117
Published: 2016-10-10
Description: Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d; http://rhn.redhat.com/errata/RHSA-2016-2962.html; http://rhn.redhat.com/errata/RHSA-2017-0031.html
CVE: CVE-2016-5325
Published: 2016-10-10
Description: CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-113
References: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html; http://rhn.redhat.com/errata/RHSA-2017-0002.html; http://www.securityfocus.com/bid/93483
CVE: CVE-2016-7099
Published: 2016-10-10
Description: The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-19
References: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html; http://rhn.redhat.com/errata/RHSA-2017-0002.html; http://www.securityfocus.com/bid/93191
CVE: CVE-2016-7423
Published: 2016-10-10
Description: The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.
CVSS Score: 4.4 (MEDIUM)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5; http://www.openwall.com/lists/oss-security/2016/09/16/11; http://www.openwall.com/lists/oss-security/2016/09/16/5
CVE: CVE-2016-8100
Published: 2016-10-10
Description: Intel Integrated Performance Primitives (aka IPP) Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93484; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00060&languageid=en-fr; http://www.securityfocus.com/bid/93484
CVE: CVE-2016-8101
Published: 2016-10-10
Description: The updater subsystem in Intel SSD Toolbox before 3.3.7 allows local users to gain privileges via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/93482; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00061&languageid=en-fr; http://www.securityfocus.com/bid/93482
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin admin-font-editor v1.8
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93896; http://www.vapidlabs.com/wp/wp_advisory.php?v=526; https://wordpress.org/plugins/admin-font-editor
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin ajax-random-post v2.00
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93895; http://www.vapidlabs.com/wp/wp_advisory.php?v=494; https://wordpress.org/plugins/ajax-random-post
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin anti-plagiarism v3.60
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93890; http://www.vapidlabs.com/wp/wp_advisory.php?v=161; https://wordpress.org/plugins/anti-plagiarism
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin defa-online-image-protector v3.3
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93892; http://www.vapidlabs.com/wp/wp_advisory.php?v=449; https://wordpress.org/plugins/defa-online-image-protector
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin e-search v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.vapidlabs.com/wp/wp_advisory.php?v=394; https://wordpress.org/plugins/e-search; http://www.vapidlabs.com/wp/wp_advisory.php?v=394
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin e-search v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93867; http://www.vapidlabs.com/wp/wp_advisory.php?v=393; https://wordpress.org/plugins/e-search
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93865; http://www.vapidlabs.com/wp/wp_advisory.php?v=37; https://wordpress.org/plugins/enhanced-tooltipglossary
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93869; http://www.vapidlabs.com/wp/wp_advisory.php?v=602; https://wordpress.org/plugins/forget-about-shortcode-buttons
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin hdw-tube v1.2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93868; http://www.vapidlabs.com/wp/wp_advisory.php?v=530; https://wordpress.org/plugins/hdw-tube
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin hdw-tube v1.2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93820; http://www.vapidlabs.com/wp/wp_advisory.php?v=533; https://wordpress.org/plugins/hdw-tube
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin heat-trackr v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93818; http://www.vapidlabs.com/wp/wp_advisory.php?v=798; https://wordpress.org/plugins/heat-trackr
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93815; http://www.vapidlabs.com/wp/wp_advisory.php?v=658; https://wordpress.org/plugins/hero-maps-pro
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin indexisto v1.0.5
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93816; http://www.vapidlabs.com/wp/wp_advisory.php?v=38; https://wordpress.org/plugins/indexisto
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin infusionsoft v1.5.11
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93819; http://www.vapidlabs.com/wp/wp_advisory.php?v=864; https://wordpress.org/plugins/infusionsoft
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin new-year-firework v1.1.9
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93817; http://www.vapidlabs.com/wp/wp_advisory.php?v=453; https://wordpress.org/plugins/new-year-firework
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin page-layout-builder v1.9.3
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93804; http://www.vapidlabs.com/wp/wp_advisory.php?v=358; https://wordpress.org/plugins/page-layout-builder
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin parsi-font v4.2.5
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93802; http://www.vapidlabs.com/wp/wp_advisory.php?v=435; https://wordpress.org/plugins/parsi-font
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin photoxhibit v2.1.8
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93803; http://www.vapidlabs.com/wp/wp_advisory.php?v=780; https://wordpress.org/plugins/photoxhibit
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin photoxhibit v2.1.8
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93585; http://www.vapidlabs.com/wp/wp_advisory.php?v=778; https://wordpress.org/plugins/photoxhibit
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin pondol-carousel v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93586; http://www.vapidlabs.com/wp/wp_advisory.php?v=524; https://wordpress.org/plugins/pondol-carousel
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin pondol-formmail v1.1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93584; http://www.vapidlabs.com/wp/wp_advisory.php?v=787; https://wordpress.org/plugins/pondol-formmail
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin recipes-writer v1.0.4
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93589; http://www.vapidlabs.com/wp/wp_advisory.php?v=380; https://wordpress.org/plugins/recipes-writer
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin s3-video v0.983
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93583; http://www.vapidlabs.com/wp/wp_advisory.php?v=240; https://wordpress.org/plugins/s3-video
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93582; http://www.vapidlabs.com/wp/wp_advisory.php?v=474; https://wordpress.org/plugins/simpel-reserveren
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin simplified-content v1.0.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93581; http://www.vapidlabs.com/wp/wp_advisory.php?v=853; https://wordpress.org/plugins/simplified-content
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin tera-charts v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93580; http://www.vapidlabs.com/wp/wp_advisory.php?v=455; https://wordpress.org/plugins/tera-charts
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin tidio-form v1.0
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93579; http://www.vapidlabs.com/wp/wp_advisory.php?v=799; https://wordpress.org/plugins/tidio-form
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin tidio-gallery v1.1
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93543; http://www.vapidlabs.com/wp/wp_advisory.php?v=427; https://wordpress.org/plugins/tidio-gallery
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin whizz v1.0.7
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93538; http://www.vapidlabs.com/wp/wp_advisory.php?v=112; https://wordpress.org/plugins/whizz
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93536; http://www.vapidlabs.com/wp/wp_advisory.php?v=303; https://wordpress.org/plugins/wpsolr-search-engine
CVE: CVE-2[PII_REDACTED]
Published: 2016-10-10
Description: Ruckus Wireless H500 web management interface authenticated command injection
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt; http://www.securityfocus.com/bid/93539; http://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/
CVE: CVE-2016-7959
Published: 2016-10-13
Description: Siemens SIMATIC STEP 7 (TIA Portal) before 14 improperly stores pre-shared key data in TIA project files, which makes it easier for local users to obtain sensitive information by leveraging access to a file and conducting a brute-force attack.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-254
References: http://www.securityfocus.com/bid/93551; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-869766.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-03
CVE: CVE-2016-7960
Published: 2016-10-13
Description: Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors.
