stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2016-1084 (severity: CRITICAL, weakness: CWE-119)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVE-2016-10840 (severity: HIGH, weakness: CWE-668)
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
CVE-2016-10841 (severity: MEDIUM, weakness: CWE-199)
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
CVE-2016-10842 (severity: MEDIUM, weakness: CWE-20)
cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
CVE-2016-10843 (severity: HIGH, weakness: CWE-77)
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
CVE-2016-10844 (severity: MEDIUM, weakness: CWE-200)
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
CVE-2016-10845 (severity: HIGH, weakness: CWE-74)
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
CVE-2016-10846 (severity: HIGH, weakness: CWE-275)
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
CVE-2016-10847 (severity: HIGH, weakness: CWE-74)
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
CVE-2016-10848 (severity: HIGH, weakness: CWE-285)
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
CVE-2016-10849 (severity: MEDIUM, weakness: CWE-77)
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
CVE-2016-1085 (severity: CRITICAL, weakness: CWE-119)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVE-2016-10850 (severity: HIGH, weakness: CWE-20)
cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
CVE-2016-10851 (severity: MEDIUM, weakness: CWE-79)
cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
CVE-2016-10852 (severity: MEDIUM, weakness: CWE-284)
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
CVE-2016-10853 (severity: MEDIUM, weakness: CWE-79)
cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
CVE-2016-10854 (severity: MEDIUM, weakness: CWE-79)
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
CVE-2016-10855 (severity: CRITICAL, weakness: CWE-20)
cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
CVE-2016-10856 (severity: MEDIUM, weakness: CWE-284)
cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
CVE-2016-10857 (severity: MEDIUM, weakness: CWE-284)
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
CVE-2016-10858 (severity: CRITICAL, weakness: CWE-20)
cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
CVE-2016-10859 (severity: HIGH, weakness: CWE-285)
cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
CVE-2016-1086 (severity: CRITICAL, weakness: CWE-119)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVE-2016-10860 (severity: HIGH, weakness: CWE-284)
cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
CVE-2016-10861 (severity: MEDIUM, weakness: CWE-352)
Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
CVE-2016-10862 (severity: HIGH, weakness: CWE-352)
Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
CVE-2016-10863 (severity: HIGH, weakness: CWE-352)
Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
CVE-2016-10864 (severity: MEDIUM, weakness: CWE-79)
NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
CVE-2016-10865 (severity: MEDIUM, weakness: CWE-352)
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
CVE-2016-10866 (severity: MEDIUM, weakness: CWE-79)
The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
CVE-2016-10867 (severity: MEDIUM, weakness: CWE-79)
The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
CVE-2016-10868 (severity: MEDIUM, weakness: CWE-79)
The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
CVE-2016-10869 (severity: MEDIUM, weakness: CWE-79)
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
CVE-2016-1087 (severity: HIGH, weakness: NVD-CWE-Other)
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1090 and CVE-2016-4106.
CVE-2016-10870 (severity: MEDIUM, weakness: CWE-79)
The google-language-translator plugin before 5.0.06 for WordPress has XSS.
CVE-2016-10871 (severity: MEDIUM, weakness: CWE-79)
The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
CVE-2016-10872 (severity: MEDIUM, weakness: CWE-79)
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
CVE-2016-10873 (severity: MEDIUM, weakness: CWE-79)
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
CVE-2016-10874 (severity: HIGH, weakness: CWE-352)
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
CVE-2016-10875 (severity: MEDIUM, weakness: CWE-79)
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
CVE-2016-10876 (severity: HIGH, weakness: CWE-352)
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
CVE-2016-10877 (severity: MEDIUM, weakness: CWE-79)
The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
CVE-2016-10878 (severity: MEDIUM, weakness: CWE-79)
The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
CVE-2016-10879 (severity: MEDIUM, weakness: CWE-79)
The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
CVE-2016-1088 (severity: CRITICAL, weakness: CWE-119)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVE-2016-10880 (severity: MEDIUM, weakness: CWE-79)
The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
CVE-2016-10881 (severity: MEDIUM, weakness: CWE-79)
The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
CVE-2016-10882 (severity: HIGH, weakness: CWE-352)
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
CVE-2016-10883 (severity: MEDIUM, weakness: CWE-352)
The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
CVE-2016-10884 (severity: HIGH, weakness: CWE-352)
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
CVE-2016-10885 (severity: HIGH, weakness: CWE-352)
The wp-editor plugin before 1.2.6 for WordPress has CSRF.
CVE-2016-10886 (severity: CRITICAL, weakness: CWE-264)
The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
CVE-2016-10887 (severity: CRITICAL, weakness: CWE-89)
The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
CVE-2016-10888 (severity: CRITICAL, weakness: CWE-89)
The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
CVE-2016-10889 (severity: CRITICAL, weakness: CWE-89)
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
CVE-2016-1089 (severity: CRITICAL, weakness: CWE-416)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
CVE-2016-10890 (severity: MEDIUM, weakness: CWE-79)
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
CVE-2016-10891 (severity: MEDIUM, weakness: CWE-79)
The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
CVE-2016-10892 (severity: MEDIUM, weakness: CWE-79)
The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
CVE-2016-10893 (severity: MEDIUM, weakness: CWE-79)
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
CVE-2016-10894 (severity: MEDIUM, weakness: CWE-254)
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
CVE-2016-10895 (severity: MEDIUM, weakness: CWE-79)
The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
CVE-2016-10896 (severity: MEDIUM, weakness: CWE-79)
The seo-redirection plugin before 4.3 for WordPress has stored XSS.
