yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-10917: The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.
Key phrases: sql injection
CVE-2016-10918: The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10919: The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.
Key phrases: xss
CVE-2016-1092: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1079.
Key phrases: obtain sensitive information, obtain sensitive information from process memory via unspecified
CVE-2016-10920: The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.
Key phrases: xss
CVE-2016-10921: The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.
Key phrases: sql injection
CVE-2016-10922: The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-10923: The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-10924: The ebook-download plugin before 1.2 for WordPress has directory traversal.
Key phrases: directory traversal
CVE-2016-10925: The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Key phrases: xss
CVE-2016-10926: The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Key phrases: ssrf
CVE-2016-10927: The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Key phrases: ssrf
CVE-2016-10928: The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Key phrases: hardcoded
CVE-2016-10929: The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Key phrases: reading of uploaded files
CVE-2016-1093: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10930: The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Key phrases: insecure direct object reference
CVE-2016-10931: An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Key phrases: man-in-the-middle, man in the middle
CVE-2016-10932: An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
Key phrases: https man-in-the-middle, man in the middle
CVE-2016-10933: An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
Key phrases: man-in-the-middle issue, man in the middle
CVE-2016-10934: The check-email plugin before 0.5.2 for WordPress has XSS.
Key phrases: xss
CVE-2016-10935: The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-10936: The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Key phrases: xss
CVE-2016-10937: IMAPFilter through 2.6.12 does not validate the hostname in an SSL certificate.
CVE-2016-10938: The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location.
Key phrases: csrf
CVE-2016-10939: The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.
Key phrases: sql injection
CVE-2016-1094: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1075, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-10940: The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.
Key phrases: sql injection
CVE-2016-10941: The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.
Key phrases: xss, csrf
CVE-2016-10942: The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.
Key phrases: sql injection, csrf
CVE-2016-10943: The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.
Key phrases: sql injection
CVE-2016-10944: The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.
Key phrases: csrf
CVE-2016-10945: The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF.
Key phrases: csrf
CVE-2016-10946: The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10947: The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
Key phrases: sql injection
CVE-2016-10948: The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
CVE-2016-10949: The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
Key phrases: sql injection, unsafe unserialization
CVE-2016-1095: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10950: The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
Key phrases: sql injection
CVE-2016-10951: The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
Key phrases: sql injection
CVE-2016-10952: The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.
Key phrases: xss
CVE-2016-10953: The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
Key phrases: xss
CVE-2016-10954: The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
Key phrases: unrestricted file upload
CVE-2016-10955: The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
Key phrases: unrestricted file upload, incorrect session tracking
CVE-2016-10956: The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.
Key phrases: local file inclusion
CVE-2016-10957: The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.
Key phrases: xss
CVE-2016-10958: The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.
Key phrases: unauthenticated arbitrary file upload
CVE-2016-10959: The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.
Key phrases: authenticated arbitrary file upload, csrf
CVE-2016-1096: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-10960: The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.
Key phrases: remote code execution, shell metacharacters
CVE-2016-10961: The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.
Key phrases: xss
CVE-2016-10962: The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.
Key phrases: csrf
CVE-2016-10963: The icegram plugin before 1.9.19 for WordPress has XSS.
Key phrases: xss
CVE-2016-10964: The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.
Key phrases: xss
CVE-2016-10965: The real3d-flipbook-lite plugin 1.0 for WordPress has deleteBook=../ directory traversal for file deletion.
Key phrases: deletebook=.. directory traversal
CVE-2016-10966: The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload.
Key phrases: directory traversal, file upload
CVE-2016-10967: The real3d-flipbook-lite plugin 1.0 for WordPress has XSS via the wp-content/plugins/real3d-flipbook/includes/flipbooks.php bookId parameter.
Key phrases: xss
CVE-2016-10968: The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.
Key phrases: peepsoprofilepreferencesajax->save() privilege escalation
CVE-2016-10969: The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
Key phrases: xss
CVE-2016-1097: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-10970: The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.
Key phrases: xss
CVE-2016-10971: The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.
Key phrases: login access control
CVE-2016-10972: The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
Key phrases: options access control
CVE-2016-10973: The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.
Key phrases: xss
CVE-2016-10974: The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.
Key phrases: frs_save csrf, stored xss
CVE-2016-10975: The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.
Key phrases: xss
CVE-2016-10976: The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.
Key phrases: xss
CVE-2016-10977: The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.
Key phrases: directory traversal
CVE-2016-10978: The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10979: The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.
