yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-10739: In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
Key phrases: potentially dangerous substrings
CVE-2016-1074: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10740: Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources.
Key phrases: learn the passwords of configured LDAP directories by
CVE-2016-10741: In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON instead of an I/O failure.
Key phrases: denial of service (system crash), cause a denial of service (system crash, race condition, hole
CVE-2016-10742: Zabbix before 2.2.21rc1, 3.x before 3.0.13rc1, 3.1.x and 3.2.x before 3.2.10rc1, and 3.3.x and 3.4.x before 3.4.4rc1 allows open redirect via the request parameter.
Key phrases: open redirect via the request parameter
CVE-2016-10743: hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
Key phrases: low-quality prng
CVE-2016-10744: In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Key phrases: display listbox data, xss
CVE-2016-10745: In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Key phrases: a sandbox escape
CVE-2016-10746: libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API calls by guest agents with an RO connection, even though an RW connection was supposed to be required, a different vulnerability than CVE-2019-3886.
CVE-2016-10749: parse_string in cJSON.c in cJSON before 2016-10-02 has a buffer over-read, as demonstrated by a string that begins with a " character and ends with a \\ character.
Key phrases: buffer over-read, buffer over read
CVE-2016-1075: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051, CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1065, CVE-2016-1066, CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1094, CVE-2016-1121, CVE-2016-1122, CVE-2016-4102, and CVE-2016-4107.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-10750: In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Key phrases: run arbitrary code, remote code execution, java deserialization, vulnerable classes
CVE-2016-10751: osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.
Key phrases: oc-admin/plugins.php Directory Traversal via, directory traversal, remote php code execution
CVE-2016-10752: serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
Key phrases: execute arbitrary PHP code, upload and execute arbitrary PHP code because it, extensionless filename
CVE-2016-10753: e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
Key phrases: PHP Object Injection with resultant SQL injection, php object injection, sql injection
CVE-2016-10754: modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.
Key phrases: SQL injection via the contactidlist parameter, sql injection
CVE-2016-10755: AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php.
Key phrases: admin/controller/pages/localisation/, sql injection
CVE-2016-10756: Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.
Key phrases: configure the uploading of .php files, csrf
CVE-2016-10757: In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.
Key phrases: csrf, remote code execution
CVE-2016-10758: PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the image_name parameter.
Key phrases: allows arbitrary File Upload, pkinc/admin/mediaarchive.php and pkinc/, arbitrary file upload
CVE-2016-10759: The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.
Key phrases: resultant arbitrary code execution, rename the .htaccess file that blocks .php uploads, directory traversal
CVE-2016-1076: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10760: On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.
Key phrases: command injection, shell metacharacters
CVE-2016-10761: Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.
Key phrases: keystroke injection, bypassing encryption
CVE-2016-10762: The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
Key phrases: CSV injection when the export tool is used, csv injection
CVE-2016-10763: The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.
Key phrases: XSS in the admin section via a ticket, xss
CVE-2016-10764: In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
CVE-2016-10765: edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.
Key phrases: account activation with a spoofed e-mail, spoofed e-mail address, spoofing
CVE-2016-10766: edx-platform before 2016-06-06 allows CSRF.
Key phrases: CSRF, csrf
CVE-2016-10767: cPanel before 60.0.25 allows stored XSS in the WHM Repair Mailbox Permissions interface (SEC-159).
Key phrases: stored XSS in the WHM Repair Mailbox Permissions, stored xss
CVE-2016-10768: cPanel before 60.0.25 allows file-overwrite operations during preparation for MySQL upgrades (SEC-161).
Key phrases: file-overwrite operations during preparation for MySQL
CVE-2016-10769: cPanel before 60.0.25 allows an open redirect via /cgi-sys/FormMail-clone.cgi (SEC-162).
Key phrases: an open redirect via /cgi-sys/
CVE-2016-1077: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10770: cPanel before 60.0.25 allows arbitrary file-overwrite operations during a Roundcube update (SEC-164).