CVE-2016-10897 (severity: MEDIUM, weakness: CWE-79)
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
CVE-2016-10898 (severity: MEDIUM, weakness: CWE-79)
The total-security plugin before 3.4.1 for WordPress has XSS.
CVE-2016-10899 (severity: MEDIUM, weakness: CWE-20)
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
CVE-2016-1090 (severity: HIGH, weakness: NVD-CWE-Other)
Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-4106.
CVE-2016-10900 (severity: MEDIUM, weakness: CWE-79)
The uji-countdown plugin before 2.0.7 for WordPress has XSS.
CVE-2016-10901 (severity: MEDIUM, weakness: CWE-79)
The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
CVE-2016-10902 (severity: HIGH, weakness: CWE-352)
The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
CVE-2016-10903 (severity: HIGH, weakness: CWE-352)
The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
CVE-2016-10904 (severity: CRITICAL, weakness: CWE-89)
The olimometer plugin before 2.57 for WordPress has SQL injection.
CVE-2016-10905 (severity: HIGH, weakness: CWE-416)
An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
CVE-2016-10906 (severity: HIGH, weakness: CWE-362)
An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
CVE-2016-10907 (severity: HIGH, weakness: CWE-787)
An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
CVE-2016-10908 (severity: MEDIUM, weakness: CWE-79)
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
CVE-2016-10909 (severity: CRITICAL, weakness: CWE-89)
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
CVE-2016-1091 (severity: CRITICAL, weakness: CWE-416)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
CVE-2016-10910 (severity: MEDIUM, weakness: CWE-79)
The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
CVE-2016-10911 (severity: MEDIUM, weakness: CWE-79)
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
CVE-2016-10912 (severity: MEDIUM, weakness: CWE-79)
The universal-analytics plugin before 1.3.1 for WordPress has XSS.
CVE-2016-10913 (severity: MEDIUM, weakness: CWE-79)
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
CVE-2016-10914 (severity: HIGH, weakness: CWE-352)
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
CVE-2016-10915 (severity: HIGH, weakness: CWE-352)
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
CVE-2016-10916 (severity: CRITICAL, weakness: CWE-89)
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
CVE-2016-10917 (severity: CRITICAL, weakness: CWE-89)
The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
CVE-2016-10918 (severity: HIGH, weakness: CWE-352)
The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
CVE-2016-10919 (severity: MEDIUM, weakness: CWE-79)
The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
CVE-2016-1092 (severity: HIGH, weakness: CWE-200)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1079.
CVE-2016-10920 (severity: MEDIUM, weakness: CWE-79)
The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
CVE-2016-10921 (severity: CRITICAL, weakness: CWE-89)
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
CVE-2016-10922 (severity: CRITICAL, weakness: CWE-264)
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
CVE-2016-10923 (severity: CRITICAL, weakness: CWE-264)
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
CVE-2016-10924 (severity: HIGH, weakness: CWE-22)
The ebook-download plugin before 1.2 for WordPress has directory traversal.
CVE-2016-10925 (severity: MEDIUM, weakness: CWE-79)
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
CVE-2016-10926 (severity: CRITICAL, weakness: CWE-918)
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
CVE-2016-10927 (severity: CRITICAL, weakness: CWE-918)
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
CVE-2016-10928 (severity: HIGH, weakness: CWE-798)
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
CVE-2016-10929 (severity: MEDIUM, weakness: CWE-264)
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
CVE-2016-1093 (severity: CRITICAL, weakness: CWE-119)
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
CVE-2016-10930 (severity: CRITICAL, weakness: CWE-20)
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
CVE-2016-10931 (severity: HIGH, weakness: CWE-295)
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
CVE-2016-10932 (severity: MEDIUM, weakness: CWE-254)
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
CVE-2016-10933 (severity: MEDIUM, weakness: CWE-254)
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
CVE-2016-10934 (severity: MEDIUM, weakness: CWE-79)
The check-email plugin before 0.5.2 for WordPress has XSS.
CVE-2016-10935 (severity: CRITICAL, weakness: CWE-264)
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
CVE-2016-10936 (severity: MEDIUM, weakness: CWE-79)
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
CVE-2016-10937 (severity: HIGH, weakness: CWE-295)
IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
CVE-2016-10938 (severity: MEDIUM, weakness: CWE-352)
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
CVE-2016-10939 (severity: HIGH, weakness: CWE-89)
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
CVE-2016-1094 (severity: CRITICAL, weakness: NVD-CWE-Other)
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
CVE-2016-10940 (severity: HIGH, weakness: CWE-89)
The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
CVE-2016-10941 (severity: MEDIUM, weakness: CWE-79)
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
CVE-2016-10942 (severity: CRITICAL, weakness: CWE-89)
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
CVE-2016-10943 (severity: HIGH, weakness: CWE-89)
The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.