Key phrases: xss
CVE-2016-1098: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-10980: The kento-post-view-counter plugin through 2.8 for WordPress has XSS via kento_pvc_geo.
Key phrases: xss
CVE-2016-10981: The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.
Key phrases: xss
CVE-2016-10982: The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvc_settings CSRF.
Key phrases: csrf
CVE-2016-10983: The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.
Key phrases: access control
CVE-2016-10984: The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.
Key phrases: xss
CVE-2016-10985: The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.
Key phrases: xss
CVE-2016-10986: The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.
Key phrases: xss
CVE-2016-10987: The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.
Key phrases: ps_sms_numbers xss
CVE-2016-10988: The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.
Key phrases: xss
CVE-2016-10989: The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.
Key phrases: csrf
CVE-2016-1099: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-10990: The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.
Key phrases: xss
CVE-2016-10991: The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.
Key phrases: local file inclusion
CVE-2016-10992: The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
Key phrases: xss
CVE-2016-10993: The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.
Key phrases: xss
CVE-2016-10994: The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
Key phrases: xss
CVE-2016-10995: The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.
Key phrases: has arbitrary file upload
CVE-2016-10996: The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.
Key phrases: nonce leak, incorrect access control
CVE-2016-10997: The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php.
Key phrases: csrf, arbitrary file upload
CVE-2016-10998: The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS.
Key phrases: xss
CVE-2016-10999: The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter.
Key phrases: xss
CVE-2016-1100: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11000: The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.
Key phrases: sql injection
CVE-2016-11001: The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.
Key phrases: xss
CVE-2016-11002: The Elegant Themes Extra theme before 1.2.4 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-11003: The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-11004: The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.
Key phrases: privilege escalation
CVE-2016-11005: The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.
Key phrases: xss
CVE-2016-11006: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
Key phrases: incorrect access control
CVE-2016-11007: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
Key phrases: incorrect access control
CVE-2016-11008: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
Key phrases: incorrect access control
CVE-2016-11009: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
Key phrases: incorrect access control
CVE-2016-1101: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11010: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
Key phrases: incorrect access control
CVE-2016-11011: The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
Key phrases: wpi_update_user_option privilege escalation
CVE-2016-11012: The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.
Key phrases: xss, incorrect access control
CVE-2016-11013: The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.
Key phrases: includes views single-listing.php xss
CVE-2016-11014: NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case.
Key phrases: incorrect access control
CVE-2016-11015: NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1.URL parameter.
Key phrases: cgi-bin/webproc CSRF via the, cgi-bin webproc csrf
CVE-2016-11016: NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.
Key phrases: webproc?getpage= XSS, xss
CVE-2016-11017: The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter (a failed login attempt returns the command-injection output to a limited login failure field). This is fixed in 16.6.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via shell metacharacters in, command-injection output, arbitrary os command, command injection
CVE-2016-11018: An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL injection. The affected file is gallery-images.php. The affected function is huge_it_image_gallery_ajax_callback().
Key phrases: unauthenticated sql injection
CVE-2016-1102: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11020: Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.
Key phrases: xss, remote code execution
CVE-2016-11021: setSystemCommand on D-Link DCS-930L devices before 2.12 allows a remote attacker to execute code via an OS command in the SystemCommand parameter.
Key phrases: execute code via an OS command in the, setsystemcommand
CVE-2016-11022: NETGEAR Prosafe WC9500 5.1.0.17, WC7600 5.1.0.17, and WC7520 2.5.0.35 devices allow a remote attacker to execute code with root privileges via shell metacharacters in the reqMethod parameter to login_handler.php.
Key phrases: execute code with root privileges via shell metacharacters
CVE-2016-11023: odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Key phrases: ExecuteCountQueryCommand.java SQL injection, sql injection
CVE-2016-11024: odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Key phrases: ExecuteJPQLQueryCommand.java SQL injection, sql injection
CVE-2016-11025: An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a memcpy heap-based buffer overflow in the OTP service. The Samsung ID is SVE-2016-7114 (December 2016).
Key phrases: memcpy heap-based buffer overflow, heap based buffer overflow
CVE-2016-11026: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. BootReceiver allows attackers to trigger a system crash because of incorrect exception handling. The Samsung ID is SVE-2016-7118 (December 2016).
Key phrases: trigger a system crash because of incorrect exception, bootreceiver
CVE-2016-11027: An issue was discovered on Samsung mobile devices with M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on the lock screen. The Samsung ID is SVE-2016-7132 (December 2016).