Key phrases: allows arbitrary file, arbitrary file-overwrite operations during a Roundcube
CVE-2016-10771: cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165).
Key phrases: file-create and file-chmod operations
CVE-2016-10772: cPanel before 60.0.25 does not enforce feature-list restrictions when calling the multilang adminbin (SEC-168).
CVE-2016-10773: cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171).
Key phrases: format-string injection in exception-message
CVE-2016-10774: cPanel before 60.0.25 allows self XSS in the tail_ea4_migration.cgi interface (SEC-172).
Key phrases: self XSS in the tail_ea4_migration.cgi interface (SEC-172, self xss
CVE-2016-10775: cPanel before 60.0.25 allows arbitrary file-chown operations via reassign_post_terminate_cruft (SEC-173).
Key phrases: allows arbitrary file, arbitrary file-chown operations via reassign_post_terminate_cruft (
CVE-2016-10776: cPanel before 60.0.25 allows stored XSS during the homedir removal phase of WHM Account termination (SEC-174).
Key phrases: stored XSS during the homedir removal phase of, stored xss
CVE-2016-10777: cPanel before 60.0.25 allows self XSS in WHM Tweak Settings for autodiscover_host (SEC-177).
Key phrases: self XSS in WHM Tweak Settings for autodiscover_host, self xss
CVE-2016-10778: cPanel before 60.0.25 allows self stored XSS in the listftpstable API (SEC-178).
Key phrases: self stored XSS in the listftpstable API (, xss
CVE-2016-10779: cPanel before 60.0.25 allows stored XSS in api1_listautoresponders (SEC-179).
Key phrases: stored XSS in api1_listautoresponders (SEC-179), xss
CVE-2016-1078: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10780: cPanel before 60.0.25 allows stored XSS in the ftp_sessions API (SEC-180).
Key phrases: stored XSS in the ftp_sessions API (SEC-180, stored xss
CVE-2016-10781: cPanel before 60.0.25 allows self XSS in the UI_confirm API (SEC-180).
Key phrases: self XSS in the UI_confirm API (SEC-180, self xss
CVE-2016-10782: cPanel before 60.0.25 allows self stored XSS in postgres API1 listdbs (SEC-181).
Key phrases: self stored XSS in postgres API1 listdbs (, self stored xss
CVE-2016-10783: cPanel before 60.0.25 allows self stored XSS in SSL_listkeys (SEC-182).
Key phrases: self stored XSS in SSL_listkeys (SEC-182), xss
CVE-2016-10784: cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).
Key phrases: self XSS in the alias upload interface (, self xss
CVE-2016-10785: cPanel before 60.0.25 allows attackers to discover file contents during file copy operations (SEC-185).
Key phrases: discover file contents during file copy operations (
CVE-2016-10786: cPanel before 60.0.25 allows members of the nobody group to read Apache HTTP Server SSL keys (SEC-186).
Key phrases: read Apache HTTP Server SSL keys (SEC-186
CVE-2016-10787: The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187).
Key phrases: actionless host
CVE-2016-10788: cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
Key phrases: allows arbitrary code execution, arbitrary code execution via Maketext in PostgreSQL adminbin
CVE-2016-10789: cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191).
Key phrases: code execution via the cpsrvd 403 error response
CVE-2016-1079: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to obtain sensitive information from process memory via unspecified vectors, a different vulnerability than CVE-2016-1092.
Key phrases: obtain sensitive information, obtain sensitive information from process memory via unspecified
CVE-2016-10790: cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net (SEC-192).
CVE-2016-10791: cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559).
CVE-2016-10792: cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141).
Key phrases: code execution in the context of other accounts
CVE-2016-10793: cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152).
Key phrases: allows arbitrary code execution, an incorrect #! in Mail::SPF scripts (
CVE-2016-10794: cPanel before 59.9999.145 allows arbitrary file-read operations because of a multipart form processing error (SEC-154).
Key phrases: allows arbitrary file, arbitrary file-read operations because of a, multipart form processing error, arbitrary file read
CVE-2016-10795: cPanel before 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
Key phrases: stored XSS in the WHM tail_upcp2.cgi interface (, stored xss
CVE-2016-10796: cPanel before 58.0.4 initially uses weak permissions for Apache HTTP Server log files (SEC-130).
Key phrases: weak permissions
CVE-2016-10797: cPanel before 58.0.4 allows WHM "Purchase and Install an SSL Certificate" page visitors to list all server domains (SEC-133).
Key phrases: list all server domains (SEC-133)
CVE-2016-10798: cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).
Key phrases: nobody) via rearrangeacct (SEC-134), file-ownership change
CVE-2016-10799: cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation (SEC-137).
CVE-2016-1080: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10800: cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
Key phrases: demo-mode escape via Site Templates and
CVE-2016-10801: cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
CVE-2016-10802: cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
Key phrases: code execution in the context of other user
CVE-2016-10803: cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
Key phrases: newline injection via LOC records (CPANEL-6923), loc records
CVE-2016-10804: The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
Key phrases: allows arbitrary file, arbitrary file-overwrite operations during Horde Restore
CVE-2016-10805: cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
Key phrases: execute arbitrary code, execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109)
CVE-2016-10806: cPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
Key phrases: self XSS on the Paper Lantern Landing Page, self xss
CVE-2016-10807: cPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
Key phrases: certain denial-of-service outcomes via, denial of service
CVE-2016-10808: In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
Key phrases: ttys
CVE-2016-10809: In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
CVE-2016-1081: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10810: In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
CVE-2016-10811: In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
Key phrases: ttys
CVE-2016-10812: In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
Key phrases: exposed ttys
CVE-2016-10813: cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
Key phrases: self XSS during ftp account creation under addon, self xss
CVE-2016-10814: cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
Key phrases: demo-mode escape via show_template.stor (SEC-119
CVE-2016-10815: cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
Key phrases: allows arbitrary file, arbitrary file-read operations for Webmail accounts, arbitrary file read
CVE-2016-10816: cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
Key phrases: execute arbitrary code, execute arbitrary code through forwarders (SEC-121)
CVE-2016-10817: cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
Key phrases: SQL Injection via the ModSecurity TailWatch log file, sql injection
CVE-2016-10818: cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
Key phrases: log-file permissions
CVE-2016-10819: In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
Key phrases: world-readable
CVE-2016-1082: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10820: cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
Key phrases: access their controlling TTYs (SEC-31), controlling ttys
CVE-2016-10821: In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
Key phrases: command-line password
CVE-2016-10822: cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
Key phrases: self XSS in X3 Reseller Branding Images (, self xss
CVE-2016-10823: cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).
Key phrases: allows arbitrary code execution, arbitrary code execution in the context of the, maketext interpolation
CVE-2016-10824: cPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
Key phrases: unauthenticated arbitrary code execution via DNS NS entry, dns ns entry poisoning
CVE-2016-10825: cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
Key phrases: bypass a Security Policy, bypass a Security Policy by faking static documents
CVE-2016-10826: cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
Key phrases: bypass Two Factor Authentication, bypass Two Factor Authentication via DNS clustering requests
CVE-2016-10827: cPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
Key phrases: self stored XSS in WHM Edit System Mail, xss
CVE-2016-10828: cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
Key phrases: allows arbitrary code execution, arbitrary code execution because of an unsafe @INC, unsafe @inc path
CVE-2016-10829: cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
Key phrases: allows arbitrary file, arbitrary file-read operations because of a, multipart form processing error, arbitrary file read
CVE-2016-1083: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10830: cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
Key phrases: bypass for AppConfig applications via magic_revision (SEC-100, ACL bypass, ACL bypass for AppConfig applications via magic_revision (, acl bypass
CVE-2016-10831: cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
CVE-2016-10832: cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
Key phrases: bypass via account name munging (SEC-102), FTP cPHulk bypass, FTP cPHulk bypass via account name munging (
CVE-2016-10833: cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
Key phrases: pre requests
CVE-2016-10834: cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
Key phrases: bypass via ftp (SEC-105), suspension bypass, account-suspension bypass via ftp (SEC-105
CVE-2016-10835: cPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
Key phrases: bypass via account name munging (SEC-107), IMAP cPHulk bypass, a POP/IMAP cPHulk bypass via account
CVE-2016-10836: cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
Key phrases: allows arbitrary file, arbitrary file-read operations during authentication with, arbitrary file read
CVE-2016-10837: cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
Key phrases: allows arbitrary code execution, arbitrary code execution because of an unsafe @INC, unsafe @inc path
CVE-2016-10838: cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
Key phrases: allows arbitrary file, arbitrary file-read operations via the bin, arbitrary file read
CVE-2016-10839: cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
Key phrases: SQL injection in bin/horde_update_usernames (SEC-71, sql injection
CVE-2016-1084: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1085, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10840: cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
Key phrases: allows arbitrary code execution, arbitrary code execution during locale duplication (SEC-72
CVE-2016-10841: The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
CVE-2016-10842: cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
Key phrases: certain file-read operations in bin/, file read
CVE-2016-10843: cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
Key phrases: code execution in the context of shared users
CVE-2016-10844: The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
CVE-2016-10845: cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
Key phrases: allows arbitrary file, arbitrary file-overwrite operations in scripts/
CVE-2016-10846: cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
Key phrases: allows arbitrary file, arbitrary file-chown and file-chmod
CVE-2016-10847: cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
Key phrases: allows arbitrary file, arbitrary file-read and file-write, arbitrary file read, file write
CVE-2016-10848: cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
Key phrases: allows arbitrary file, arbitrary file-overwrite operations in scripts/
CVE-2016-10849: cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
Key phrases: certain file-chmod operations in scripts/
CVE-2016-1085: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1086, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10850: cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
Key phrases: allows arbitrary code execution, arbitrary code execution via scripts/synccpaddonswithsqlhost (
CVE-2016-10851: cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
Key phrases: self XSS in the WHM PHP Configuration editor, self xss
CVE-2016-10852: cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
CVE-2016-10853: cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
Key phrases: stored XSS in the WHM Feature Manager interface, stored xss
CVE-2016-10854: cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
Key phrases: self XSS in the X3 Entropy Banner interface, self xss
CVE-2016-10855: cPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
Key phrases: unauthenticated arbitrary code execution via cpsrvd (SEC-91
CVE-2016-10856: cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
Key phrases: discover sensitive data through comet feeds (SEC-29
CVE-2016-10857: cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
Key phrases: bypass of the e-mail sending limit, a bypass of the e-mail sending
CVE-2016-10858: cPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
Key phrases: unauthenticated arbitrary code execution via DNS NS entry, dns ns entry poisoning
CVE-2016-10859: cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
Key phrases: unauthorized password changes via Webmail API commands (
CVE-2016-1086: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1088, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10860: cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
Key phrases: unauthorized zone modification via the WHM API (
CVE-2016-10861: Neet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
Key phrases: change the AP name and password, csrf
CVE-2016-10862: Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
CVE-2016-10863: Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
Key phrases: goform/formwlencryptvxd CSRF with resultant PSK key, goform formwlencryptvxd csrf, psk key disclosure
CVE-2016-10864: NETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
Key phrases: XSS via the SSID, xss
CVE-2016-10865: The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
Key phrases: cross-site request forgery (csrf), resultant width xss, cross site request forgery
CVE-2016-10866: The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10867: The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
Key phrases: xss
CVE-2016-10868: The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
Key phrases: xss
CVE-2016-10869: The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Key phrases: xss
CVE-2016-1087: Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1090 and CVE-2016-4106.
Key phrases: gain privileges, gain privileges via a Trojan horse resource in, untrusted search path, unspecified
CVE-2016-10870: The google-language-translator plugin before 5.0.06 for WordPress has XSS.
