stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2016-0983 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0984.
CVE-2016-0984 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.
CVE-2016-0985 (severity: HIGH, weakness: CWE-843)
Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."
CVE-2016-0986 (severity: HIGH, weakness: CWE-119)
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
CVE-2016-0987 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0988 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0989 (severity: HIGH, weakness: CWE-119)
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.
CVE-2016-0990 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0991 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0992 (severity: HIGH, weakness: CWE-119)
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1002, and CVE-2016-1005.
CVE-2016-0993 (severity: HIGH, weakness: CWE-190)
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
CVE-2016-0994 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0995 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0996 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0997 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0998 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.
CVE-2016-0999 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.
CVE-2016-1000 (severity: HIGH, weakness: CWE-416)
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.
CVE-2016-1000000 (severity: HIGH, weakness: CWE-89)
Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection
CVE-2016-1000001 (severity: HIGH, weakness: CWE-601)
flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect
CVE-2016-1000002 (severity: LOW, weakness: CWE-200)
gdm3 3.14.2 and possibly later has an information leak before screen lock
CVE-2016-1000003 (severity: CRITICAL, weakness: CWE-94)
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
CVE-2016-1000004 (severity: CRITICAL, weakness: CWE-345)
Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
CVE-2016-1000005 (severity: CRITICAL, weakness: CWE-843)
mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
CVE-2016-1000006 (severity: CRITICAL, weakness: CWE-416)
hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.
CVE-2016-1000007 (severity: MEDIUM, weakness: CWE-79)
Pagure 2.2.1 XSS in raw file endpoint
CVE-2016-1000009 (severity: HIGH, weakness: CWE-254)
TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.
CVE-2016-1000027 (severity: CRITICAL, weakness: CWE-502)
Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVE-2016-1000028 (severity: MEDIUM, weakness: CWE-79)
Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impact other admins. (Tenable ID 5198).
CVE-2016-1000029 (severity: MEDIUM, weakness: CWE-79)
Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would potentially impact other admins (Tenable IDs 5218 and 5269).
CVE-2016-1000030 (severity: CRITICAL, weakness: CWE-295)
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
CVE-2016-1000031 (severity: CRITICAL, weakness: CWE-284)
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
CVE-2016-1000032 (severity: HIGH, weakness: CWE-284)
TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.
CVE-2016-1000033 (severity: LOW, weakness: CWE-295)
Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.
CVE-2016-1000037 (severity: MEDIUM, weakness: CWE-79)
Pagure: XSS possible in file attachment endpoint
CVE-2016-1000104 (severity: HIGH, weakness: CWE-20)
A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07.
CVE-2016-1000107 (severity: MEDIUM, weakness: CWE-601)
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVE-2016-1000108 (severity: MEDIUM, weakness: CWE-601)
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVE-2016-1000109 (severity: MEDIUM, weakness: CWE-665)
HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).
CVE-2016-1000110 (severity: MEDIUM, weakness: CWE-601)
The CGIHandler class in Python before 2.7.12 does not protect against the HTTP_PROXY variable name clash in a CGI script, which could allow a remote attacker to redirect HTTP requests.
CVE-2016-1000111 (severity: MEDIUM, weakness: CWE-425)
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVE-2016-1000112 (severity: CRITICAL, weakness: CWE-22)
Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
CVE-2016-1000113 (severity: CRITICAL, weakness: CWE-89)
XSS and SQLi in huge IT gallery v1.1.5 for Joomla
CVE-2016-1000114 (severity: MEDIUM, weakness: CWE-79)
XSS in huge IT gallery v1.1.5 for Joomla
CVE-2016-1000115 (severity: HIGH, weakness: CWE-79)
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
CVE-2016-1000116 (severity: HIGH, weakness: CWE-79)
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
CVE-2016-1000117 (severity: HIGH, weakness: CWE-79)
XSS & SQLi in HugeIT slideshow v1.0.4
CVE-2016-1000118 (severity: HIGH, weakness: CWE-79)
XSS & SQLi in HugeIT slideshow v1.0.4
CVE-2016-1000119 (severity: HIGH, weakness: CWE-79)
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
CVE-2016-1000120 (severity: HIGH, weakness: CWE-89)
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
CVE-2016-1000121 (severity: MEDIUM, weakness: CWE-79)
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
CVE-2016-1000122 (severity: HIGH, weakness: CWE-89)
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
CVE-2016-1000123 (severity: CRITICAL, weakness: CWE-89)
Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
CVE-2016-1000124 (severity: CRITICAL, weakness: CWE-89)
Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
CVE-2016-1000125 (severity: CRITICAL, weakness: CWE-89)
Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
CVE-2016-1000126 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin admin-font-editor v1.8
CVE-2016-1000127 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin ajax-random-post v2.00
CVE-2016-1000128 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin anti-plagiarism v3.60
CVE-2016-1000129 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin defa-online-image-protector v3.3
CVE-2016-1000130 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin e-search v1.0
CVE-2016-1000131 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin e-search v1.0
CVE-2016-1000132 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8
CVE-2016-1000133 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1
CVE-2016-1000134 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin hdw-tube v1.2
CVE-2016-1000135 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin hdw-tube v1.2
CVE-2016-1000136 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin heat-trackr v1.0
CVE-2016-1000137 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin hero-maps-pro v2.1.0
CVE-2016-1000138 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin indexisto v1.0.5
CVE-2016-1000139 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin infusionsoft v1.5.11
CVE-2016-1000140 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin new-year-firework v1.1.9
CVE-2016-1000141 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin page-layout-builder v1.9.3
CVE-2016-1000142 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin parsi-font v4.2.5
CVE-2016-1000143 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin photoxhibit v2.1.8
CVE-2016-1000144 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin photoxhibit v2.1.8
CVE-2016-1000145 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin pondol-carousel v1.0
CVE-2016-1000146 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin pondol-formmail v1.1
CVE-2016-1000147 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin recipes-writer v1.0.4
CVE-2016-1000148 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin s3-video v0.983
CVE-2016-1000149 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin simpel-reserveren v3.5.2
CVE-2016-1000150 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin simplified-content v1.0.0
CVE-2016-1000151 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin tera-charts v1.0
CVE-2016-1000152 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin tidio-form v1.0
CVE-2016-1000153 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin tidio-gallery v1.1
CVE-2016-1000154 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin whizz v1.0.7
CVE-2016-1000155 (severity: MEDIUM, weakness: CWE-79)
Reflected XSS in wordpress plugin wpsolr-search-engine v7.6
CVE-2016-1000156 (severity: CRITICAL, weakness: CWE-77)
Mailcwp remote file upload vulnerability incomplete fix v1.100
CVE-2016-10002 (severity: HIGH, weakness: CWE-200)
Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.
CVE-2016-1000213 (severity: HIGH, weakness: CWE-352)
Ruckus Wireless H500 web management interface CSRF
CVE-2016-1000214 (severity: MEDIUM, weakness: CWE-200)
Ruckus Wireless H500 web management interface authentication bypass
CVE-2016-1000215 (severity: HIGH, weakness: NVD-CWE-Other)
Ruckus Wireless H500 web management interface denial of service
CVE-2016-1000216 (severity: HIGH, weakness: CWE-78)
Ruckus Wireless H500 web management interface authenticated command injection
CVE-2016-1000217 (severity: CRITICAL, weakness: CWE-89)
Zotpress plugin for WordPress SQLi in zp_get_account()
CVE-2016-1000218 (severity: HIGH, weakness: CWE-352)
Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page.
CVE-2016-1000219 (severity: HIGH, weakness: CWE-285)
Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.
CVE-2016-1000220 (severity: MEDIUM, weakness: CWE-79)
Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.
CVE-2016-1000221 (severity: HIGH, weakness: CWE-200)
Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
CVE-2016-1000222 (severity: HIGH, weakness: CWE-88)
Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.
CVE-2016-1000229 (severity: MEDIUM, weakness: CWE-79)
swagger-ui has XSS in key names
CVE-2016-1000232 (severity: MEDIUM, weakness: CWE-20)
NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.
CVE-2016-1000236 (severity: MEDIUM, weakness: CWE-362)
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
CVE-2016-1000237 (severity: MEDIUM, weakness: CWE-79)
sanitize-html before 1.4.3 has XSS.
CVE-2016-1000271 (severity: CRITICAL, weakness: CWE-89)
Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.
CVE-2016-1000282 (severity: CRITICAL, weakness: CWE-77)
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.