Key phrases: shade locked state
CVE-2016-11028: An issue was discovered on Samsung mobile devices with software through 2016-09-13 (Exynos AP chipsets). There is a stack-based buffer overflow in the OTP TrustZone trustlet. The Samsung IDs are SVE-2016-7173 and SVE-2016-7174 (December 2016).
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2016-11029: An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.0) software. Attackers can read the password of the Mobile Hotspot in the log because of an unprotected intent. The Samsung ID is SVE-2016-7301 (December 2016).
Key phrases: unprotected intent
CVE-2016-1103: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11030: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (with Hrm sensor support) software. The sysfs of the MAX86902 sensor driver does not prevent concurrent access, leading to a race condition and resultant heap-based buffer overflow. The Samsung ID is SVE-2016-7341 (December 2016).
Key phrases: race condition, heap-based buffer overflow, heap based buffer overflow
CVE-2016-11031: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. AntService allows a system_server crash and reboot. The Samsung ID is SVE-2016-7044 (November 2016).
Key phrases: a system_server crash and reboot, antservice
CVE-2016-11032: An issue was discovered on Samsung mobile devices with M(6.0) software. An attacker can disable all Sound functionality by broadcasting an unprotected intent. The Samsung IDs are SVE-2016-7179 and SVE-2016-7182 (November 2016).
Key phrases: unprotected intent
CVE-2016-11033: An issue was discovered on Samsung mobile devices with M(6.0) software. There is a heap-based buffer overflow in tlc_server. The Samsung IDs are SVE-2016-7220 and SVE-2016-7225 (November 2016).
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2016-11034: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. The decode function in Qjpeg in Qt 5.7 allows attackers to trigger a system crash via a malformed image. The Samsung ID is SVE-2016-6560 (October 2016).
Key phrases: trigger a system crash via a malformed image
CVE-2016-11035: An issue was discovered on Samsung mobile devices with software through 2016-05-27 (Exynos AP chipsets). A local graphics user can cause a Kernel Crash via the fb0(DECON) frame buffer interface. The Samsung ID is SVE-2016-7011 (October 2016).
Key phrases: local graphics user
CVE-2016-11036: An issue was discovered on Samsung mobile devices with M(6.0) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-6008 (August 2016).
Key phrases: bypass, factory reset protection (frp) bypass
CVE-2016-11038: An issue was discovered on Samsung mobile devices with software through 2016-04-05 (incorporating the Samsung Professional Audio SDK). The Jack audio service doesn't implement access control for shared memory, leading to arbitrary code execution or privilege escalation. The Samsung ID is SVE-2016-5953 (July 2016).
Key phrases: arbitrary code execution, privilege escalation
CVE-2016-11039: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) (AP + CP MDM9x35, or Qualcomm Onechip) software. There is a NULL pointer dereference issue in the IPC socket code. The Samsung ID is SVE-2016-5980 (July 2016).
Key phrases: null pointer dereference issue
CVE-2016-1104: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11040: An issue was discovered on Samsung mobile devices with L(5.0/5.1) (with USB OTG MyFile2014_L_ESS support) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5068 (June 2016).
Key phrases: bypass, factory reset protection (frp) bypass
CVE-2016-11041: An issue was discovered on Samsung mobile devices with KK(4.4) software. Attackers can bypass the lockscreen by sending an AT command over USB. The Samsung ID is SVE-2015-5301 (June 2016).
Key phrases: bypass the lockscreen, at command
CVE-2016-11042: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. There is a SIM Lock bypass. The Samsung ID is SVE-2016-5381 (June 2016).
Key phrases: SIM Lock bypass, sim lock bypass
CVE-2016-11043: An issue was discovered on Samsung mobile devices with M(6.0) software. The S/MIME implementation in EAS uses DES (where 3DES is intended). The Samsung ID is SVE-2016-5871 (June 2016).
CVE-2016-11044: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can be bypassed during installation. The Samsung ID is SVE-2016-5923 (June 2016).
CVE-2016-11045: An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. The Gallery library allow memory corruption via a malformed image. The Samsung ID is SVE-2016-5317 (May 2016).
Key phrases: memory corruption via a malformed image
CVE-2016-11046: An issue was discovered on Samsung mobile devices with JBP(4.3), KK(4.4), and L(5.0/5.1) software. Because of a misused whitelist, attackers can reach the radio layer (aka RIL or RILD) to place calls or send SMS messages. The Samsung ID is SVE-2016-5733 (May 2016).