Key phrases: xss
CVE-2016-10871: The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
Key phrases: xss
CVE-2016-10872: The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Key phrases: xss
CVE-2016-10873: The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
Key phrases: xss
CVE-2016-10874: The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10875: The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
Key phrases: xss
CVE-2016-10876: The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10877: The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10878: The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
Key phrases: xss
CVE-2016-10879: The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
Key phrases: xss
CVE-2016-1088: Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1037, CVE-2016-1063, CVE-2016-1064, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-1074, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1080, CVE-2016-1081, CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1093, CVE-2016-1095, CVE-2016-1116, CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1123, CVE-2016-1124, CVE-2016-1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089, CVE-2016-4090, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4103, CVE-2016-4104, and CVE-2016-4105.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, unspecified
CVE-2016-10880: The google-document-embedder plugin before 2.6.1 for WordPress has XSS.
Key phrases: xss
CVE-2016-10881: The google-document-embedder plugin before 2.6.2 for WordPress has XSS.
Key phrases: xss
CVE-2016-10882: The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10883: The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
Key phrases: csrf
CVE-2016-10884: The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Key phrases: csrf
CVE-2016-10885: The wp-editor plugin before 1.2.6 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10886: The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
Key phrases: incorrect permissions
CVE-2016-10887: The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
Key phrases: sql injection
CVE-2016-10888: The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
Key phrases: sql injection
CVE-2016-10889: The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
Key phrases: sql injection
CVE-2016-1089: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1091, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-10890: The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
Key phrases: xss
CVE-2016-10891: The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
Key phrases: xss
CVE-2016-10892: The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10893: The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Key phrases: xss issues
CVE-2016-10894: xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
Key phrases: multitouch events
CVE-2016-10895: The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Key phrases: xss
CVE-2016-10896: The seo-redirection plugin before 4.3 for WordPress has stored XSS.
Key phrases: xss
CVE-2016-10897: The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10898: The total-security plugin before 3.4.1 for WordPress has XSS.
Key phrases: xss
CVE-2016-10899: The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
Key phrases: settings-change
CVE-2016-1090: Untrusted search path vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows local users to gain privileges via a Trojan horse resource in an unspecified directory, a different vulnerability than CVE-2016-1087 and CVE-2016-4106.
Key phrases: gain privileges, gain privileges via a Trojan horse resource in, untrusted search path, unspecified
CVE-2016-10900: The uji-countdown plugin before 2.0.7 for WordPress has XSS.
Key phrases: xss
CVE-2016-10901: The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.
Key phrases: xss
CVE-2016-10902: The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.
Key phrases: csrf
CVE-2016-10903: The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10904: The olimometer plugin before 2.57 for WordPress has SQL injection.
Key phrases: sql injection
CVE-2016-10905: An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.
Key phrases: use-after-free, use after free
CVE-2016-10906: An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.
Key phrases: use-after-free, race condition, use after free
CVE-2016-10907: An issue was discovered in drivers/iio/dac/ad5755.c in the Linux kernel before 4.8.6. There is an out of bounds write in the function ad5755_parse_dt.
Key phrases: out of bounds write
CVE-2016-10908: The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
Key phrases: xss
CVE-2016-10909: The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
Key phrases: sql injection
CVE-2016-1091: Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1089, CVE-2016-6944, CVE-2016-6945, CVE-2016-6946, CVE-2016-6949, CVE-2016-6952, CVE-2016-6953, CVE-2016-6961, CVE-2016-6962, CVE-2016-6963, CVE-2016-6964, CVE-2016-6965, CVE-2016-6967, CVE-2016-6968, CVE-2016-6969, CVE-2016-6971, CVE-2016-6979, CVE-2016-6988, and CVE-2016-6993.
Key phrases: execute arbitrary code, execute arbitrary code via unspecified vectors, use-after-free
CVE-2016-10910: The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10911: The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
Key phrases: xss
CVE-2016-10912: The universal-analytics plugin before 1.3.1 for WordPress has XSS.
Key phrases: xss
CVE-2016-10913: The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
Key phrases: xss
CVE-2016-10914: The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Key phrases: csrf
CVE-2016-10915: The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Key phrases: csrf
CVE-2016-10916: The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
Key phrases: sql injection