CVSS Score: 2.5 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/93551; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-869766.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-03
CVE: CVE-2016-8563
Published: 2016-10-13
Description: Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to cause a denial of service (ALM service outage) via crafted packets to TCP port 4410.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93553; http://www.securitytracker.com/id/1037011; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284342.pdf
CVE: CVE-2016-8564
Published: 2016-10-13
Description: SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www.securityfocus.com/bid/93553; http://www.securitytracker.com/id/1037011; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284342.pdf
CVE: CVE-2016-8565
Published: 2016-10-13
Description: Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/93553; http://www.securitytracker.com/id/1037011; http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284342.pdf
CVE: CVE-2016-3635
Published: 2016-10-13
Description: SAP Netweaver 7.4 allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list and execute arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly, aka SAP Security Note 2139366.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2016/Oct/48; http://www.securityfocus.com/bid/93501; https://www.onapsis.com/research/security-advisories/sap-ucon-security-protection-bypass
CVE: CVE-2016-3638
Published: 2016-10-13
Description: SAP SLD Registration Program (aka SLDREG) allows local users to cause a denial of service (memory corruption and process termination) via a crafted HOST parameter, aka SAP Security Note 2125623.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://packetstormsecurity.com/files/139096/SAP-SLDREG-Memory-Corruption.html; http://seclists.org/fulldisclosure/2016/Oct/52; http://www.securityfocus.com/bid/93500
CVE: CVE-2016-3946
Published: 2016-10-13
Description: SAP Console (aka SAPConsole) 7.30 allows local users to discover SAP Server login credentials by reading the Windows registry, aka SAP Security Note 2121461.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-255
References: http://seclists.org/fulldisclosure/2016/Oct/31; http://www.securityfocus.com/bid/93509; https://www.onapsis.com/research/security-advisories/sap-console-insecure-password-storage
CVE: CVE-2016-4407
Published: 2016-10-13
Description: The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2016/Oct/32; http://www.securityfocus.com/bid/93502; https://www.onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm
CVE: CVE-2016-5425
Published: 2016-10-13
Description: The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://legalhackers.com/advisories/Tomcat-RedHat-Pkgs-Root-PrivEsc-Exploit-CVE-2016-5425.html; http://packetstormsecurity.com/files/139041/Apache-Tomcat-8-7-6-Privilege-Escalation.html; http://rhn.redhat.com/errata/RHSA-2016-2046.html
CVE: CVE-2016-6325
Published: 2016-10-13
Description: The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2016-2045.html; http://rhn.redhat.com/errata/RHSA-2016-2046.html; http://rhn.redhat.com/errata/RHSA-2017-0457.html
CVE: CVE-2016-7065
Published: 2016-10-13
Description: The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://seclists.org/fulldisclosure/2016/Nov/143; http://www.securityfocus.com/bid/93462; https://bugzilla.redhat.com/show_bug.cgi?id=1382534
CVE: CVE-2016-7437
Published: 2016-10-13
Description: SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 2252312.
CVSS Score: 3.3 (LOW)
References: http://seclists.org/fulldisclosure/2016/Oct/53; http://www.securityfocus.com/bid/93503; https://www.onapsis.com/research/security-advisories/sap-business-objects-memory-corruption-0
CVE: CVE-2016-7795
Published: 2016-10-13
Description: The manager_invoke_notify_message function in systemd 231 and earlier allows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2610.html; http://rhn.redhat.com/errata/RHSA-2016-2694.html; http://www.openwall.com/lists/oss-security/2016/09/28/9
CVE: CVE-2016-7796
Published: 2016-10-13
Description: The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00016.html; http://rhn.redhat.com/errata/RHSA-2017-0003.html
CVE: CVE-2016-1089
Published: 2016-10-13
Description: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/93491; http://www.securitytracker.com/id/1036986; https://helpx.adobe.com/security/products/acrobat/apsb16-33.html