Key phrases: misused whitelist
CVE-2016-11047: An issue was discovered on Samsung mobile devices with JBP(4.2) and KK(4.4) (Marvell chipsets) software. The ACIPC-MSOCKET driver allows local privilege escalation via a stack-based buffer overflow. The Samsung ID is SVE-2016-5393 (April 2016).
Key phrases: local privilege escalation via a stack-based, stack-based buffer overflow, stack based buffer overflow
CVE-2016-11048: An issue was discovered on Samsung mobile devices with L(5.0/5.1) (Spreadtrum or Marvell chipsets) software. There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2016-5421 (March 2016).
Key phrases: bypass, factory reset protection (frp) bypass
CVE-2016-11049: An issue was discovered on Samsung mobile devices with software through 2016-01-16 (Shannon333/308/310 chipsets). The IMEI may be retrieved and modified because of an error in managing key information. The Samsung ID is SVE-2016-5435 (March 2016).
CVE-2016-1105: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11050: An issue was discovered on Samsung mobile devices with S3(KK), Note2(KK), S4(L), Note3(L), and S5(L) software. An attacker can rewrite the IMEI by flashing crafted firmware. The Samsung ID is SVE-2016-5562 (March 2016).
CVE-2016-11052: An issue was discovered on Samsung mobile devices with L(5.0/5.1) software. je_free in libQjpeg.so in Qjpeg in Qt 5.5 allows memory corruption via a malformed JPEG file. The Samsung ID is SVE-2015-5110 (January 2016).
Key phrases: memory corruption via a malformed JPEG file
CVE-2016-11053: An issue was discovered on Samsung mobile devices with software through 2015-11-11 (supporting FRP/RL). There is a Factory Reset Protection (FRP) bypass. The Samsung ID is SVE-2015-5131 (January 2016).
Key phrases: bypass, factory reset protection (frp) bypass
CVE-2016-11054: NETGEAR DGN2200v4 devices before 2017-01-06 are affected by command execution and an FTP insecure root directory.
Key phrases: command execution, ftp insecure root directory
CVE-2016-11055: Certain NETGEAR devices are affected by CSRF. This affects CM400 before 2017-01-11, CM600 before 2017-01-11, D1500 before 2017-01-11, D500 before 2017-01-11, DST6501 before 2017-01-11, JNR1010v1 before 2017-01-11, JWNR2000Tv3 before 2017-01-11, JWNR2010v3 before 2017-01-11, PLW1000 before 2017-01-11, PLW1010 before 2017-01-11, WNR500 before 2017-01-11, WNR612v3 before 2017-01-11, N450 before 2017-01-11, and CG3000Dv2 before 2017-01-11.
Key phrases: csrf
CVE-2016-11056: Certain NETGEAR devices are affected by anonymous root access. This affects ReadyNAS Surveillance 1.1.1-3-armel and earlier and ReadyNAS Surveillance 1.4.1-3-amd64 and earlier.
Key phrases: anonymous root access
CVE-2016-11057: Certain NETGEAR devices are affected by mishandling of repeated URL calls. This affects JNR1010v2 before 2017-01-06, WNR614 before 2017-01-06, WNR618 before 2017-01-06, JWNR2000v5 before 2017-01-06, WNR2020 before 2017-01-06, JWNR2010v5 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2020v2 before 2017-01-06, R6220 before 2017-01-06, and WNDR3700v5 before 2017-01-06.
Key phrases: mishandling of repeated url calls
CVE-2016-11058: The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs.
Key phrases: hard-coded api keys, session ids
CVE-2016-11059: Certain NETGEAR devices are affected by password exposure. This affects AC1450 before 2017-01-06, C6300 before 2017-01-06, D500 before 2017-01-06, D1500 before 2017-01-06, D3600 before 2017-01-06, D6000 before 2017-01-06, D6100 before 2017-01-06, D6200 before 2017-01-06, D6200B before 2017-01-06, D6300B before 2017-01-06, D6300 before 2017-01-06, DGN1000v3 before 2017-01-06, DGN2200v1 before 2017-01-06, DGN2200v3 before 2017-01-06, DGN2200V4 before 2017-01-06, DGN2200Bv3 before 2017-01-06, DGN2200Bv4 before 2017-01-06, DGND3700v1 before 2017-01-06, DGND3700v2 before 2017-01-06, DGND3700Bv2 before 2017-01-06, JNR1010v1 before 2017-01-06, JNR1010v2 before 2017-01-06, JNR3300 before 2017-01-06, JR6100 before 2017-01-06, JR6150 before 2017-01-06, JWNR2000v5 before 2017-01-06, R2000 before 2017-01-06, R6050 before 2017-01-06, R6100 before 2017-01-06, R6200 before 2017-01-06, R6200v2 before 2017-01-06, R6220 before 2017-01-06, R6250 before 2017-01-06, R6300 before 2017-01-06, R6300v2 before 2017-01-06, R6700 before 2017-01-06, R7000 before 2017-01-06, R7900 before 2017-01-06, R7500 before 2017-01-06, R8000 before 2017-01-06, WGR614v10 before 2017-01-06, WNR1000v2 before 2017-01-06, WNR1000v3 before 2017-01-06, WNR1000v4 before 2017-01-06, WNR2000v3 before 2017-01-06, WNR2000v4 before 2017-01-06, WNR2000v5 before 2017-01-06, WNR2200 before 2017-01-06, WNR2500 before 2017-01-06, WNR3500Lv2 before 2017-01-06, WNDR3400v2 before 2017-01-06, WNDR3400v3 before 2017-01-06, WNDR3700v3 before 2017-01-06, WNDR3700v4 before 2017-01-06, WNDR3700v5 before 2017-01-06, WNDR4300 before 2017-01-06, WNDR4300v2 before 2017-01-06, WNDR4500v1 before 2017-01-06, WNDR4500v2 before 2017-01-06, and WNDR4500v3 before 2017-01-06.
Key phrases: password exposure
CVE-2016-1106: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11060: Certain NETGEAR devices are affected by insecure renegotiation. This affects SRX5308 before 2017-02-10, FVS336Gv3 before 2017-02-10, FVS318N before 2017-02-10, and FVS318Gv2 before 2017-02-10.
Key phrases: insecure renegotiation
CVE-2016-11061: Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
Key phrases: execute OS commands on the device, os commands
CVE-2016-11062: An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.
Key phrases: e-mail address verification
CVE-2016-11063: An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
Key phrases: xss
CVE-2016-11064: An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
Key phrases: injection, execute code, code injection
CVE-2016-11065: An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance.
Key phrases: posts appearance
CVE-2016-11066: An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.
CVE-2016-11067: An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.
Key phrases: hang
CVE-2016-11068: An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.
Key phrases: injection
CVE-2016-11069: An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.
Key phrases: brute-force attempts
CVE-2016-1107: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11070: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.
Key phrases: XSS via theme color-code values, xss
CVE-2016-11071: An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place.
Key phrases: XSS because the noreferrer and noopener protection mechanisms, xss
CVE-2016-11072: An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
CVE-2016-11073: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting.
Key phrases: XSS via a Legal or Support setting, xss
CVE-2016-11074: An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused.
Key phrases: password-reset link
CVE-2016-11075: An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API.
Key phrases: obtain sensitive information, obtain sensitive information about team URLs via an
CVE-2016-11076: An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
CVE-2016-11077: An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account.
Key phrases: superfluous api
CVE-2016-11078: An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI.
Key phrases: obtain sensitive information, obtain sensitive information (credential fields within config.json
CVE-2016-11079: An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL.
Key phrases: XSS via a redirect URL, xss
CVE-2016-1108: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-11080: An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details.
Key phrases: superfluous apis
CVE-2016-11081: An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser.
Key phrases: information stored by a web browser, unintended access
CVE-2016-11082: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link.
Key phrases: XSS via a crafted link, xss
CVE-2016-11083: An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.
Key phrases: be opened in a browser window, xss
CVE-2016-11084: An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF.
Key phrases: XSS via CSRF, xss, csrf
CVE-2016-11085: php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.
Key phrases: CSRF, csrf, stored xss
CVE-2016-11086: lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
Key phrases: obtain sensitive information, spoof servers and obtain sensitive information, man in the middle, spoofing
CVE-2016-1109: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-1110: Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
Key phrases: unspecified, unknown impact, unspecified vulnerability
CVE-2016-1111: Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted Graphics State dictionary.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Graphics State, double free
CVE-2016-1112: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information via unspecified vectors.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors
CVE-2016-1113: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss), unspecified vectors
CVE-2016-1114: Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted serialized Java
CVE-2016-1115: Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Key phrases: spoof servers via a crafted certificate, man in the middle, spoofing
CVE-2016-1116: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-1117: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1044, and CVE-2016-1062.
Key phrases: bypass JavaScript API execution restrictions, bypass JavaScript API execution restrictions via unspecified vectors
CVE-2016-1118: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-1119: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified