CVE-2016-0001

2017-05-11T10:29:55.767-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:jscript:5.7 cpe:/a:microsoft:jscript:5.8 cpe:/a:microsoft:vbscript:5.7 cpe:/a:microsoft:vbscript:5.8

CVE-2016-0002

2016-01-13T00:59:01.433-05:00

2018-10-12T18:10:41.707-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034648 SECTRACK 1034650 MS MS16-001 MS MS16-003 IDEFENSE 20160112 Microsoft Internet Explorer VBScript "Assignvar" Use-After-Free Vulnerability The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0003

2016-01-13T00:59:02.683-05:00

2018-10-12T18:10:42.207-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034649 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-019 MS MS16-002 Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Microsoft Edge Memory Corruption Vulnerability."

CVE-2016-0004

2017-05-11T10:29:55.780-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0005

2016-01-13T00:59:03.653-05:00

2018-10-12T18:10:42.457-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034648 MS MS16-001 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0006

2016-01-13T00:59:04.590-05:00

2019-05-17T16:08:17.717-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:18:22.153-04:00

BID 79882 SECTRACK 1034645 MS MS16-008 EXPLOIT-DB 39311 The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a crafted application, aka "Windows Mount Point Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0007.

CVE-2016-0007

2016-01-13T00:59:05.513-05:00

2019-05-17T16:17:51.557-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:13:04.830-04:00

BID 79898 SECTRACK 1034645 MISC https://code.google.com/p/google-security-research/issues/detail?id=589 MS MS16-008 EXPLOIT-DB 39310 EXPLOIT-DB 39311 The sandbox implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandles reparse points, which allows local users to gain privileges via a crafted application, aka "Windows Mount Point Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0006.

cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0008

2016-01-13T00:59:06.420-05:00

2019-05-15T15:28:55.353-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-05-15T10:20:29.597-04:00

SECTRACK 1034654 MS MS16-005 The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows GDI32.dll ASLR Bypass Vulnerability."

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:-::~~~~x86~ cpe:/o:microsoft:windows_10:1511::~~~~x64~ cpe:/o:microsoft:windows_10:1511::~~~~x86~ cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_7:-:sp1:x86 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0009

2016-01-13T00:59:07.560-05:00

2018-10-30T12:27:22.263-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034654 MS MS16-005 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via unspecified vectors, aka "Win32k Remote Code Execution Vulnerability."

cpe:/a:microsoft:excel_for_mac:2011 cpe:/a:microsoft:excel_for_mac:2016 cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016 cpe:/a:microsoft:powerpoint_for_mac:2011 cpe:/a:microsoft:powerpoint_for_mac:2016 cpe:/a:microsoft:word_for_mac:2011 cpe:/a:microsoft:word_for_mac:2016 cpe:/a:microsoft:word_viewer

CVE-2016-0010

2016-01-13T00:59:08.527-05:00

2018-10-12T18:10:44.017-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034651 MS MS16-004 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2013:sp1 cpe:/a:microsoft:sharepoint_server:2013:sp1

CVE-2016-0011

2016-01-13T00:59:09.387-05:00

2018-10-12T18:10:44.220-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034653 MS MS16-004 Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-2015-6117.

cpe:/a:microsoft:excel:2007:sp3 cpe:/a:microsoft:excel:2010:sp2:~~~~x64~ cpe:/a:microsoft:excel:2010:sp2:~~~~x86~ cpe:/a:microsoft:excel:2013:sp1 cpe:/a:microsoft:excel:2013:sp1:~~rt~~~ cpe:/a:microsoft:excel:2016 cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016 cpe:/a:microsoft:powerpoint:2010:sp2 cpe:/a:microsoft:powerpoint:2013:sp1 cpe:/a:microsoft:powerpoint:2013:sp1:~~rt~~~ cpe:/a:microsoft:powerpoint:2016 cpe:/a:microsoft:visio:2007:sp3 cpe:/a:microsoft:visio:2010:sp2 cpe:/a:microsoft:visio:2013:sp1 cpe:/a:microsoft:visio:2016 cpe:/a:microsoft:visual_basics:6.0::~~rt~~~ cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016

CVE-2016-0012

2016-01-13T00:59:10.607-05:00

2018-10-12T18:10:44.423-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034651 MS MS16-004 Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Microsoft Office ASLR Bypass."

CVE-2016-0013

2017-05-11T10:29:55.813-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0014

2016-01-13T00:59:11.887-05:00

2019-05-16T14:24:13.693-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:14:20.787-04:00

SECTRACK 1034661 MS MS16-007 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~itanium~ cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0015

2016-01-13T00:59:12.997-05:00

2019-05-17T15:13:58.827-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:23:13.833-04:00

MISC http://packetstormsecurity.com/files/135232/Microsoft-DirectShow-Remote-Code-Execution.html SECTRACK 1034660 MS MS16-007 EXPLOIT-DB 39232 DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "DirectShow Heap Corruption Remote Code Execution Vulnerability."

CVE-2016-0016

2016-01-13T00:59:13.873-05:00

2019-05-15T10:36:07.040-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:09:29.820-04:00

SECTRACK 1034661 MISC https://code.google.com/p/google-security-research/issues/detail?id=555 MS MS16-007 EXPLOIT-DB 39233 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

CVE-2016-0017

2017-05-11T10:29:55.827-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0018

2016-01-13T00:59:14.763-05:00

2019-05-15T14:59:47.013-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:07:22.987-04:00

SECTRACK 1034661 MS MS16-007 Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10:-::~~~~x64~ cpe:/o:microsoft:windows_10:-::~~~~x86~ cpe:/o:microsoft:windows_10:1511::~~~~x64~ cpe:/o:microsoft:windows_10:1511::~~~~x86~

CVE-2016-0019

2016-01-13T00:59:15.640-05:00

2018-10-30T12:27:22.263-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034659 MS MS16-007 The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511 allows remote attackers to bypass intended access restrictions and establish sessions for blank-password accounts via a modified RDP client, aka "Windows Remote Desktop Protocol Security Bypass Vulnerability."

cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_7:-:sp1:x86 cpe:/o:microsoft:windows_7:-:sp2 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1

CVE-2016-0020

2016-01-13T00:59:16.593-05:00

2018-10-12T18:10:45.923-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034661 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-018 MS MS16-007 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "MAPI DLL Loading Elevation of Privilege Vulnerability."

cpe:/a:microsoft:infopath:2007:sp3 cpe:/a:microsoft:infopath:2010:sp2 cpe:/a:microsoft:infopath:2013:sp1

CVE-2016-0021

2016-03-09T06:59:00.120-05:00

2018-10-12T18:10:46.190-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84024 SECTRACK 1035207 MS MS16-029 Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_for_mac:2011 cpe:/a:microsoft:word_for_mac:2016 cpe:/a:microsoft:word_viewer

CVE-2016-0022

2016-02-10T06:59:00.157-05:00

2018-10-12T18:10:46.470-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034975 SECTRACK 1034976 MS MS16-015 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0052.

CVE-2016-0023

2017-05-11T10:29:55.860-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:edge:-

CVE-2016-0024

2016-01-13T00:59:17.810-05:00

2018-10-12T18:10:46.737-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 79891 SECTRACK 1034649 MS MS16-002 The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Scripting Engine Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2016 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_online_server:- cpe:/a:microsoft:office_web_apps:2010:sp2 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_for_mac:2011 cpe:/a:microsoft:word_for_mac:2016

CVE-2016-0025

2016-06-15T21:59:01.680-04:00

2018-10-12T18:10:47.017-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1036093 MS MS16-070 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016:- cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0026

2016-11-10T01:59:00.197-05:00

2018-10-12T18:10:47.253-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 93998 SECTRACK 1037252 MS MS16-134 The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to gain privileges via a crafted application, aka "Windows Common Log File System Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3332, CVE-2016-3333, CVE-2016-3334, CVE-2016-3335, CVE-2016-3338, CVE-2016-3340, CVE-2016-3342, CVE-2016-3343, and CVE-2016-7184.

CVE-2016-0027

2017-05-11T10:29:55.873-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:outlook_web_access

CVE-2016-0028

2016-06-15T21:59:03.167-04:00

2018-10-12T18:10:47.517-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1036106 MS MS16-079 Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."

cpe:/a:microsoft:exchange_server:2016

CVE-2016-0029

2016-01-13T00:59:18.717-05:00

2019-05-31T20:29:01.120-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 79889 SECTRACK 1034647 MS MS16-010 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0031.

cpe:/a:microsoft:exchange_server:2013:cumulative_update_10 cpe:/a:microsoft:exchange_server:2013:sp1 cpe:/a:microsoft:exchange_server:2016

CVE-2016-0030

2016-01-13T00:59:19.607-05:00

2019-05-31T20:29:01.213-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 79890 SECTRACK 1034647 MS MS16-010 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

cpe:/a:microsoft:exchange_server:2016

CVE-2016-0031

2016-01-13T00:59:20.513-05:00

2019-05-31T20:29:01.307-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 79888 SECTRACK 1034647 MS MS16-010 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability," a different vulnerability than CVE-2016-0029.

cpe:/a:microsoft:exchange_server:2013:cumulative_update_10 cpe:/a:microsoft:exchange_server:2013:cumulative_update_11 cpe:/a:microsoft:exchange_server:2013:sp1 cpe:/a:microsoft:exchange_server:2016

CVE-2016-0032

2016-01-13T00:59:21.420-05:00

2019-05-31T20:29:01.400-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 79884 SECTRACK 1034647 MS MS16-010 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Exchange Spoofing Vulnerability."

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1

CVE-2016-0033

2016-02-10T06:59:01.297-05:00

2018-10-12T18:10:48.533-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1034983 MS MS16-019 Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, which allows remote attackers to cause a denial of service (performance degradation) via crafted XSLT data, aka ".NET Framework Stack Overflow Denial of Service Vulnerability."

cpe:/a:microsoft:silverlight:5.0

CVE-2016-0034

2016-01-13T00:59:22.657-05:00

2018-10-12T18:10:48.720-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034655 MS MS16-006 Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."

CVE-2016-0035

2016-01-13T00:59:23.593-05:00

2018-10-12T18:10:48.923-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034651 MISC http://www.zerodayinitiative.com/advisories/ZDI-15-639 MS MS16-004 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0036

2016-02-10T06:59:02.407-05:00

2019-05-15T14:42:49.827-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:28:24.450-04:00

SECTRACK 1034981 MS MS16-017 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote authenticated users to execute arbitrary code via crafted data, aka "Remote Desktop Protocol (RDP) Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_server_2012:r2::~~datacenter~~~ cpe:/o:microsoft:windows_server_2012:r2::~~essentials~~~ cpe:/o:microsoft:windows_server_2012:r2::~~standard~~~

CVE-2016-0037

2016-02-10T06:59:03.453-05:00

2019-05-08T18:03:15.720-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 82507 SECTRACK 1034984 MS MS16-020 The forms-based authentication implementation in Active Directory Federation Services (ADFS) 3.0 in Microsoft Windows Server 2012 R2 allows remote attackers to cause a denial of service (daemon outage) via crafted data, aka "Microsoft Active Directory Federation Services Denial of Service Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1:~~~~x64~ cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0038

2016-02-10T06:59:04.377-05:00

2019-05-15T11:08:31.960-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:24:12.947-04:00

SECTRACK 1034974 MS MS16-013 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Memory Corruption Vulnerability."

cpe:/a:microsoft:sharepoint_foundation:2013:sp1

CVE-2016-0039

2016-02-10T06:59:05.360-05:00

2018-10-12T18:10:49.923-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034975 MS MS16-015 Cross-site scripting (XSS) vulnerability in SharePoint Server in Microsoft SharePoint Foundation 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_7:-:sp1:x86 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_vista:-:sp2

CVE-2016-0040

2016-02-10T06:59:06.440-05:00

2018-10-12T18:10:50.127-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034985 MS MS16-014 EXPLOIT-DB 44586 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11 cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0041

2016-02-10T06:59:07.423-05:00

2018-10-12T18:10:50.393-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov FULLDISC 20160210 NPS Datastore server DLL side loading vulnerability SECTRACK 1034971 SECTRACK 1034985 MS MS16-009 MS MS16-014 MISC https://www.securify.nl/advisory/SFY20150905/nps_datastore_server_dll_side_loading_vulnerability.html Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0042

2016-02-10T06:59:08.690-05:00

2018-10-12T18:10:50.970-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034985 MS MS16-014 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."

CVE-2016-0043

2017-05-11T10:29:55.907-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0044

2016-02-10T06:59:09.657-05:00

2019-05-15T13:27:22.577-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-05-15T10:26:13.247-04:00

SECTRACK 1034985 MS MS16-014 Sync Framework in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows remote attackers to cause a denial of service (SyncShareSvc service outage) via crafted "change batch" data, aka "Windows DLL Loading Denial of Service Vulnerability."

CVE-2016-0045

2017-05-11T10:29:55.920-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0046

2016-02-10T06:59:10.610-05:00

2019-05-15T10:58:44.060-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:29:54.907-04:00

SECTRACK 1034973 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-156 MS MS16-012 Windows Reader in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted Reader file, aka "Microsoft Windows Reader Vulnerability."

CVE-2016-0047

2016-02-10T06:59:11.517-05:00

2018-10-12T18:10:51.597-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034983 MS MS16-019 WinForms in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to obtain sensitive information from process memory via crafted icon data, aka "Windows Forms Information Disclosure Vulnerability."

CVE-2016-0048

2016-02-10T06:59:12.470-05:00

2018-10-12T18:10:51.817-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034982 MS MS16-018 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0049

2016-02-10T06:59:13.580-05:00

2018-10-30T12:27:22.200-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/135797/Windows-Kerberos-Security-Feature-Bypass.html BID 82535 SECTRACK 1034985 MS MS16-014 EXPLOIT-DB 39442 Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 does not properly validate password changes, which allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action, aka "Windows Kerberos Security Feature Bypass."

cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:-:gold cpe:/o:microsoft:windows_server_2012:r2::~~datacenter~~~ cpe:/o:microsoft:windows_server_2012:r2::~~essentials~~~ cpe:/o:microsoft:windows_server_2012:r2::~~standard~~~

CVE-2016-0050

2016-02-10T06:59:14.567-05:00

2019-05-08T18:03:15.720-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1034986 MS MS16-021 Network Policy Server (NPS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 misparses username queries, which allows remote attackers to cause a denial of service (RADIUS authentication outage) via crafted requests, aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability."

CVE-2016-0051

2016-02-10T06:59:15.567-05:00

2018-10-12T18:10:52.627-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034980 MS MS16-016 EXPLOIT-DB 39432 EXPLOIT-DB 39788 EXPLOIT-DB 40085 The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."

cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_for_mac:2011 cpe:/a:microsoft:word_for_mac:2016 cpe:/a:microsoft:word_viewer

CVE-2016-0052

2016-02-10T06:59:16.487-05:00

2018-10-12T18:10:53.050-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

CVE-2016-0053

2016-02-10T06:59:17.377-05:00

2018-10-12T18:10:53.317-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034975 SECTRACK 1034976 MS MS16-015 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVE-2016-0054

2016-02-10T06:59:18.643-05:00

2018-10-12T18:10:53.643-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034976 MS MS16-015 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, Excel Viewer, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 SP1, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2007:sp3

CVE-2016-0055

2016-02-10T06:59:19.753-05:00

2018-10-12T18:10:53.847-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034976 MS MS16-015 Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016

CVE-2016-0056

2016-02-10T06:59:20.753-05:00

2018-10-12T18:10:54.050-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034976 MS MS16-015 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016

CVE-2016-0057

2016-03-09T06:59:01.057-05:00

2018-10-12T18:10:54.237-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84030 SECTRACK 1035207 MS MS16-029 Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 does not properly sign an unspecified binary file, which allows local users to gain privileges via a Trojan horse file with a crafted signature, aka "Microsoft Office Security Feature Bypass Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0058

2016-02-10T06:59:21.817-05:00

2019-05-15T14:36:04.520-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2019-05-15T10:21:39.237-04:00

SECTRACK 1034973 MS MS16-012 Buffer overflow in the PDF Library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls, aka "Microsoft PDF Library Buffer Overflow Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0059

2016-02-10T06:59:22.847-05:00

2018-10-12T18:10:54.707-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034971 MS MS16-009 The Hyperlink Object Library in Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted URL in a (1) e-mail message or (2) Office document, aka "Internet Explorer Information Disclosure Vulnerability."

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0060

2016-02-10T06:59:23.927-05:00

2018-10-12T18:10:54.910-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 SECTRACK 1034972 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-159 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-165 MS MS16-009 MS MS16-011 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0061, CVE-2016-0063, CVE-2016-0067, and CVE-2016-0072.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0061

2016-02-10T06:59:24.910-05:00

2018-10-12T18:10:55.470-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 SECTRACK 1034972 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-162 MS MS16-009 MS MS16-011 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0063, CVE-2016-0067, and CVE-2016-0072.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0062

2016-02-10T06:59:25.893-05:00

2018-10-12T18:10:56.003-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 SECTRACK 1034972 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-158 MS MS16-009 MS MS16-011 Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0063

2016-02-10T06:59:26.863-05:00

2018-10-12T18:10:56.470-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://blog.skylined.nl/20161128001.html SECTRACK 1034971 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-166 MS MS16-009 EXPLOIT-DB 40845 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0067, and CVE-2016-0072.

cpe:/a:microsoft:internet_explorer:10

CVE-2016-0064

2016-02-10T06:59:27.817-05:00

2018-10-12T18:10:56.877-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 MS MS16-009 Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

CVE-2016-0065

2017-05-11T10:29:55.953-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0066

2017-05-11T10:29:55.967-04:00

2017-05-11T10:29:55.983-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0067

2016-02-10T06:59:29.177-05:00

2018-10-12T18:10:57.080-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 MS MS16-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0063, and CVE-2016-0072.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0068

2016-02-18T17:59:05.120-05:00

2018-10-12T18:10:57.267-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 MS MS16-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0069.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0069

2016-02-18T17:59:06.010-05:00

2018-10-12T18:10:57.470-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov JVN JVN#78383854 JVNDB JVNDB-2016-000028 BID 82665 SECTRACK 1034971 MS MS16-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0068.

CVE-2016-0070

2016-10-13T22:59:00.200-04:00

2018-10-12T18:10:57.893-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93354 MS MS16-124 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."

cpe:/a:microsoft:internet_explorer:9

CVE-2016-0071

2016-02-10T06:59:30.190-05:00

2018-10-12T18:10:58.097-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 MS MS16-009 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0072

2016-02-10T06:59:31.190-05:00

2018-10-12T18:10:58.317-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034971 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-157 MS MS16-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0060, CVE-2016-0061, CVE-2016-0063, and CVE-2016-0067.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_10:1607 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0073

2016-10-13T22:59:01.607-04:00

2018-10-12T18:10:58.580-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93355 MS MS16-124 EXPLOIT-DB 40574 The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0075.

CVE-2016-0074

2017-05-11T10:29:56.000-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0075

2016-10-13T22:59:02.593-04:00

2018-10-12T18:10:58.830-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93356 MS MS16-124 EXPLOIT-DB 40573 The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0073.

CVE-2016-0076

2017-05-11T10:29:56.030-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0077

2016-02-10T06:59:32.317-05:00

2018-10-12T18:10:59.113-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034971 SECTRACK 1034972 MS MS16-009 MS MS16-011 Microsoft Internet Explorer 9 through 11 and Microsoft Edge misparse HTTP responses, which allows remote attackers to spoof web sites via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."

CVE-2016-0078

2017-05-11T10:29:56.047-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_10:1607

CVE-2016-0079

2016-10-13T22:59:03.750-04:00

2018-10-12T18:10:59.503-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93357 MS MS16-124 EXPLOIT-DB 40608 The kernel in Microsoft Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application that makes an API call to access sensitive information in the registry, aka "Windows Kernel Local Elevation of Privilege Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0080

2016-02-10T06:59:33.397-05:00

2018-10-12T18:10:59.753-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 82631 SECTRACK 1034972 MS MS16-011 Microsoft Edge mishandles exceptions during window-message dispatch operations, which allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge ASLR Bypass."

CVE-2016-0081

2017-05-11T10:29:56.063-04:00

2017-05-11T10:29:56.077-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0082

2017-05-11T10:29:56.093-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0083

2017-05-11T10:29:56.123-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:edge:-

CVE-2016-0084

2016-02-10T06:59:34.300-05:00

2018-10-12T18:11:00.017-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 82635 SECTRACK 1034972 MS MS16-011 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability."

CVE-2016-0085

2017-05-11T10:29:56.140-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0086

2017-05-11T10:29:56.170-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_7::sp1:x64 cpe:/o:microsoft:windows_7::sp1:x86 cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0087

2016-03-09T06:59:01.900-05:00

2018-10-12T18:11:00.427-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84032 SECTRACK 1035209 MS MS16-031 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 do not properly validate handles, which allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0088

2016-04-12T19:59:00.147-04:00

2018-10-12T18:11:00.707-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035538 MS MS16-045 Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0089

2016-04-12T19:59:01.583-04:00

2018-10-12T18:11:00.910-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035538 MS MS16-045 Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0090

2016-04-12T19:59:02.977-04:00

2018-10-12T18:11:01.160-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035538 MS MS16-045 Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information Disclosure Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0091

2016-03-09T06:59:02.840-05:00

2018-10-12T18:11:01.427-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 83944 SECTRACK 1035208 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-182 MS MS16-030 OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0092.

CVE-2016-0092

2016-03-09T06:59:03.713-05:00

2018-10-12T18:11:01.783-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84125 SECTRACK 1035208 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-181 MS MS16-030 OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Memory Remote Code Execution Vulnerability," a different vulnerability than CVE-2016-0091.

CVE-2016-0093

2016-03-09T06:59:04.620-05:00

2018-10-12T18:11:02.223-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84054 SECTRACK 1035212 MS MS16-034 EXPLOIT-DB 39648 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0094, CVE-2016-0095, and CVE-2016-0096.

CVE-2016-0094

2016-03-09T06:59:05.527-05:00

2018-10-12T18:11:02.567-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84066 SECTRACK 1035212 MS MS16-034 EXPLOIT-DB 39647 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0095, and CVE-2016-0096.

CVE-2016-0095

2016-03-09T06:59:06.637-05:00

2018-10-12T18:11:02.910-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84072 SECTRACK 1035212 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-196 MS MS16-034 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0096.

CVE-2016-0096

2016-03-09T06:59:07.763-05:00

2018-10-12T18:11:03.237-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84069 SECTRACK 1035212 MS MS16-034 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0095.

CVE-2016-0097

2017-05-11T10:29:56.187-04:00

2017-05-11T10:29:56.203-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0098

2016-03-09T06:59:08.747-05:00

2018-10-12T18:11:03.520-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84089 SECTRACK 1035200 MS MS16-027 Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."

CVE-2016-0099

2016-03-09T06:59:09.590-05:00

2018-10-12T18:11:03.800-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84034 SECTRACK 1035210 MS MS16-032 EXPLOIT-DB 39574 EXPLOIT-DB 39719 EXPLOIT-DB 39809 EXPLOIT-DB 40107 The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0100

2016-03-09T06:59:10.527-05:00

2018-10-12T18:11:04.410-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 83930 SECTRACK 1035205 MS MS16-025 Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1:- cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0101

2016-03-09T06:59:11.623-05:00

2018-10-12T18:11:04.690-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84111 SECTRACK 1035200 MS MS16-027 Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via crafted media content, aka "Windows Media Parsing Remote Code Execution Vulnerability."

cpe:/a:microsoft:edge cpe:/a:microsoft:internet_explorer:11

CVE-2016-0102

2016-03-09T06:59:12.543-05:00

2018-10-12T18:11:05.003-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84018 SECTRACK 1035203 SECTRACK 1035204 MS MS16-023 MS MS16-024 Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0103

2016-03-09T06:59:13.450-05:00

2018-10-12T18:11:05.643-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84013 SECTRACK 1035203 MS MS16-023 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0106, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.

cpe:/a:microsoft:internet_explorer:10

CVE-2016-0104

2016-03-09T06:59:14.437-05:00

2018-10-12T18:11:05.973-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84009 SECTRACK 1035203 MS MS16-023 Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:edge cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0105

2016-03-09T06:59:15.327-05:00

2018-10-12T18:11:06.253-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84019 SECTRACK 1035203 SECTRACK 1035204 MS MS16-023 MS MS16-024 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0107, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0106

2016-03-09T06:59:16.233-05:00

2018-10-12T18:11:06.753-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84014 SECTRACK 1035203 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-179 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-180 MS MS16-023 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0108, CVE-2016-0109, and CVE-2016-0114.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0107

2016-03-09T06:59:17.153-05:00

2018-10-12T18:11:07.143-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84015 SECTRACK 1035203 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-183 MS MS16-023 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0111, CVE-2016-0112, and CVE-2016-0113.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0108

2016-03-09T06:59:18.043-05:00

2018-10-12T18:11:07.473-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84016 SECTRACK 1035203 MS MS16-023 EXPLOIT-DB 39562 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0109, and CVE-2016-0114.

cpe:/a:microsoft:edge cpe:/a:microsoft:internet_explorer:11

CVE-2016-0109

2016-03-09T06:59:18.950-05:00

2018-10-12T18:11:07.817-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84020 SECTRACK 1035203 SECTRACK 1035204 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-184 MS MS16-023 MS MS16-024 Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0114.

cpe:/a:microsoft:edge cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0110

2016-03-09T06:59:19.857-05:00

2018-10-12T18:11:08.377-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84021 SECTRACK 1035203 SECTRACK 1035204 MS MS16-023 MS MS16-024 Microsoft Internet Explorer 10 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

cpe:/a:microsoft:edge cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0111

2016-03-09T06:59:20.747-05:00

2018-10-12T18:11:08.877-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84022 SECTRACK 1035203 SECTRACK 1035204 MS MS16-023 MS MS16-024 EXPLOIT-DB 39663 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0112

2016-03-09T06:59:21.747-05:00

2018-10-12T18:11:09.427-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84010 SECTRACK 1035203 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-185 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-188 MS MS16-023 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0113.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0113

2016-03-09T06:59:22.733-05:00

2018-10-12T18:11:09.817-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84011 SECTRACK 1035203 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-186 MS MS16-023 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0111, and CVE-2016-0112.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0114

2016-03-09T06:59:23.640-05:00

2018-10-12T18:11:10.143-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84012 SECTRACK 1035203 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-187 MS MS16-023 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0102, CVE-2016-0103, CVE-2016-0106, CVE-2016-0108, and CVE-2016-0109.

CVE-2016-0115

2017-05-11T10:29:56.217-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:edge

CVE-2016-0116

2016-03-09T06:59:24.593-05:00

2018-10-12T18:11:10.473-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035204 MS MS16-024 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0123, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130.

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0117

2016-03-09T06:59:25.513-05:00

2018-10-12T18:11:10.677-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84109 SECTRACK 1035202 MS MS16-028 The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511

CVE-2016-0118

2016-03-09T06:59:26.513-05:00

2018-10-12T18:11:10.940-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84112 SECTRACK 1035202 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-177 MS MS16-028 The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows Remote Code Execution Vulnerability."

CVE-2016-0119

2017-05-11T10:29:56.250-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0120

2016-03-09T06:59:27.453-05:00

2018-10-12T18:11:11.270-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84071 SECTRACK 1035198 MS MS16-026 EXPLOIT-DB 39561 The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."

CVE-2016-0121

2016-03-09T06:59:28.360-05:00

2018-10-12T18:11:11.597-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84027 SECTRACK 1035198 MS MS16-026 EXPLOIT-DB 39560 The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."

cpe:/a:microsoft:excel:2007:sp3 cpe:/a:microsoft:excel:2010:sp2 cpe:/a:microsoft:excel:2013:sp1 cpe:/a:microsoft:excel:2013:sp1:~~rt~~~ cpe:/a:microsoft:excel:2016 cpe:/a:microsoft:excel_viewer cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:word_for_mac:2016

CVE-2016-0122

2016-04-12T19:59:04.117-04:00

2018-10-12T18:11:11.940-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035525 MS MS16-042 EXPLOIT-DB 39694 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:edge

CVE-2016-0123

2016-03-09T06:59:29.233-05:00

2018-10-12T18:11:12.207-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84114 SECTRACK 1035204 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-178 MS MS16-024 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0124, CVE-2016-0129, and CVE-2016-0130.

cpe:/a:microsoft:edge

CVE-2016-0124

2016-03-09T06:59:30.170-05:00

2018-10-12T18:11:12.537-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84115 SECTRACK 1035204 MS MS16-024 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0129, and CVE-2016-0130.

cpe:/a:microsoft:edge

CVE-2016-0125

2016-03-09T06:59:31.047-05:00

2018-10-12T18:11:12.787-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035204 MS MS16-024 Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Disclosure Vulnerability."

cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016

CVE-2016-0126

2016-05-10T21:59:02.647-04:00

2018-10-30T12:27:52.233-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89938 SECTRACK 1035819 MS MS16-054 Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_web_apps_server:2010:sp2 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word_viewer

CVE-2016-0127

2016-04-12T19:59:05.617-04:00

2018-10-12T18:11:13.270-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035524 SECTRACK 1035525 MS MS16-042 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0128

2016-04-12T19:59:06.587-04:00

2019-09-27T13:21:55.877-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-09-27T12:03:40.093-04:00

MISC http://badlock.org/ SECTRACK 1035534 CONFIRM https://bto.bluecoat.com/security-advisory/sa122 MS MS16-047 CERT-VN VU#813296 MISC https://www.samba.org/samba/security/CVE-2016-2118.html The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."

cpe:/a:microsoft:edge

CVE-2016-0129

2016-03-09T06:59:31.937-05:00

2018-10-12T18:11:14.050-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84116 SECTRACK 1035204 MS MS16-024 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0130.

cpe:/a:microsoft:edge

CVE-2016-0130

2016-03-09T06:59:32.860-05:00

2018-10-12T18:11:14.300-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 84117 SECTRACK 1035204 MS MS16-024 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0116, CVE-2016-0123, CVE-2016-0124, and CVE-2016-0129.

CVE-2016-0131

2017-05-11T10:29:56.267-04:00

2017-05-11T10:29:56.280-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:.net_framework:2.0:sp2 cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:.net_framework:4.5.2 cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1

CVE-2016-0132

2016-03-09T06:59:33.827-05:00

2018-10-12T18:11:14.567-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84075 SECTRACK 1035213 MS MS16-035 Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML documents, which allows remote attackers to spoof signatures via a modified document, aka ".NET XML Validation Security Feature Bypass."

CVE-2016-0133

2016-03-09T06:59:34.750-05:00

2018-10-12T18:11:14.817-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84035 SECTRACK 1035211 MS MS16-033 The USB Mass Storage Class driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows physically proximate attackers to execute arbitrary code by inserting a crafted USB device, aka "USB Mass Storage Elevation of Privilege Vulnerability."

cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:office_web_apps_server:2010:sp2 cpe:/a:microsoft:office_web_apps_server:2013:sp1 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:sharepoint_server:2013:sp1 cpe:/a:microsoft:word:2007:sp3 cpe:/a:microsoft:word:2010:sp2 cpe:/a:microsoft:word:2013:sp1 cpe:/a:microsoft:word:2013:sp1:~~rt~~~ cpe:/a:microsoft:word:2016 cpe:/a:microsoft:word_for_mac:2011 cpe:/a:microsoft:word_for_mac:2016 cpe:/a:microsoft:word_viewer

CVE-2016-0134

2016-03-09T06:59:35.640-05:00

2018-10-12T18:11:15.097-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 84026 SECTRACK 1035206 SECTRACK 1035207 MS MS16-029 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511

CVE-2016-0135

2016-04-12T19:59:07.527-04:00

2018-10-12T18:11:15.427-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035541 MS MS16-046 The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

cpe:/a:microsoft:excel:2007:sp3 cpe:/a:microsoft:excel:2010:sp2 cpe:/a:microsoft:office_compatibility_pack::sp3 cpe:/a:microsoft:sharepoint_designer:2007:sp3 cpe:/a:microsoft:sharepoint_foundation:2010:sp2

CVE-2016-0136

2016-04-12T19:59:08.587-04:00

2018-10-12T18:11:15.630-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035524 SECTRACK 1035525 MS MS16-042 IDEFENSE 20160412 Microsoft Excel Uninitialized Pointer Memory Corruption Vulnerability Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016

CVE-2016-0137

2016-09-14T06:59:00.180-04:00

2018-10-12T18:11:15.973-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92785 SECTRACK 1036785 MS MS16-107 The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft APP-V ASLR Bypass."

cpe:/a:microsoft:exchange_server:2007:sp3 cpe:/a:microsoft:exchange_server:2010:sp3 cpe:/a:microsoft:exchange_server:2013:cumulative_update_12 cpe:/a:microsoft:exchange_server:2013:cumulative_update_13 cpe:/a:microsoft:exchange_server:2013:sp1 cpe:/a:microsoft:exchange_server:2016:cumulative_update_1 cpe:/a:microsoft:exchange_server:2016:cumulative_update_2

CVE-2016-0138

2016-09-14T06:59:02.133-04:00

2018-10-12T18:11:16.253-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 92806 SECTRACK 1036778 MS MS16-108 Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses e-mail messages, which allows remote authenticated users to obtain sensitive Outlook application information by leveraging the Send As right, aka "Microsoft Exchange Information Disclosure Vulnerability."

cpe:/a:microsoft:excel:2010:sp2 cpe:/a:microsoft:excel_viewer cpe:/a:microsoft:word_for_mac:2011

CVE-2016-0139

2016-04-12T19:59:09.933-04:00

2018-10-12T18:11:16.520-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035525 MS MS16-042 Microsoft Excel 2010 SP2, Word for Mac 2011, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office_web_apps:2010:sp2 cpe:/a:microsoft:sharepoint_server:2010:sp2

CVE-2016-0140

2016-05-10T21:59:03.837-04:00

2018-10-12T18:11:16.707-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89953 SECTRACK 1035819 MS MS16-054 Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2:x64 cpe:/a:microsoft:office:2010:sp2:x86 cpe:/a:microsoft:office:2013:sp1 cpe:/a:microsoft:office:2016

CVE-2016-0141

2016-09-14T06:59:03.320-04:00

2018-10-12T18:11:16.973-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92903 SECTRACK 1036785 MS MS16-107 The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."

CVE-2016-0142

2016-10-13T22:59:04.907-04:00

2018-10-12T18:11:17.237-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 93378 SECTRACK 1036983 MS MS16-122 Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Video Control Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0143

2016-04-12T19:59:10.887-04:00

2018-10-12T18:11:17.503-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 85896 SECTRACK 1035529 SECTRACK 1035532 MS MS16-039 EXPLOIT-DB 39712 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0165 and CVE-2016-0167.

CVE-2016-0144

2017-05-11T10:29:56.297-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:.net_framework:3.0:sp2 cpe:/a:microsoft:.net_framework:3.5 cpe:/a:microsoft:.net_framework:3.5.1 cpe:/a:microsoft:live_meeting:2007 cpe:/a:microsoft:lync:2010 cpe:/a:microsoft:lync:2010::attendee cpe:/a:microsoft:lync:2013:sp1 cpe:/a:microsoft:office:2007:sp3 cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:skype_for_business:2016 cpe:/a:microsoft:word_viewer cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7:-:sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008:-:sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0145

2016-04-12T19:59:11.777-04:00

2018-10-12T18:11:17.910-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035528 SECTRACK 1035529 SECTRACK 1035530 SECTRACK 1035531 SECTRACK 1035532 MS MS16-039 EXPLOIT-DB 39743 The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Graphics Memory Corruption Vulnerability."

CVE-2016-0146

2017-05-11T10:29:56.327-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:xml_core_services:3.0

CVE-2016-0147

2016-04-12T19:59:12.730-04:00

2018-10-12T18:11:18.503-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035523 MS MS16-040 Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site, aka "MSXML 3.0 Remote Code Execution Vulnerability."

cpe:/a:microsoft:.net_framework:4.6 cpe:/a:microsoft:.net_framework:4.6.1

CVE-2016-0148

2016-04-12T19:59:13.653-04:00

2018-10-12T18:11:18.707-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136671/.NET-Framework-4.6-DLL-Hijacking.html FULLDISC 20160412 .NET Framework 4.6 allows side loading of Windows API Set DLL BUGTRAQ 20160412 .NET Framework 4.6 allows side loading of Windows API Set DLL SECTRACK 1035535 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-234 MS MS16-041 Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading, which allows local users to gain privileges via a crafted application, aka ".NET Framework Remote Code Execution Vulnerability."

CVE-2016-0149

2016-05-10T21:59:04.993-04:00

2018-10-12T18:11:19.270-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 90026 SECTRACK 1035842 MS MS16-065 Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows man-in-the-middle attackers to obtain sensitive cleartext information via vectors involving injection of cleartext data into the client-server data stream, aka "TLS/SSL Information Disclosure Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511

CVE-2016-0150

2016-04-12T19:59:14.937-04:00

2018-10-12T18:11:19.537-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035546 MS MS16-049 HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service (system hang) via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0151

2016-04-12T19:59:15.890-04:00

2018-10-12T18:11:19.723-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035544 MS MS16-048 EXPLOIT-DB 39740 The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass Vulnerability."

cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0152

2016-05-10T21:59:06.353-04:00

2018-10-12T18:11:19.987-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90020 SECTRACK 1035834 MS MS16-058 Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."

cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0153

2016-04-12T19:59:16.907-04:00

2018-10-12T18:11:20.253-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035536 MS MS16-044 OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 allows remote attackers to execute arbitrary code via a crafted file, aka "Windows OLE Remote Code Execution Vulnerability."

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0154

2016-04-12T19:59:17.923-04:00

2018-10-12T18:11:20.457-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035521 SECTRACK 1035522 MS MS16-037 MS MS16-038 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0155

2016-04-12T19:59:18.877-04:00

2018-10-12T18:11:20.880-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035522 MS MS16-038 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0156 and CVE-2016-0157.

cpe:/a:microsoft:edge:-

CVE-2016-0156

2016-04-12T19:59:20.187-04:00

2018-10-12T18:11:21.067-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

cpe:/a:microsoft:edge:-

CVE-2016-0157

2016-04-12T19:59:21.207-04:00

2018-10-12T18:11:21.270-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035522 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-232 MS MS16-038 Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0155 and CVE-2016-0156.

cpe:/a:microsoft:edge:-

CVE-2016-0158

2016-04-12T19:59:22.080-04:00

2018-10-12T18:11:21.537-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035522 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-233 MS MS16-038 Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0161.

cpe:/a:microsoft:internet_explorer:9

CVE-2016-0159

2016-04-12T19:59:22.987-04:00

2018-10-12T18:11:21.800-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035521 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-231 MS MS16-037 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0160

2016-04-12T19:59:23.987-04:00

2018-10-12T18:11:22.067-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136702/Microsoft-Internet-Explorer-11-DLL-Hijacking.html FULLDISC 20160416 Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability BUGTRAQ 20160415 Microsoft Internet Explorer 11 MSHTML.DLL Remote Binary Planting Vulnerability SECTRACK 1035521 MS MS16-037 Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0161

2016-04-12T19:59:25.333-04:00

2018-10-12T18:11:22.567-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035522 MS MS16-038 Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Edge Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0158.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0162

2016-04-12T19:59:26.410-04:00

2018-10-12T18:11:22.770-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 85939 SECTRACK 1035521 MS MS16-037 Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2016-0163

2017-05-11T10:29:56.373-04:00

2017-05-11T10:29:56.390-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0164

2016-04-12T19:59:27.380-04:00

2018-10-12T18:11:23.020-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 85922 SECTRACK 1035521 MS MS16-037 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0165

2016-04-12T19:59:28.303-04:00

2018-10-12T18:11:23.287-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035529 SECTRACK 1035532 MS MS16-039 EXPLOIT-DB 44480 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0167.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0166

2016-04-12T19:59:29.210-04:00

2018-10-12T18:11:23.630-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035521 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-230 MS MS16-037 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1:- cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0167

2016-04-12T19:59:30.430-04:00

2018-10-12T18:11:23.880-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035529 SECTRACK 1035532 MS MS16-039 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0143 and CVE-2016-0165.

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0168

2016-05-10T21:59:07.680-04:00

2018-10-12T18:11:24.147-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137094/Microsoft-Windows-gdi32.dll-Information-Disclosure.html BID 89862 SECTRACK 1035823 MS MS16-055 GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0169.

CVE-2016-0169

2016-05-10T21:59:08.807-04:00

2018-10-12T18:11:24.490-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137095/Microsoft-Windows-gdi32.dll-Data-Copy.html BID 89863 SECTRACK 1035823 MS MS16-055 GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to obtain sensitive information via a crafted document, aka "Windows Graphics Component Information Disclosure Vulnerability," a different vulnerability than CVE-2016-0168.

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_7:-:sp1:x86 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0170

2016-05-10T21:59:10.027-04:00

2018-10-12T18:11:24.817-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137096/Microsoft-Windows-gdi32.dll-ExtEscape-Buffer-Overflow.html BID 89864 SECTRACK 1035823 MS MS16-055 GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Graphics Component RCE Vulnerability."

CVE-2016-0171

2016-05-10T21:59:11.450-04:00

2018-10-12T18:11:25.160-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137502/Windows-7-win32k-Bitmap-Use-After-Free.html BID 89860 SECTRACK 1035841 MS MS16-062 EXPLOIT-DB 39959 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0173, CVE-2016-0174, and CVE-2016-0196.

CVE-2016-0172

2017-05-11T10:29:56.420-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0173

2016-05-10T21:59:12.747-04:00

2018-10-12T18:11:25.583-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137503/Windows-7-win32k-Bitmap-Use-After-Free.html BID 90064 SECTRACK 1035841 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-279 MISC https://bugs.chromium.org/p/project-zero/issues/detail?id=747 MS MS16-062 EXPLOIT-DB 39960 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0174, and CVE-2016-0196.

CVE-2016-0174

2016-05-10T21:59:13.937-04:00

2018-10-12T18:11:26.147-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90065 SECTRACK 1035841 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-280 MS MS16-062 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0173, and CVE-2016-0196.

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_7:-:sp1:x64 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008::sp2 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0175

2016-05-10T21:59:15.077-04:00

2018-10-12T18:11:26.490-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 90027 SECTRACK 1035841 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-281 MS MS16-062 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses, and consequently bypass the KASLR protection mechanism, via a crafted application, aka "Win32k Information Disclosure Vulnerability."

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2008:r2:sp1 cpe:/o:microsoft:windows_server_2012 cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0176

2016-05-10T21:59:16.483-04:00

2018-10-12T18:11:26.833-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90052 SECTRACK 1035841 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-284 MS MS16-062 dxgkrnl.sys in the DirectX Graphics kernel subsystem in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability."

CVE-2016-0177

2017-05-11T10:29:56.453-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0178

2016-05-10T21:59:17.640-04:00

2018-10-12T18:11:27.193-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 90032 SECTRACK 1035837 MS MS16-061 The RPC NDR Engine in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles free operations, which allows remote attackers to execute arbitrary code via malformed RPC requests, aka "RPC Network Data Representation Engine Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0179

2016-05-10T21:59:18.687-04:00

2018-10-12T18:11:27.457-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89868 SECTRACK 1035825 MS MS16-057 Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Shell Remote Code Execution Vulnerability."

CVE-2016-0180

2016-05-10T21:59:19.953-04:00

2018-10-12T18:11:27.707-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90028 SECTRACK 1035833 MS MS16-060 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles symbolic links, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Elevation of Privilege Vulnerability."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511

CVE-2016-0181

2016-05-10T21:59:21.347-04:00

2018-10-12T18:11:27.973-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 90048 SECTRACK 1035843 MS MS16-066 Microsoft Windows 10 Gold and 1511 allows local users to bypass the Virtual Secure Mode Hypervisor Code Integrity (HVCI) protection mechanism and perform RWX markings of kernel-mode pages via a crafted application, aka "Hypervisor Code Integrity Security Feature Bypass."

cpe:/o:microsoft:windows_10:- cpe:/o:microsoft:windows_10:1511 cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0182

2016-05-10T21:59:22.533-04:00

2018-10-12T18:11:28.240-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89867 SECTRACK 1035824 MS MS16-056 IDEFENSE 20160510 Microsoft Windows Journal OOB Write Memory Corruption Vulnerability Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal (aka .jnt) file, aka "Windows Journal Memory Corruption Vulnerability."

cpe:/a:microsoft:office:2010:sp2 cpe:/a:microsoft:office_web_apps:2010:sp2 cpe:/a:microsoft:sharepoint_server:2010:sp2 cpe:/a:microsoft:word:2010:sp2

CVE-2016-0183

2016-05-10T21:59:23.610-04:00

2018-10-12T18:11:28.567-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035819 MS MS16-054 The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Microsoft Office Graphics RCE Vulnerability."

CVE-2016-0184

2016-05-10T21:59:24.737-04:00

2018-10-12T18:11:28.770-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89892 SECTRACK 1035823 MS MS16-055 Use-after-free vulnerability in GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Direct3D Use After Free Vulnerability."

cpe:/o:microsoft:windows_7::sp1 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::sp2

CVE-2016-0185

2016-05-10T21:59:26.097-04:00

2018-10-12T18:11:29.037-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 90023 SECTRACK 1035832 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-277 MS MS16-059 EXPLOIT-DB 39805 Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0186

2016-05-10T21:59:27.207-04:00

2018-10-12T18:11:29.473-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90008 SECTRACK 1035821 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-338 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-355 MS MS16-052 The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0191 and CVE-2016-0193.

cpe:/a:microsoft:jscript:5.8 cpe:/a:microsoft:vbscript:5.8

CVE-2016-0187

2016-05-10T21:59:28.300-04:00

2018-10-12T18:11:29.863-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90011 SECTRACK 1035820 MS MS16-051 MS MS16-053 The Microsoft (1) JScript 5.8 and (2) VBScript 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0189.

cpe:/a:microsoft:internet_explorer:11

CVE-2016-0188

2016-05-10T21:59:29.397-04:00

2018-10-12T18:11:30.303-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 90003 SECTRACK 1035820 MS MS16-051 The User Mode Code Integrity (UMCI) implementation in Device Guard in Microsoft Internet Explorer 11 allows remote attackers to bypass a code-signing protection mechanism via unspecified vectors, aka "Internet Explorer Security Feature Bypass."

cpe:/a:microsoft:jscript:5.8 cpe:/a:microsoft:vbscript:5.7 cpe:/a:microsoft:vbscript:5.8

CVE-2016-0189

2016-05-10T21:59:30.537-04:00

2018-10-12T18:11:30.600-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90012 SECTRACK 1035820 MS MS16-051 MS MS16-053 EXPLOIT-DB 40118 MISC https://www.virusbulletin.com/virusbulletin/2017/01/journey-and-evolution-god-mode-2016-cve-2016-0189/ The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_rt_8.1 cpe:/o:microsoft:windows_server_2012:- cpe:/o:microsoft:windows_server_2012:r2

CVE-2016-0190

2016-05-10T21:59:32.130-04:00

2018-10-12T18:11:31.177-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 90075 SECTRACK 1035844 MS MS16-067 Volume Manager Driver in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT 8.1 does not properly check whether RemoteFX RDP USB disk accesses originate from the user who mounted a disk, which allows local users to read arbitrary files on these disks via RemoteFX requests, aka "Remote Desktop Protocol Drive Redirection Information Disclosure Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0191

2016-05-10T21:59:33.350-04:00

2018-10-12T18:11:31.443-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90010 SECTRACK 1035821 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-282 MS MS16-052 The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.

cpe:/a:microsoft:edge:- cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11

CVE-2016-0192

2016-05-10T21:59:34.350-04:00

2018-10-12T18:11:31.787-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90007 SECTRACK 1035820 SECTRACK 1035821 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-276 MS MS16-051 MS MS16-052 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

cpe:/a:microsoft:edge:-

CVE-2016-0193

2016-05-10T21:59:35.413-04:00

2018-10-12T18:11:32.333-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 90009 SECTRACK 1035821 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-283 MS MS16-052 The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.

cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0194

2016-05-10T21:59:36.963-04:00

2018-10-12T18:11:32.660-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 90004 SECTRACK 1035820 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-275 MS MS16-051 Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass file permissions and obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."

CVE-2016-0195

2016-05-10T21:59:37.883-04:00

2018-10-12T18:11:32.990-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89901 SECTRACK 1035823 MS MS16-055 The Imaging Component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Imaging Component Memory Corruption Vulnerability."

CVE-2016-0196

2016-05-10T21:59:38.837-04:00

2018-10-12T18:11:33.257-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90101 SECTRACK 1035841 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-278 MS MS16-062 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0171, CVE-2016-0173, and CVE-2016-0174.

CVE-2016-0197

2016-05-10T21:59:39.900-04:00

2018-10-12T18:11:33.600-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90102 SECTRACK 1035841 MS MS16-062 dxgkrnl.sys in the DirectX Graphics kernel subsystem in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Microsoft DirectX Graphics Kernel Subsystem Elevation of Privilege Vulnerability."

CVE-2016-0198

2016-05-10T21:59:41.230-04:00

2018-10-12T18:11:33.863-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BID 89962 SECTRACK 1035819 MS MS16-054 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0199

2016-06-15T21:59:04.133-04:00

2018-10-12T18:11:34.147-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137533/Microsoft-Internet-Explorer-11-Garbage-Collector-Attribute-Type-Confusion.html FULLDISC 20160618 CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion BUGTRAQ 20160617 CVE-2016-0199 / MS16-063: MSIE 11 garbage collector attribute type confusion SECTRACK 1036096 MS MS16-063 EXPLOIT-DB 39994 IDEFENSE 20160614 Microsoft Internet Explorer 11 Garbage Collector Attribute Type Confusion Vulnerability Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and CVE-2016-3211.

cpe:/a:microsoft:internet_explorer:9 cpe:/a:microsoft:internet_explorer:10 cpe:/a:microsoft:internet_explorer:11:-

CVE-2016-0200

2016-06-15T21:59:05.057-04:00

2018-10-12T18:11:34.817-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1036096 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-365 MS MS16-063 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-3211.

cpe:/o:ibm:security_network_protection_firmware:5.3.1 cpe:/o:ibm:security_network_protection_firmware:5.3.2

CVE-2016-0201

2016-01-18T00:59:07.647-05:00

2016-12-07T13:30:24.503-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 80883 SECTRACK 1034696 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21974242 GSKit in IBM Security Network Protection 5.3.1 before 5.3.1.7 and 5.3.2 allows remote attackers to discover credentials by triggering an MD5 collision.

cpe:/a:ibm:cloud_orchestrator:2.3 cpe:/a:ibm:cloud_orchestrator:2.3.0.1 cpe:/a:ibm:cloud_orchestrator:2.4 cpe:/a:ibm:cloud_orchestrator:2.4.0.1 cpe:/a:ibm:cloud_orchestrator:2.4.0.2 cpe:/a:ibm:cloud_orchestrator:2.4.0.3

CVE-2016-0202

2017-02-08T17:59:00.277-05:00

2017-02-15T07:39:17.533-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-14T11:27:47.857-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg2C1000134 BID 94578 A vulnerability has been identified in tasks, backend object generated for handling any action performed by the application in IBM Cloud Orchestrator. It is possible for an authenticated user to view any task of the current users domain.

cpe:/a:ibm:cloud_orchestrator:2.4 cpe:/a:ibm:cloud_orchestrator:2.4.0.1 cpe:/a:ibm:cloud_orchestrator:2.4.0.2 cpe:/a:ibm:cloud_orchestrator:2.4.0.3 cpe:/a:ibm:cloud_orchestrator:2.5 cpe:/a:ibm:cloud_orchestrator:2.5.01 cpe:/a:ibm:smartcloud_orchestrator:2.3 cpe:/a:ibm:smartcloud_orchestrator:2.3.0.1

CVE-2016-0203

2017-02-08T17:59:00.307-05:00

2017-02-15T09:13:32.270-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-14T12:26:42.593-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg2C1000140 BID 94440 A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information associated with actions performed on virtual machines in projects where the user belongs to.

cpe:/a:ibm:cloud_orchestrator:2.4.0.0 cpe:/a:ibm:cloud_orchestrator:2.4.0.1 cpe:/a:ibm:cloud_orchestrator:2.4.0.2

CVE-2016-0204

2016-10-16T17:59:04.207-04:00

2018-05-02T11:23:57.407-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-01T14:18:29.107-04:00

BID 93512 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000124 Open redirect vulnerability in IBM Cloud Orchestrator 2.4.x before 2.4.0 FP3 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

cpe:/a:ibm:cloud_orchestrator:2.3.0.0 cpe:/a:ibm:cloud_orchestrator:2.3.0.1 cpe:/a:ibm:cloud_orchestrator:2.4.0.0 cpe:/a:ibm:cloud_orchestrator:2.4.0.1

CVE-2016-0205

2018-08-30T12:29:00.243-04:00

2019-10-09T19:16:08.073-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov XF ibm-co-cve20160205-info-disc(109394) CONFIRM https://www-01.ibm.com/support/docview.wss?uid=swg2C4000049 A vulnerability has been identified in IBM Cloud Orchestrator 2.3, 2.3.0.1, 2.4, and 2.4.0.1 that could allow an attacker after authentication to enumerate valid users of the system. IBM X-Force ID: 109394.

cpe:/a:ibm:cloud_orchestrator:2.3 cpe:/a:ibm:cloud_orchestrator:2.3.0.1 cpe:/a:ibm:cloud_orchestrator:2.4 cpe:/a:ibm:cloud_orchestrator:2.4.0.1 cpe:/a:ibm:cloud_orchestrator:2.4.0.2

CVE-2016-0206

2017-02-08T17:59:00.323-05:00

2017-02-15T08:46:43.590-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-02-14T11:04:56.107-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg2C1000141 BID 94656 IBM Cloud Orchestrator could allow a local authenticated attacker to cause the server to slow down for a short period of time by using a specially crafted and malformed URL.

cpe:/a:ibm:algo_risk_application:4.9.1 cpe:/a:ibm:algo_risk_application:5.0.0 cpe:/a:ibm:algo_risk_application:5.1.0

CVE-2016-0207

2018-01-16T14:29:00.823-05:00

2018-02-01T15:42:31.090-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-01T10:18:32.877-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981322 XF ibm-algo-cve20160207-clickjacking(109399) IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. IBM X-Force ID: 109399.

cpe:/a:ibm:websphere_commerce:6.0.0.0 cpe:/a:ibm:websphere_commerce:6.0.0.1 cpe:/a:ibm:websphere_commerce:6.0.0.2 cpe:/a:ibm:websphere_commerce:6.0.0.3 cpe:/a:ibm:websphere_commerce:6.0.0.4 cpe:/a:ibm:websphere_commerce:6.0.0.5 cpe:/a:ibm:websphere_commerce:6.0.0.6 cpe:/a:ibm:websphere_commerce:6.0.0.7 cpe:/a:ibm:websphere_commerce:6.0.0.8 cpe:/a:ibm:websphere_commerce:6.0.0.9 cpe:/a:ibm:websphere_commerce:6.0.0.10 cpe:/a:ibm:websphere_commerce:6.0.0.11 cpe:/a:ibm:websphere_commerce:7.0 cpe:/a:ibm:websphere_commerce:7.0.0.1 cpe:/a:ibm:websphere_commerce:7.0.0.2 cpe:/a:ibm:websphere_commerce:7.0.0.3 cpe:/a:ibm:websphere_commerce:7.0.0.4 cpe:/a:ibm:websphere_commerce:7.0.0.5 cpe:/a:ibm:websphere_commerce:7.0.0.6 cpe:/a:ibm:websphere_commerce:7.0.0.7 cpe:/a:ibm:websphere_commerce:7.0.0.8 cpe:/a:ibm:websphere_commerce:7.0.0.9 cpe:/a:ibm:websphere_commerce:8.0.0.0 cpe:/a:ibm:websphere_commerce:8.0.0.1 cpe:/a:ibm:websphere_commerce:8.0.0.2

CVE-2016-0208

2016-03-13T21:59:00.153-04:00

2019-09-30T12:19:44.473-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1035239 AIXAPAR JR54988 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21975774 IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors.

cpe:/a:ibm:websphere_portal:8.5.0.0

CVE-2016-0209

2016-01-27T00:59:03.417-05:00

2016-12-07T13:30:25.440-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1034844 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21974564 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF09 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:sterling_b2b_integrator:5.1 cpe:/a:ibm:sterling_b2b_integrator:5.2

CVE-2016-0210

2017-02-08T17:59:00.370-05:00

2017-02-15T08:13:35.893-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-14T14:21:11.527-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21981549 BID 90527 IBM Sterling B2B Integrator Standard Edition could allow a remote attacker to obtain sensitive information. By allowing HTTP OPTIONS method, a remote attacker could send a specially-crafted query to a vulnerable server running to cause the server to disclose sensitive information in the HTTP response.

cpe:/a:ibm:db2:9.7 cpe:/a:ibm:db2:9.7::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7::~~enterprise~~~ cpe:/a:ibm:db2:9.7::~~express~~~ cpe:/a:ibm:db2:9.7::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.1 cpe:/a:ibm:db2:9.7.0.1::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.1::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.1::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.1::~~express~~~ cpe:/a:ibm:db2:9.7.0.1::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.2 cpe:/a:ibm:db2:9.7.0.2::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.2::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.2::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.2::~~express~~~ cpe:/a:ibm:db2:9.7.0.2::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.3 cpe:/a:ibm:db2:9.7.0.3::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.3::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.3::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.3::~~express~~~ cpe:/a:ibm:db2:9.7.0.3::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.4 cpe:/a:ibm:db2:9.7.0.4::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.4::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.4::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.4::~~express~~~ cpe:/a:ibm:db2:9.7.0.4::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.5 cpe:/a:ibm:db2:9.7.0.5::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.5::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.5::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.5::~~express~~~ cpe:/a:ibm:db2:9.7.0.5::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.6 cpe:/a:ibm:db2:9.7.0.6::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.6::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.6::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.6::~~express~~~ cpe:/a:ibm:db2:9.7.0.6::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.7 cpe:/a:ibm:db2:9.7.0.7::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.7::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.7::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.7::~~express~~~ cpe:/a:ibm:db2:9.7.0.7::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.8 cpe:/a:ibm:db2:9.7.0.8::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.8::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.8::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.8::~~express~~~ cpe:/a:ibm:db2:9.7.0.8::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.9 cpe:/a:ibm:db2:9.7.0.9::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.9::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.9::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.9::~~express~~~ cpe:/a:ibm:db2:9.7.0.9::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.10 cpe:/a:ibm:db2:9.7.0.10::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.10::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.10::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.10::~~express~~~ cpe:/a:ibm:db2:9.7.0.10::~~workgroup~~~ cpe:/a:ibm:db2:9.7.0.11 cpe:/a:ibm:db2:9.7.0.11::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.7.0.11::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.7.0.11::~~enterprise~~~ cpe:/a:ibm:db2:9.7.0.11::~~express~~~ cpe:/a:ibm:db2:9.7.0.11::~~workgroup~~~ cpe:/a:ibm:db2:9.8 cpe:/a:ibm:db2:9.8::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8::~~enterprise~~~ cpe:/a:ibm:db2:9.8::~~express~~~ cpe:/a:ibm:db2:9.8::~~workgroup~~~ cpe:/a:ibm:db2:9.8.0.1 cpe:/a:ibm:db2:9.8.0.1::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8.0.1::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8.0.1::~~enterprise~~~ cpe:/a:ibm:db2:9.8.0.1::~~express~~~ cpe:/a:ibm:db2:9.8.0.1::~~workgroup~~~ cpe:/a:ibm:db2:9.8.0.2 cpe:/a:ibm:db2:9.8.0.2::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8.0.2::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8.0.2::~~enterprise~~~ cpe:/a:ibm:db2:9.8.0.2::~~express~~~ cpe:/a:ibm:db2:9.8.0.2::~~workgroup~~~ cpe:/a:ibm:db2:9.8.0.3 cpe:/a:ibm:db2:9.8.0.3::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8.0.3::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8.0.3::~~enterprise~~~ cpe:/a:ibm:db2:9.8.0.3::~~express~~~ cpe:/a:ibm:db2:9.8.0.3::~~workgroup~~~ cpe:/a:ibm:db2:9.8.0.4 cpe:/a:ibm:db2:9.8.0.4::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8.0.4::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8.0.4::~~enterprise~~~ cpe:/a:ibm:db2:9.8.0.4::~~express~~~ cpe:/a:ibm:db2:9.8.0.4::~~workgroup~~~ cpe:/a:ibm:db2:9.8.0.5 cpe:/a:ibm:db2:9.8.0.5::~~advanced_enterprise~~~ cpe:/a:ibm:db2:9.8.0.5::~~advanced_workgroup~~~ cpe:/a:ibm:db2:9.8.0.5::~~enterprise~~~ cpe:/a:ibm:db2:9.8.0.5::~~express~~~ cpe:/a:ibm:db2:9.8.0.5::~~workgroup~~~ cpe:/a:ibm:db2:10.1 cpe:/a:ibm:db2:10.1::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1::~~enterprise~~~ cpe:/a:ibm:db2:10.1::~~express~~~ cpe:/a:ibm:db2:10.1::~~workgroup~~~ cpe:/a:ibm:db2:10.1.0.1 cpe:/a:ibm:db2:10.1.0.1::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1.0.1::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1.0.1::~~enterprise~~~ cpe:/a:ibm:db2:10.1.0.1::~~express~~~ cpe:/a:ibm:db2:10.1.0.1::~~workgroup~~~ cpe:/a:ibm:db2:10.1.0.2 cpe:/a:ibm:db2:10.1.0.2::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1.0.2::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1.0.2::~~enterprise~~~ cpe:/a:ibm:db2:10.1.0.2::~~express~~~ cpe:/a:ibm:db2:10.1.0.2::~~workgroup~~~ cpe:/a:ibm:db2:10.1.0.3 cpe:/a:ibm:db2:10.1.0.3::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1.0.3::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1.0.3::~~enterprise~~~ cpe:/a:ibm:db2:10.1.0.3::~~express~~~ cpe:/a:ibm:db2:10.1.0.3::~~workgroup~~~ cpe:/a:ibm:db2:10.1.0.4 cpe:/a:ibm:db2:10.1.0.4::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1.0.4::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1.0.4::~~enterprise~~~ cpe:/a:ibm:db2:10.1.0.4::~~express~~~ cpe:/a:ibm:db2:10.1.0.4::~~workgroup~~~ cpe:/a:ibm:db2:10.1.0.5 cpe:/a:ibm:db2:10.1.0.5::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.1.0.5::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.1.0.5::~~enterprise~~~ cpe:/a:ibm:db2:10.1.0.5::~~express~~~ cpe:/a:ibm:db2:10.1.0.5::~~workgroup~~~ cpe:/a:ibm:db2:10.5 cpe:/a:ibm:db2:10.5::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5::~~enterprise~~~ cpe:/a:ibm:db2:10.5::~~express~~~ cpe:/a:ibm:db2:10.5::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.1 cpe:/a:ibm:db2:10.5.0.1::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.1::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.1::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.1::~~express~~~ cpe:/a:ibm:db2:10.5.0.1::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.2 cpe:/a:ibm:db2:10.5.0.2::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.2::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.2::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.2::~~express~~~ cpe:/a:ibm:db2:10.5.0.2::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.3 cpe:/a:ibm:db2:10.5.0.3::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.3::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.3::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.3::~~express~~~ cpe:/a:ibm:db2:10.5.0.3::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.4 cpe:/a:ibm:db2:10.5.0.4::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.4::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.4::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.4::~~express~~~ cpe:/a:ibm:db2:10.5.0.4::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.5 cpe:/a:ibm:db2:10.5.0.5::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.5::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.5::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.5::~~express~~~ cpe:/a:ibm:db2:10.5.0.5::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.6 cpe:/a:ibm:db2:10.5.0.6::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.6::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.6::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.6::~~express~~~ cpe:/a:ibm:db2:10.5.0.6::~~workgroup~~~ cpe:/a:ibm:db2:10.5.0.7 cpe:/a:ibm:db2:10.5.0.7::~~advanced_enterprise~~~ cpe:/a:ibm:db2:10.5.0.7::~~advanced_workgroup~~~ cpe:/a:ibm:db2:10.5.0.7::~~enterprise~~~ cpe:/a:ibm:db2:10.5.0.7::~~express~~~ cpe:/a:ibm:db2:10.5.0.7::~~workgroup~~~ cpe:/a:ibm:db2_connect:9.7::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.1::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.1::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.1::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.2::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.2::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.2::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.3::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.3::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.3::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.4::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.4::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.4::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.5::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.5::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.5::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.6::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.6::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.6::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.7::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.7::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.7::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.8::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.8::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.8::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.9::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.9::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.9::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.10::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.10::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.10::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.7.0.11::~~application_server~~~ cpe:/a:ibm:db2_connect:9.7.0.11::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.7.0.11::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8.0.1::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8.0.1::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8.0.1::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8.0.2::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8.0.2::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8.0.2::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8.0.3::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8.0.3::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8.0.3::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8.0.4::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8.0.4::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8.0.4::~~unlimited~~~ cpe:/a:ibm:db2_connect:9.8.0.5::~~application_server~~~ cpe:/a:ibm:db2_connect:9.8.0.5::~~enterprise~~~ cpe:/a:ibm:db2_connect:9.8.0.5::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1.0.1::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1.0.1::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1.0.1::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1.0.2::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1.0.2::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1.0.2::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1.0.3::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1.0.3::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1.0.3::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1.0.4::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1.0.4::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1.0.4::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.1.0.5::~~application_server~~~ cpe:/a:ibm:db2_connect:10.1.0.5::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.1.0.5::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.1::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.1::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.1::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.2::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.2::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.2::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.3::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.3::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.3::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.4::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.4::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.4::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.5::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.5::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.5::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.6::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.6::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.6::~~unlimited~~~ cpe:/a:ibm:db2_connect:10.5.0.7::~~application_server~~~ cpe:/a:ibm:db2_connect:10.5.0.7::~~enterprise~~~ cpe:/a:ibm:db2_connect:10.5.0.7::~~unlimited~~~

CVE-2016-0211

2016-04-27T21:59:00.723-04:00

2016-12-02T22:16:13.583-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov BID 85979 SECTRACK 1035660 AIXAPAR IT12462 AIXAPAR IT12487 AIXAPAR IT12488 AIXAPAR IT13350 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979984 IBM DB2 9.7 through FP11, 9.8, 10.1 through FP5, and 10.5 through FP7 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) via a crafted DRDA message.

cpe:/a:ibm:tivoli_storage_manager_fastback:5.5.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.0.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.0.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.1.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.2.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.3 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.3.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.4 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.4.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.8 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.8.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.8.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11.1

CVE-2016-0212

2016-02-29T06:59:04.967-05:00

2016-03-03T14:35:24.210-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-03T14:33:40.490-05:00

CONFIRM http://www.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin_multiple_security_vulnerabilities_in_ibm_tivoli_storage_manager_fastback_cve_2016_0212_cve_2016_0213_cve_2016_0216 CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21975358 Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2016-0213 and CVE-2016-0216.

CVE-2016-0213

2016-02-29T06:59:05.873-05:00

2016-03-03T14:34:17.087-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-03T14:29:05.190-05:00

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.5

CVE-2016-0214

2017-02-08T17:59:00.387-05:00

2017-02-15T08:33:13.193-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-02-14T13:01:08.593-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21993203 BID 94193 IBM Tivoli Endpoint Manager could allow a remote attacker to upload arbitrary files. A remote attacker could exploit this vulnerability to upload a malicious file. The only way that file would be executed would be through a phishing attack to trick an unsuspecting victim to execute the file.

cpe:/a:ibm:db2:9.7::~~advanced_enterprise_server~~~ cpe:/a:ibm:db2:9.7::~~advanced_workgroup_server~~~ cpe:/a:ibm:db2:9.7::~~connect_application_server~~~ cpe:/a:ibm:db2:9.7::~~connect_enterprise~~~ cpe:/a:ibm:db2:9.7::~~connect_unlimited~system_i~~ cpe:/a:ibm:db2:9.7::~~connect_unlimited~system_z~~ cpe:/a:ibm:db2:9.7::~~enterprise_server~~~ cpe:/a:ibm:db2:9.7::~~express~~~ cpe:/a:ibm:db2:9.7::~~workgroup_server~~~ cpe:/a:ibm:db2:9.8::~~enterprise_server~~~ cpe:/a:ibm:db2:10.1::~~advanced_enterprise_server~~~ cpe:/a:ibm:db2:10.1::~~advanced_workgroup_server~~~ cpe:/a:ibm:db2:10.1::~~connect_application_server~~~ cpe:/a:ibm:db2:10.1::~~connect_enterprise~~~ cpe:/a:ibm:db2:10.1::~~connect_unlimited~system_i~~ cpe:/a:ibm:db2:10.1::~~connect_unlimited~system_z~~ cpe:/a:ibm:db2:10.1::~~enterprise_server~~~ cpe:/a:ibm:db2:10.1::~~express~~~ cpe:/a:ibm:db2:10.1::~~workgroup_server~~~ cpe:/a:ibm:db2:10.5::~~advanced_enterprise_server~~~ cpe:/a:ibm:db2:10.5::~~advanced_workgroup_server~~~ cpe:/a:ibm:db2:10.5::~~connect_application_server~~~ cpe:/a:ibm:db2:10.5::~~connect_enterprise~~~ cpe:/a:ibm:db2:10.5::~~connect_unlimited~system_i~~ cpe:/a:ibm:db2:10.5::~~connect_unlimited~system_z~~ cpe:/a:ibm:db2:10.5::~~enterprise_server~~~ cpe:/a:ibm:db2:10.5::~~express~~~ cpe:/a:ibm:db2:10.5::~~workgroup_server~~~

CVE-2016-0215

2018-01-16T14:29:00.887-05:00

2018-02-05T15:12:04.177-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2018-02-02T12:29:38.483-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979986 IBM DB2 9.7, 10.1 before FP6, and 10.5 before FP8 on AIX, Linux, HP, Solaris and Windows allow remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a subquery containing the AVG OLAP function on an Oracle compatible database.

cpe:/a:ibm:tivoli_storage_manager_fastback:5.5.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.0.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.1.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.2.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.3 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.3.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.4 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.4.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.5.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.6.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.7.2 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.8 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.8.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.9.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.10.1 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11.0 cpe:/a:ibm:tivoli_storage_manager_fastback:6.1.11.1

CVE-2016-0216

2016-02-29T06:59:06.843-05:00

2016-03-03T12:04:09.857-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-03T11:51:41.690-05:00

cpe:/a:ibm:cognos_analytics:11.0.0 cpe:/a:ibm:cognos_analytics:11.0.1 cpe:/a:ibm:cognos_analytics:11.0.2 cpe:/a:ibm:cognos_analytics:11.0.3 cpe:/a:ibm:cognos_analytics:11.0.4

CVE-2016-0217

2017-02-01T17:59:00.133-05:00

2019-09-30T11:42:13.787-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-15T09:49:02.933-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21996417 BID 95681 IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

cpe:/a:ibm:cognos_business_intelligence:10.1.1 cpe:/a:ibm:cognos_business_intelligence:10.2 cpe:/a:ibm:cognos_business_intelligence:10.2.1 cpe:/a:ibm:cognos_business_intelligence:10.2.1.1 cpe:/a:ibm:cognos_business_intelligence:10.2.2

CVE-2016-0218

2017-02-01T17:59:00.197-05:00

2017-04-05T21:59:00.340-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 95456 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21995691 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21996417 IBM Cognos Business Intelligence and IBM Cognos Analytics are vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.3 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.4 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.5 cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1 cpe:/a:ibm:rational_doors_next_generation:4.0 cpe:/a:ibm:rational_doors_next_generation:4.0.1 cpe:/a:ibm:rational_doors_next_generation:4.0.2 cpe:/a:ibm:rational_doors_next_generation:4.0.3 cpe:/a:ibm:rational_doors_next_generation:4.0.4 cpe:/a:ibm:rational_doors_next_generation:4.0.5 cpe:/a:ibm:rational_doors_next_generation:4.0.6 cpe:/a:ibm:rational_doors_next_generation:4.0.7 cpe:/a:ibm:rational_doors_next_generation:5.0 cpe:/a:ibm:rational_doors_next_generation:5.0.1 cpe:/a:ibm:rational_doors_next_generation:5.0.2 cpe:/a:ibm:rational_doors_next_generation:6.0 cpe:/a:ibm:rational_doors_next_generation:6.0.1 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.3 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.4 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.5 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.6 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.7 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0.1 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0.2 cpe:/a:ibm:rational_engineering_lifecycle_manager:6.0 cpe:/a:ibm:rational_engineering_lifecycle_manager:6.0.1 cpe:/a:ibm:rational_quality_manager:3.0 cpe:/a:ibm:rational_quality_manager:3.0.1 cpe:/a:ibm:rational_quality_manager:3.0.1.1 cpe:/a:ibm:rational_quality_manager:3.0.1.2 cpe:/a:ibm:rational_quality_manager:3.0.1.3 cpe:/a:ibm:rational_quality_manager:3.0.1.4 cpe:/a:ibm:rational_quality_manager:3.0.1.5 cpe:/a:ibm:rational_quality_manager:3.0.1.6 cpe:/a:ibm:rational_quality_manager:4.0 cpe:/a:ibm:rational_quality_manager:4.0.0.1 cpe:/a:ibm:rational_quality_manager:4.0.0.2 cpe:/a:ibm:rational_quality_manager:4.0.1 cpe:/a:ibm:rational_quality_manager:4.0.2 cpe:/a:ibm:rational_quality_manager:4.0.3 cpe:/a:ibm:rational_quality_manager:4.0.4 cpe:/a:ibm:rational_quality_manager:4.0.5 cpe:/a:ibm:rational_quality_manager:4.0.7 cpe:/a:ibm:rational_quality_manager:5.0 cpe:/a:ibm:rational_quality_manager:5.0.1 cpe:/a:ibm:rational_quality_manager:5.0.2 cpe:/a:ibm:rational_quality_manager:6.0 cpe:/a:ibm:rational_quality_manager:6.0.1 cpe:/a:ibm:rational_requirements_composer:3.0 cpe:/a:ibm:rational_requirements_composer:3.0.1 cpe:/a:ibm:rational_requirements_composer:3.0.1.1 cpe:/a:ibm:rational_requirements_composer:3.0.1.2 cpe:/a:ibm:rational_requirements_composer:3.0.1.3 cpe:/a:ibm:rational_requirements_composer:3.0.1.4 cpe:/a:ibm:rational_requirements_composer:3.0.1.5 cpe:/a:ibm:rational_requirements_composer:3.0.1.6 cpe:/a:ibm:rational_requirements_composer:4.0 cpe:/a:ibm:rational_requirements_composer:4.0.1 cpe:/a:ibm:rational_requirements_composer:4.0.2 cpe:/a:ibm:rational_requirements_composer:4.0.3 cpe:/a:ibm:rational_requirements_composer:4.0.4 cpe:/a:ibm:rational_requirements_composer:4.0.5 cpe:/a:ibm:rational_requirements_composer:4.0.6 cpe:/a:ibm:rational_requirements_composer:4.0.7 cpe:/a:ibm:rational_rhapsody_design_manager:4.0 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.1 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.2 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.3 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.4 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.5 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.6 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.7 cpe:/a:ibm:rational_rhapsody_design_manager:5.0 cpe:/a:ibm:rational_rhapsody_design_manager:5.0.1 cpe:/a:ibm:rational_rhapsody_design_manager:5.0.2 cpe:/a:ibm:rational_rhapsody_design_manager:6.0 cpe:/a:ibm:rational_rhapsody_design_manager:6.0.1 cpe:/a:ibm:rational_software_architect_design_manager:4.0 cpe:/a:ibm:rational_software_architect_design_manager:4.0.1 cpe:/a:ibm:rational_software_architect_design_manager:4.0.2 cpe:/a:ibm:rational_software_architect_design_manager:4.0.3 cpe:/a:ibm:rational_software_architect_design_manager:4.0.4 cpe:/a:ibm:rational_software_architect_design_manager:4.0.5 cpe:/a:ibm:rational_software_architect_design_manager:4.0.6 cpe:/a:ibm:rational_software_architect_design_manager:4.0.7 cpe:/a:ibm:rational_software_architect_design_manager:5.0 cpe:/a:ibm:rational_software_architect_design_manager:5.0.1 cpe:/a:ibm:rational_software_architect_design_manager:5.0.2 cpe:/a:ibm:rational_software_architect_design_manager:6.0 cpe:/a:ibm:rational_software_architect_design_manager:6.0.1 cpe:/a:ibm:rational_team_concert:3.0 cpe:/a:ibm:rational_team_concert:3.0.1 cpe:/a:ibm:rational_team_concert:3.0.1.1 cpe:/a:ibm:rational_team_concert:3.0.1.2 cpe:/a:ibm:rational_team_concert:3.0.1.3 cpe:/a:ibm:rational_team_concert:3.0.1.4 cpe:/a:ibm:rational_team_concert:3.0.1.5 cpe:/a:ibm:rational_team_concert:3.0.1.6 cpe:/a:ibm:rational_team_concert:4.0 cpe:/a:ibm:rational_team_concert:4.0.0.1 cpe:/a:ibm:rational_team_concert:4.0.0.2 cpe:/a:ibm:rational_team_concert:4.0.1 cpe:/a:ibm:rational_team_concert:4.0.2 cpe:/a:ibm:rational_team_concert:4.0.3 cpe:/a:ibm:rational_team_concert:4.0.4 cpe:/a:ibm:rational_team_concert:4.0.5 cpe:/a:ibm:rational_team_concert:4.0.6 cpe:/a:ibm:rational_team_concert:4.0.7 cpe:/a:ibm:rational_team_concert:5.0 cpe:/a:ibm:rational_team_concert:5.0.1 cpe:/a:ibm:rational_team_concert:5.0.2 cpe:/a:ibm:rational_team_concert:6.0 cpe:/a:ibm:rational_team_concert:6.0.1

CVE-2016-0219

2018-01-16T14:29:00.963-05:00

2018-02-05T10:07:31.940-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2018-02-02T13:23:33.093-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983720 XF ibm-rtc-cve20160219-dos(109693) XML external entity (XXE) vulnerability in IBM Rational Team Concert 3.0 before 3.0.1.6 iFix7 Interim Fix 1, 4.0 before 4.0.7 iFix10, 5.0 before 5.0.2 iFix15, and 6.0 before 6.0.1 iFix4 allows remote authenticated users to cause a denial of service via crafted XML data. IBM X-Force ID: 109693.

CVE-2016-0221

2016-07-03T17:59:00.133-04:00

2017-08-31T21:29:01.427-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91542 SECTRACK 1036221 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984323 Cross-site scripting (XSS) vulnerability in IBM Cognos TM1, as used in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:maximo_asset_management:7.6.0.0 cpe:/a:ibm:maximo_asset_management:7.6.0.1 cpe:/a:ibm:maximo_asset_management:7.6.0.2 cpe:/a:ibm:maximo_asset_management:7.6.0.3 cpe:/a:ibm:maximo_for_government:- cpe:/a:ibm:maximo_for_life_sciences:- cpe:/a:ibm:maximo_for_nuclear_power:- cpe:/a:ibm:maximo_for_oil_and_gas:- cpe:/a:ibm:maximo_for_transportation:- cpe:/a:ibm:maximo_for_utilities:- cpe:/a:ibm:smartcloud_control_desk:-

CVE-2016-0222

2016-03-13T21:59:01.467-04:00

2016-03-17T18:03:49.993-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-17T15:46:48.610-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21976949 IBM Maximo Asset Management 7.6 before 7.6.0.3 IFIX001 allows remote authenticated users to bypass intended access restrictions and read arbitrary purchase-order work logs via unspecified vectors.

cpe:/a:ibm:forms_server:4.0.0.0 cpe:/a:ibm:forms_server:8.0.0.0 cpe:/a:ibm:forms_server:8.0.1.0 cpe:/a:ibm:forms_server:8.1.0.0 cpe:/a:ibm:forms_server:8.2.0.0

CVE-2016-0223

2018-03-15T18:29:00.480-04:00

2018-04-09T08:23:11.387-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-06T17:16:27.487-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977574 XF ibm-forms-cve20160223-xss(110006) Cross-site scripting (XSS) vulnerability in the Webform Framework API in IBM Forms Server 4.0.x, 8.0.x, 8.1, and 8.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110006.

cpe:/a:ibm:marketing_platform:8.5.0.0 cpe:/a:ibm:marketing_platform:8.5.0.1 cpe:/a:ibm:marketing_platform:8.5.0.2 cpe:/a:ibm:marketing_platform:8.5.0.3 cpe:/a:ibm:marketing_platform:8.5.0.4 cpe:/a:ibm:marketing_platform:8.5.0.5 cpe:/a:ibm:marketing_platform:8.5.0.6 cpe:/a:ibm:marketing_platform:8.5.0.7 cpe:/a:ibm:marketing_platform:8.6.0.0 cpe:/a:ibm:marketing_platform:8.6.0.1 cpe:/a:ibm:marketing_platform:8.6.0.2 cpe:/a:ibm:marketing_platform:8.6.0.3 cpe:/a:ibm:marketing_platform:8.6.0.4 cpe:/a:ibm:marketing_platform:8.6.0.5 cpe:/a:ibm:marketing_platform:8.6.0.6 cpe:/a:ibm:marketing_platform:8.6.0.7 cpe:/a:ibm:marketing_platform:8.6.0.8 cpe:/a:ibm:marketing_platform:8.6.0.9 cpe:/a:ibm:marketing_platform:8.6.0.10 cpe:/a:ibm:marketing_platform:8.6.0.11 cpe:/a:ibm:marketing_platform:9.0.0.0 cpe:/a:ibm:marketing_platform:9.0.0.1 cpe:/a:ibm:marketing_platform:9.0.0.2 cpe:/a:ibm:marketing_platform:9.0.0.3 cpe:/a:ibm:marketing_platform:9.0.0.4 cpe:/a:ibm:marketing_platform:9.1.0.0 cpe:/a:ibm:marketing_platform:9.1.0.1 cpe:/a:ibm:marketing_platform:9.1.0.2 cpe:/a:ibm:marketing_platform:9.1.0.3 cpe:/a:ibm:marketing_platform:9.1.0.4 cpe:/a:ibm:marketing_platform:9.1.0.5 cpe:/a:ibm:marketing_platform:9.1.0.6 cpe:/a:ibm:marketing_platform:9.1.0.7 cpe:/a:ibm:marketing_platform:9.1.0.8 cpe:/a:ibm:marketing_platform:9.1.0.9 cpe:/a:ibm:marketing_platform:9.1.0.10 cpe:/a:ibm:marketing_platform:9.1.1.0 cpe:/a:ibm:marketing_platform:9.1.1.1 cpe:/a:ibm:marketing_platform:9.1.1.2 cpe:/a:ibm:marketing_platform:9.1.1.3 cpe:/a:ibm:marketing_platform:9.1.1.4 cpe:/a:ibm:marketing_platform:9.1.2.0

CVE-2016-0224

2016-06-27T21:59:00.203-04:00

2016-06-28T10:58:31.243-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-28T10:00:54.707-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980989 SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2016-0225

2016-02-29T06:59:07.953-05:00

2019-09-30T12:19:41.927-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-03T16:50:13.050-05:00

AIXAPAR JR54585 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21976623 IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive information via unspecified vectors.

cpe:/a:ibm:informix_dynamic_server:11.70.xcn

CVE-2016-0226

2016-03-28T19:59:00.127-04:00

2016-12-02T22:16:14.663-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1035286 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21978598 MISC http://zerodayinitiative.com/advisories/ZDI-16-208/ MISC http://zerodayinitiative.com/advisories/ZDI-16-209/ MISC http://zerodayinitiative.com/advisories/ZDI-16-210/ The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap executable files, which allows local users to gain privileges via a Trojan horse file.

cpe:/a:ibm:business_process_manager:8.0.0.0::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.0.0.0::~~express~~~ cpe:/a:ibm:business_process_manager:8.0.0.0::~~standard~~~ cpe:/a:ibm:business_process_manager:8.0.1.0::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.0.1.0::~~express~~~ cpe:/a:ibm:business_process_manager:8.0.1.0::~~standard~~~ cpe:/a:ibm:business_process_manager:8.0.1.1::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.0.1.1::~~express~~~ cpe:/a:ibm:business_process_manager:8.0.1.1::~~standard~~~ cpe:/a:ibm:business_process_manager:8.0.1.2::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.0.1.2::~~express~~~ cpe:/a:ibm:business_process_manager:8.0.1.2::~~standard~~~ cpe:/a:ibm:business_process_manager:8.0.1.3::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.0.1.3::~~express~~~ cpe:/a:ibm:business_process_manager:8.0.1.3::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.0.0::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.0.0::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.0.0::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.0.1::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.0.1::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.0.1::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.0.2::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.0.2::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.0.2::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.5.0::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.5.0::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.5.0::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.6.0::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.6.0::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.6.0::~~standard~~~ cpe:/a:ibm:business_process_manager:8.5.6.2::~~advanced~~~ cpe:/a:ibm:business_process_manager:8.5.6.2::~~express~~~ cpe:/a:ibm:business_process_manager:8.5.6.2::~~standard~~~

CVE-2016-0227

2016-03-03T17:59:10.537-05:00

2016-12-02T22:16:15.647-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035175 AIXAPAR JR55152 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21978058 Cross-site scripting (XSS) vulnerability in the document-list control implementation in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.2, and 8.5.5 and 8.5.6 through 8.5.6.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:marketing_platform:10.0

CVE-2016-0228

2017-04-17T17:59:00.170-04:00

2017-04-21T11:19:46.707-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2017-04-21T09:12:10.957-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22001952 BID 97670 IBM Marketing Platform 10.0 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in various scripts. An attacker could exploit this vulnerability to redirect a victim to arbitrary Web sites. IBM X-Force ID: 110236.

cpe:/a:ibm:marketing_platform:8.6.0.0 cpe:/a:ibm:marketing_platform:8.6.0.1 cpe:/a:ibm:marketing_platform:8.6.0.2 cpe:/a:ibm:marketing_platform:8.6.0.3 cpe:/a:ibm:marketing_platform:8.6.0.4 cpe:/a:ibm:marketing_platform:8.6.0.5 cpe:/a:ibm:marketing_platform:8.6.0.6 cpe:/a:ibm:marketing_platform:8.6.0.7 cpe:/a:ibm:marketing_platform:8.6.0.8 cpe:/a:ibm:marketing_platform:8.6.0.9 cpe:/a:ibm:marketing_platform:8.6.0.10 cpe:/a:ibm:marketing_platform:8.6.0.11 cpe:/a:ibm:marketing_platform:9.0.0.0 cpe:/a:ibm:marketing_platform:9.0.0.1 cpe:/a:ibm:marketing_platform:9.0.0.2 cpe:/a:ibm:marketing_platform:9.0.0.3 cpe:/a:ibm:marketing_platform:9.0.0.4 cpe:/a:ibm:marketing_platform:9.1.0.0 cpe:/a:ibm:marketing_platform:9.1.0.1 cpe:/a:ibm:marketing_platform:9.1.0.2 cpe:/a:ibm:marketing_platform:9.1.0.3 cpe:/a:ibm:marketing_platform:9.1.0.4 cpe:/a:ibm:marketing_platform:9.1.0.5 cpe:/a:ibm:marketing_platform:9.1.0.6 cpe:/a:ibm:marketing_platform:9.1.0.7 cpe:/a:ibm:marketing_platform:9.1.0.8 cpe:/a:ibm:marketing_platform:9.1.0.9 cpe:/a:ibm:marketing_platform:9.1.0.10 cpe:/a:ibm:marketing_platform:9.1.1.0 cpe:/a:ibm:marketing_platform:9.1.1.1 cpe:/a:ibm:marketing_platform:9.1.1.2 cpe:/a:ibm:marketing_platform:9.1.1.3 cpe:/a:ibm:marketing_platform:9.1.1.4 cpe:/a:ibm:marketing_platform:9.1.2.0

CVE-2016-0229

2016-06-27T21:59:01.610-04:00

2016-06-28T10:58:55.013-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-28T10:03:08.850-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980989 Cross-site scripting (XSS) vulnerability in IBM Marketing Platform 8.6.x and 9.x before 9.1.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:power_hardware_management_console:7.3.0 cpe:/a:ibm:power_hardware_management_console:7.3.0:sp1 cpe:/a:ibm:power_hardware_management_console:7.3.0:sp4 cpe:/a:ibm:power_hardware_management_console:7.3.0:sp5 cpe:/a:ibm:power_hardware_management_console:7.3.0:sp7 cpe:/a:ibm:power_hardware_management_console:7.9.0 cpe:/a:ibm:power_hardware_management_console:7.9.0:sp1 cpe:/a:ibm:power_hardware_management_console:7.9.0:sp2 cpe:/a:ibm:power_hardware_management_console:7.9.0:sp3 cpe:/a:ibm:power_hardware_management_console:8.1.0 cpe:/a:ibm:power_hardware_management_console:8.1.0:sp1 cpe:/a:ibm:power_hardware_management_console:8.1.0:sp2 cpe:/a:ibm:power_hardware_management_console:8.1.0:sp3 cpe:/a:ibm:power_hardware_management_console:8.2.0 cpe:/a:ibm:power_hardware_management_console:8.2.0:sp1 cpe:/a:ibm:power_hardware_management_console:8.2.0:sp2 cpe:/a:ibm:power_hardware_management_console:8.3.0 cpe:/a:ibm:power_hardware_management_console:8.3.0:sp1 cpe:/a:ibm:power_hardware_management_console:8.3.0:sp2 cpe:/a:ibm:power_hardware_management_console:8.4.0 cpe:/a:ibm:power_hardware_management_console:8.4.0:sp1 cpe:/a:ibm:power_hardware_management_console:8.5.0

CVE-2016-0230

2016-07-07T10:59:00.237-04:00

2016-11-28T14:52:39.190-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

ALLOWS_ADMIN_ACCESS

BID 91535 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1021387 AIXAPAR MB04021 AIXAPAR MB04022 AIXAPAR MB04023 AIXAPAR MB04024 AIXAPAR MB04025 AIXAPAR MB04026 AIXAPAR MB04027 CONFIRM https://delivery04.dhe.ibm.com/sar/CMA/HMA/069vc/2/MH01635.readme.html CONFIRM https://delivery04.dhe.ibm.com/sar/CMA/HMA/069y2/1/MH01636.readme.html CONFIRM https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a1r/2/MH01638.readme.html CONFIRM https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a1v/2/MH01639.readme.html CONFIRM https://delivery04.dhe.ibm.com/sar/CMA/HMA/06a2q/1/MH01640.readme.html IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3, 8.1 through 8.1.0 SP3, 8.2 through 8.2.0 SP2, 8.3 through 8.3.0 SP2, 8.4 through 8.4.0 SP1, and 8.5.0 allows physically proximate attackers to obtain root access via unspecified vectors.

cpe:/a:ibm:financial_transaction_manager:3.0.0.0

CVE-2016-0231

2016-02-15T18:59:00.113-05:00

2016-03-10T16:07:14.247-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-07T10:23:48.857-05:00

AIXAPAR PI56757 AIXAPAR PI56758 AIXAPAR PI56759 AIXAPAR PI56762 AIXAPAR PI56763 AIXAPAR PI56764 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21976392 IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs.

cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~cps_services~~

CVE-2016-0232

2016-02-15T18:59:01.097-05:00

2016-03-10T16:31:48.033-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-09T11:08:34.317-05:00

CVE-2016-0233

2016-06-27T21:59:02.877-04:00

2016-06-28T09:58:20.907-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-06-28T09:47:13.900-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980989 SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:ibm:openpages_grc_platform:7.1.0.0 cpe:/a:ibm:openpages_grc_platform:7.1.0.1 cpe:/a:ibm:openpages_grc_platform:7.1.0.2 cpe:/a:ibm:openpages_grc_platform:7.1.0.3 cpe:/a:ibm:openpages_grc_platform:7.2.0.0 cpe:/a:ibm:openpages_grc_platform:7.2.0.1 cpe:/a:ibm:openpages_grc_platform:7.2.0.2 cpe:/a:ibm:openpages_grc_platform:7.3.0.0

CVE-2016-0234

2018-08-30T12:29:00.417-04:00

2019-10-09T19:16:08.837-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21997687 XF ibm-openpages-cve20160234-info-disc(110303) IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous user has logged out of the system but neglected to close their browser. IBM X-Force ID: 110303.

cpe:/a:ibm:security_guardium_database_activity_monitor:10.0

CVE-2016-0235

2018-03-12T17:29:00.233-04:00

2018-04-04T13:04:14.260-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2018-03-30T19:27:46.050-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981748 XF ibm-guardian-cve20160235-info-disc(110326) IBM Security Guardium Database Activity Monitor 10 allows local users to have unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems. IBM X-Force ID: 110326.

cpe:/a:ibm:security_guardium_database_activity_monitor:8.2 cpe:/a:ibm:security_guardium_database_activity_monitor:9.0 cpe:/a:ibm:security_guardium_database_activity_monitor:9.1 cpe:/a:ibm:security_guardium_database_activity_monitor:9.5 cpe:/a:ibm:security_guardium_database_activity_monitor:10.0 cpe:/a:ibm:security_guardium_database_activity_monitor:10.1

CVE-2016-0236

2016-10-21T13:59:00.167-04:00

2016-11-28T14:52:40.207-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov BID 93823 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990372 IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to execute arbitrary commands with root privileges via the search field.

cpe:/a:ibm:security_guardium_database_activity_monitor:10.0

CVE-2016-0237

2018-03-12T17:29:00.327-04:00

2018-04-04T13:04:35.973-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-30T19:18:56.547-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981631 XF ibm-guardian-cve20160237-info-disc(110328) IBM Security Guardium Database Activity Monitor 10 allows local users to obtain sensitive information by reading cached browser data. IBM X-Force ID: 110328.

cpe:/a:ibm:security_guardium:9.0 cpe:/a:ibm:security_guardium:9.1 cpe:/a:ibm:security_guardium:9.5 cpe:/a:ibm:security_guardium:10.0 cpe:/a:ibm:security_guardium:10.1 cpe:/a:ibm:security_guardium:10.1.2

CVE-2016-0238

2017-07-05T09:29:00.207-04:00

2017-07-11T13:07:41.700-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-07-10T10:28:57.777-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21989124 BID 99379 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/110409 IBM Security Guardium 9.0, 9.1, 9.5, 10.0, and 10.1 transmits sensitive data in cleartext in the query of the request. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 110409

cpe:/a:ibm:security_guardium_database_activity_monitor:9.0 cpe:/a:ibm:security_guardium_database_activity_monitor:9.1 cpe:/a:ibm:security_guardium_database_activity_monitor:9.5 cpe:/a:ibm:security_guardium_database_activity_monitor:10.0 cpe:/a:ibm:security_guardium_database_activity_monitor:10.0.1

CVE-2016-0239

2016-10-21T23:59:00.203-04:00

2016-11-28T14:52:41.193-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 93827 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21988999 IBM Security Guardium Database Activity Monitor 9.x through 9.5 before p700 and 10.x through 10.0.1 before p100 allows remote authenticated users to make HTTP requests with administrator privileges via unspecified vectors.

CVE-2016-0240

2016-10-21T23:59:01.813-04:00

2016-11-28T14:52:42.300-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93836 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990232 IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.

CVE-2016-0241

2016-10-21T23:59:03.580-04:00

2016-11-28T14:52:43.363-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 93828 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990219 IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated users to spoof administrator accounts by sending a modified login request over HTTP.

cpe:/a:ibm:security_guardium:10.0 cpe:/a:ibm:security_guardium:10.01

CVE-2016-0242

2016-10-21T23:59:04.987-04:00

2017-04-07T19:59:37.877-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2017-04-07T16:48:59.240-04:00

BID 93825 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990229 IBM Security Guardium 10.x through 10.1 before p100 allows remote authenticated users to obtain sensitive information by reading an Application Error message.

cpe:/a:ibm:websphere_portal:6.1.0.0 cpe:/a:ibm:websphere_portal:6.1.0.1 cpe:/a:ibm:websphere_portal:6.1.0.2 cpe:/a:ibm:websphere_portal:6.1.0.3 cpe:/a:ibm:websphere_portal:6.1.0.4 cpe:/a:ibm:websphere_portal:6.1.0.5 cpe:/a:ibm:websphere_portal:6.1.0.6 cpe:/a:ibm:websphere_portal:6.1.5.0 cpe:/a:ibm:websphere_portal:6.1.5.1 cpe:/a:ibm:websphere_portal:6.1.5.2 cpe:/a:ibm:websphere_portal:6.1.5.3 cpe:/a:ibm:websphere_portal:7.0.0.0 cpe:/a:ibm:websphere_portal:7.0.0.1 cpe:/a:ibm:websphere_portal:7.0.0.2 cpe:/a:ibm:websphere_portal:8.0.0.0 cpe:/a:ibm:websphere_portal:8.0.0.1 cpe:/a:ibm:websphere_portal:8.5.0.0

CVE-2016-0243

2016-02-29T06:59:08.983-05:00

2017-09-02T21:29:02.797-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 100572 BID 83488 AIXAPAR PI54088 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0244.

CVE-2016-0244

2016-02-29T06:59:09.873-05:00

2016-03-03T11:43:15.020-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-02T16:36:32.527-05:00

AIXAPAR PI55327 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0243.

cpe:/a:ibm:websphere_portal:8.0.0.0 cpe:/a:ibm:websphere_portal:8.0.0.1 cpe:/a:ibm:websphere_portal:8.5.0.0

CVE-2016-0245

2016-02-29T06:59:10.767-05:00

2017-02-19T01:15:34.447-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2016-09-14T10:55:09.453-04:00

AIXAPAR PI56682 The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:ibm:security_guardium:8.2 cpe:/a:ibm:security_guardium:9.0 cpe:/a:ibm:security_guardium:9.1 cpe:/a:ibm:security_guardium:9.5 cpe:/a:ibm:security_guardium:10.0 cpe:/a:ibm:security_guardium:10.1

CVE-2016-0246

2016-10-21T23:59:06.487-04:00

2016-11-28T14:52:46.693-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93400 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990377 Cross-site scripting (XSS) vulnerability in IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:security_guardium:8.2 cpe:/a:ibm:security_guardium:9.0 cpe:/a:ibm:security_guardium:9.1 cpe:/a:ibm:security_guardium:9.5 cpe:/a:ibm:security_guardium:10.0 cpe:/a:ibm:security_guardium:10.1

CVE-2016-0247

2016-10-21T23:59:07.690-04:00

2016-11-28T14:52:47.740-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93341 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990368 IBM Security Guardium 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain sensitive cleartext information via unspecified vectors, as demonstrated by password information.

cpe:/a:ibm:security_guardium:9.0 cpe:/a:ibm:security_guardium:10.0

CVE-2016-0248

2016-09-26T00:59:00.210-04:00

2016-11-28T14:52:48.707-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93137 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982031 IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors.

cpe:/a:ibm:security_guardium:8.2 cpe:/a:ibm:security_guardium:9.0 cpe:/a:ibm:security_guardium:9.1 cpe:/a:ibm:security_guardium:9.5 cpe:/a:ibm:security_guardium:10.0 cpe:/a:ibm:security_guardium:10.0.1 cpe:/a:ibm:security_guardium:10.1.0

CVE-2016-0249

2016-10-16T17:59:05.363-04:00

2016-11-28T14:52:49.757-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 93339 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990363 SQL injection vulnerability in IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

cpe:/a:ibm:infosphere_information_server:11.3 cpe:/a:ibm:infosphere_information_server:11.3.1 cpe:/a:ibm:infosphere_information_server:11.5

CVE-2016-0250

2018-03-12T17:29:00.390-04:00

2018-04-09T13:09:09.310-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2018-04-09T10:14:44.580-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977152 XF ibm-infosphere-cve20160250-info-disc(110510) XML external entity (XXE) vulnerability in IBM InfoSphere Information Governance Catalog 11.3 before 11.3.1.2 and 11.5 before 11.5.0.1 allows remote authenticated users to read arbitrary files or cause a denial of service via crafted XML data. IBM X-Force ID: 110510.

cpe:/a:ibm:control_center:6.0.0.0 cpe:/a:ibm:sterling_control_center:5.4.0.0 cpe:/a:ibm:sterling_control_center:5.4.0.1 cpe:/a:ibm:sterling_control_center:5.4.1 cpe:/a:ibm:sterling_control_center:5.4.1.0 cpe:/a:ibm:sterling_control_center:5.4.2 cpe:/a:ibm:sterling_control_center:5.4.2.0

CVE-2016-0252

2016-07-07T21:59:01.663-04:00

2016-07-08T11:31:26.407-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-08T10:05:29.567-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985641 IBM Control Center 6.x before 6.0.0.1 iFix06 and Sterling Control Center 5.4.x before 5.4.2.1 iFix09 allow local users to decrypt the master key via unspecified vectors.

cpe:/a:ibm:financial_transaction_manager:2.1.1.2::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:2.1.1.2::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:2.1.1.2::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.0::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.1::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.2::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.3::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.4::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.5::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.6::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.7::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.8::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.9::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.10::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.11::~~~cps_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.12::~~~ach_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.12::~~~check_services~~ cpe:/a:ibm:financial_transaction_manager:3.0.0.12::~~~cps_services~~

CVE-2016-0253

2018-03-09T14:29:00.257-05:00

2018-03-26T14:12:27.467-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-26T13:54:50.143-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 XF ibm-ftm-cve20160253-xss(110562) Cross-site scripting (XSS) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110562.

CVE-2016-0254

2017-06-07T13:29:00.210-04:00

2017-06-14T10:06:24.297-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2017-06-14T09:26:41.867-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22004036 BID 98971 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/110563 IBM Cognos Business Intelligence 10.1 and 10.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote authenticated attacker could exploit this vulnerability to consume all available CPU resources and cause a denial of service. IBM X-Force ID: 110563.

cpe:/a:ibm:marketing_platform:9.1 cpe:/a:ibm:marketing_platform:9.1.1 cpe:/a:ibm:marketing_platform:9.1.2 cpe:/a:ibm:marketing_platform:10.0

CVE-2016-0255

2017-05-05T15:29:00.170-04:00

2017-05-12T13:12:55.130-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-05-12T12:59:18.747-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22001950 BID 98336 IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 110564.

cpe:/a:ibm:websphere_mq:8.0.0.1 cpe:/a:ibm:websphere_mq:8.0.0.2 cpe:/a:ibm:websphere_mq:8.0.0.3 cpe:/a:ibm:websphere_mq:8.0.0.4

CVE-2016-0259

2016-06-26T10:59:01.277-04:00

2016-11-29T22:02:48.853-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1036179 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984561 runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.

cpe:/a:ibm:websphere_mq:8.0 cpe:/a:ibm:websphere_mq:8.0.0.1 cpe:/a:ibm:websphere_mq:8.0.0.2 cpe:/a:ibm:websphere_mq:8.0.0.3 cpe:/a:ibm:websphere_mq:8.0.0.4

CVE-2016-0260

2016-06-28T21:59:02.587-04:00

2016-06-30T11:44:37.807-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-29T17:01:42.797-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984564 Memory leak in queue-manager agents in IBM WebSphere MQ 8.x before 8.0.0.5 allows remote attackers to cause a denial of service (heap memory consumption) by triggering many errors.

cpe:/a:ibm:care_management:6.0 cpe:/a:ibm:curam_social_program_management:6.0:sp1 cpe:/a:ibm:curam_social_program_management:6.0:sp2 cpe:/a:ibm:curam_social_program_management:6.0.0 cpe:/a:ibm:curam_social_program_management:6.0.4.0 cpe:/a:ibm:curam_social_program_management:6.0.4.1 cpe:/a:ibm:curam_social_program_management:6.0.4.2 cpe:/a:ibm:curam_social_program_management:6.0.4.3 cpe:/a:ibm:curam_social_program_management:6.0.4.4 cpe:/a:ibm:curam_social_program_management:6.0.4.5 cpe:/a:ibm:curam_social_program_management:6.0.4.6 cpe:/a:ibm:curam_social_program_management:6.0.5.0 cpe:/a:ibm:curam_social_program_management:6.0.5.1 cpe:/a:ibm:curam_social_program_management:6.0.5.2 cpe:/a:ibm:curam_social_program_management:6.0.5.3 cpe:/a:ibm:curam_social_program_management:6.0.5.4 cpe:/a:ibm:curam_social_program_management:6.0.5.5 cpe:/a:ibm:curam_social_program_management:6.0.5.6 cpe:/a:ibm:curam_social_program_management:6.0.5.7 cpe:/a:ibm:curam_social_program_management:6.0.5.8 cpe:/a:ibm:curam_social_program_management:6.0.5.9 cpe:/a:ibm:curam_social_program_management:6.1.0.0 cpe:/a:ibm:curam_social_program_management:6.1.0.1 cpe:/a:ibm:curam_social_program_management:6.1.1.0 cpe:/a:ibm:curam_social_program_management:6.1.1.1

CVE-2016-0261

2018-03-12T17:29:00.453-04:00

2018-04-09T10:57:11.277-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-09T09:58:02.730-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981103 XF ibm-curam-cve20160261-xss(110604) Cross-site scripting (XSS) vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 110604.

cpe:/a:ibm:maximo_asset_management:7.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.2 cpe:/a:ibm:maximo_asset_management:7.1.1.3 cpe:/a:ibm:maximo_asset_management:7.5.0.0 cpe:/a:ibm:maximo_asset_management:7.5.0.1 cpe:/a:ibm:maximo_asset_management:7.5.0.2 cpe:/a:ibm:maximo_asset_management:7.5.0.3 cpe:/a:ibm:maximo_asset_management:7.5.0.4 cpe:/a:ibm:maximo_asset_management:7.5.0.5 cpe:/a:ibm:maximo_asset_management:7.5.0.6 cpe:/a:ibm:maximo_asset_management:7.5.0.7 cpe:/a:ibm:maximo_asset_management:7.5.0.8 cpe:/a:ibm:maximo_asset_management:7.5.0.9 cpe:/a:ibm:maximo_asset_management:7.6.0.0 cpe:/a:ibm:maximo_asset_management:7.6.0.1 cpe:/a:ibm:maximo_asset_management:7.6.0.2 cpe:/a:ibm:maximo_asset_management:7.6.0.3

CVE-2016-0262

2016-03-13T21:59:02.590-04:00

2016-03-16T09:04:55.080-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-15T10:53:30.707-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977828 Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1.1 through 7.1.1.3, 7.5.0 before 7.5.0.9 IFIX004, and 7.6.0 before 7.6.0.3 IFIX001 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.1 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.2 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.3 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.4 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.5 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.6 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.7 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.8 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.9 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.10 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.11 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.12 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.13 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.14 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.15 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.16 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.17 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.18 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.19 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.20 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.21 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.22 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.23 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.24 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.25 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.26 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.27 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.28 cpe:/a:ibm:general_parallel_file_system_storage_server:3.5.0.29 cpe:/a:ibm:spectrum_scale:4.1.1.1 cpe:/a:ibm:spectrum_scale:4.1.1.2 cpe:/a:ibm:spectrum_scale:4.1.1.3 cpe:/a:ibm:spectrum_scale:4.1.1.4 cpe:/a:ibm:spectrum_scale:4.2.0.0 cpe:/a:ibm:spectrum_scale:4.2.0.1

CVE-2016-0263

2016-06-28T21:59:03.743-04:00

2017-08-31T21:29:01.477-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 90525 SECTRACK 1036458 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005708 IBM Spectrum Scale 4.1 before 4.1.1.5 and 4.2 before 4.2.0.2 and General Parallel File System 3.5 before 3.5.0.30 allow local users to gain privileges or cause a denial of service via a crafted mmapplypolicy command.

cpe:/a:ibm:java_sdk:6.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.11.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.12.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.14.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.3::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.20::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.2::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.8.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.31::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.2.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.31::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.1.10::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.11::~~technology~~~ cpe:/a:redhat:satellite:5.6 cpe:/a:redhat:satellite:5.7 cpe:/a:suse:manager:2.1 cpe:/a:suse:manager_proxy:2.1 cpe:/a:suse:openstack:5.0 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:7.0 cpe:/o:redhat:enterprise_linux_server:5.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_eus:6.7 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.3 cpe:/o:redhat:enterprise_linux_server_eus:7.4 cpe:/o:redhat:enterprise_linux_server_eus:7.5 cpe:/o:redhat:enterprise_linux_workstation:5.0 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0 cpe:/o:suse:linux_enterprise_server:10:sp4:~~ltss~~~ cpe:/o:suse:linux_enterprise_server:11:sp2:~~ltss~~~ cpe:/o:suse:linux_enterprise_server:11:sp3:~~ltss~~~ cpe:/o:suse:linux_enterprise_server:11:sp4 cpe:/o:suse:linux_enterprise_server:12:sp1 cpe:/o:suse:linux_enterprise_software_development_kit:11:sp4 cpe:/o:suse:linux_enterprise_software_development_kit:12 cpe:/o:suse:linux_enterprise_software_development_kit:12:sp1 cpe:/o:suse:suse_linux_enterprise_server:12

CVE-2016-0264

2016-05-24T11:59:00.117-04:00

2019-06-24T10:07:03.200-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-06-24T08:19:00.383-04:00

cpe:/a:ibm:campaign:8.6 cpe:/a:ibm:campaign:9.1 cpe:/a:ibm:campaign:9.1.1 cpe:/a:ibm:campaign:9.1.2

CVE-2016-0265

2017-02-01T15:59:00.130-05:00

2017-02-05T15:29:44.490-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-03T15:42:43.473-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21986033 BID 95100 IBM Campaign is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

cpe:/o:ibm:aix:5.3 cpe:/o:ibm:aix:6.1 cpe:/o:ibm:aix:7.1 cpe:/o:ibm:aix:7.2 cpe:/o:ibm:vios:2.2.0.10 cpe:/o:ibm:vios:2.2.0.11 cpe:/o:ibm:vios:2.2.0.12 cpe:/o:ibm:vios:2.2.0.13 cpe:/o:ibm:vios:2.2.1.0 cpe:/o:ibm:vios:2.2.1.1 cpe:/o:ibm:vios:2.2.1.3 cpe:/o:ibm:vios:2.2.1.4 cpe:/o:ibm:vios:2.2.1.5 cpe:/o:ibm:vios:2.2.1.6 cpe:/o:ibm:vios:2.2.1.7 cpe:/o:ibm:vios:2.2.1.8 cpe:/o:ibm:vios:2.2.1.9 cpe:/o:ibm:vios:2.2.2.0 cpe:/o:ibm:vios:2.2.2.1 cpe:/o:ibm:vios:2.2.2.2 cpe:/o:ibm:vios:2.2.2.3 cpe:/o:ibm:vios:2.2.2.4 cpe:/o:ibm:vios:2.2.2.5 cpe:/o:ibm:vios:2.2.3.0 cpe:/o:ibm:vios:2.2.3.1 cpe:/o:ibm:vios:2.2.3.2 cpe:/o:ibm:vios:2.2.3.3 cpe:/o:ibm:vios:2.2.3.4 cpe:/o:ibm:vios:2.2.3.50 cpe:/o:ibm:vios:2.2.3.51 cpe:/o:ibm:vios:2.2.3.52 cpe:/o:ibm:vios:2.2.3.60 cpe:/o:ibm:vios:2.2.3.70 cpe:/o:ibm:vios:2.2.4.0 cpe:/o:ibm:vios:2.2.4.10 cpe:/o:ibm:vios:2.2.4.21 cpe:/o:ibm:vios:2.2.4.22

CVE-2016-0266

2016-08-07T21:59:00.130-04:00

2017-08-31T21:29:01.537-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92150 SECTRACK 1036467 AIXAPAR IV86116 AIXAPAR IV86117 AIXAPAR IV86118 AIXAPAR IV86119 AIXAPAR IV86120 AIXAPAR IV86132 CONFIRM https://aix.software.ibm.com/aix/efixes/security/nettcp_advisory2.asc IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

CVE-2016-0267

2016-06-28T21:59:04.887-04:00

2016-06-29T13:29:28.553-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-29T13:08:51.480-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000151 IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 allows remote authenticated users to obtain sensitive cleartext secure-property information via (1) the server UI or (2) a database request.

CVE-2016-0268

2018-03-09T14:29:00.337-05:00

2018-03-26T14:09:23.323-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-26T14:02:55.187-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 XML external entity (XXE) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 110915.

cpe:/a:ibm:bigfix_platform:9.0.5 cpe:/a:ibm:bigfix_platform:9.0.6 cpe:/a:ibm:bigfix_platform:9.0.7 cpe:/a:ibm:bigfix_platform:9.0.8 cpe:/a:ibm:bigfix_platform:9.1.3 cpe:/a:ibm:bigfix_platform:9.1.4 cpe:/a:ibm:bigfix_platform:9.1.5 cpe:/a:ibm:bigfix_platform:9.1.6 cpe:/a:ibm:bigfix_platform:9.1.7 cpe:/a:ibm:bigfix_platform:9.2.0 cpe:/a:ibm:bigfix_platform:9.2.1 cpe:/a:ibm:bigfix_platform:9.2.2 cpe:/a:ibm:bigfix_platform:9.2.3 cpe:/a:ibm:bigfix_platform:9.2.4 cpe:/a:ibm:bigfix_platform:9.2.5 cpe:/a:ibm:bigfix_platform:9.2.6

CVE-2016-0269

2016-07-15T14:59:01.140-04:00

2016-11-28T14:52:54.460-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91690 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985734 Cross-site scripting (XSS) vulnerability in IBM BigFix Platform 9.x before 9.1.8 and 9.2.x before 9.2.7 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:client_application_access:1.0.0.1 cpe:/a:ibm:domino:9.0.1.3 cpe:/a:ibm:domino:9.0.1.4 cpe:/a:ibm:domino:9.0.1.5 cpe:/a:ibm:notes:9.0.1.3 cpe:/a:ibm:notes:9.0.1.4 cpe:/a:ibm:notes:9.0.1.5

CVE-2016-0270

2017-02-08T11:59:00.133-05:00

2017-11-14T21:29:08.220-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 96062 SECTRACK 1037795 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979604 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979669 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979673 MISC https://github.com/nonce-disrespect/nonce-disrespect CONFIRM https://support.citrix.com/article/CTX220329 IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.

cpe:/a:ibm:urbancode_deploy:6.0 cpe:/a:ibm:urbancode_deploy:6.0.1.0 cpe:/a:ibm:urbancode_deploy:6.0.1.1 cpe:/a:ibm:urbancode_deploy:6.0.1.2 cpe:/a:ibm:urbancode_deploy:6.0.1.3 cpe:/a:ibm:urbancode_deploy:6.0.1.4 cpe:/a:ibm:urbancode_deploy:6.0.1.5 cpe:/a:ibm:urbancode_deploy:6.0.1.6 cpe:/a:ibm:urbancode_deploy:6.0.1.7 cpe:/a:ibm:urbancode_deploy:6.0.1.8 cpe:/a:ibm:urbancode_deploy:6.0.1.9 cpe:/a:ibm:urbancode_deploy:6.0.1.10 cpe:/a:ibm:urbancode_deploy:6.0.1.11 cpe:/a:ibm:urbancode_deploy:6.0.1.12 cpe:/a:ibm:urbancode_deploy:6.0.1.13 cpe:/a:ibm:urbancode_deploy:6.1 cpe:/a:ibm:urbancode_deploy:6.1.0.1 cpe:/a:ibm:urbancode_deploy:6.1.0.2 cpe:/a:ibm:urbancode_deploy:6.1.0.3 cpe:/a:ibm:urbancode_deploy:6.1.0.4 cpe:/a:ibm:urbancode_deploy:6.1.1.0 cpe:/a:ibm:urbancode_deploy:6.1.1.1 cpe:/a:ibm:urbancode_deploy:6.1.1.2 cpe:/a:ibm:urbancode_deploy:6.1.1.3 cpe:/a:ibm:urbancode_deploy:6.1.1.4 cpe:/a:ibm:urbancode_deploy:6.1.1.5 cpe:/a:ibm:urbancode_deploy:6.1.1.6 cpe:/a:ibm:urbancode_deploy:6.1.1.7 cpe:/a:ibm:urbancode_deploy:6.1.1.8 cpe:/a:ibm:urbancode_deploy:6.1.2 cpe:/a:ibm:urbancode_deploy:6.1.3 cpe:/a:ibm:urbancode_deploy:6.1.3.1 cpe:/a:ibm:urbancode_deploy:6.1.3.2 cpe:/a:ibm:urbancode_deploy:6.2.0.0 cpe:/a:ibm:urbancode_deploy:6.2.0.1 cpe:/a:ibm:urbancode_deploy:6.2.0.2 cpe:/a:ibm:urbancode_deploy:6.2.1

CVE-2016-0271

2016-07-07T21:59:02.930-04:00

2016-07-08T11:33:16.313-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-07-08T10:40:19.830-04:00

ALLOWS_ADMIN_ACCESS

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000150 The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors.

CVE-2016-0272

2018-03-09T14:29:00.383-05:00

2018-03-26T14:10:48.997-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-03-26T13:46:23.217-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 XF ibm-ftm-cve20160272-csrf(111052) Cross-site request forgery (CSRF) vulnerability in IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to hijack the authentication of arbitrary users via unspecified vectors. IBM X-Force ID: 111052.

cpe:/a:ibm:rational_collaborative_lifecycle_management:3.0.1.6 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.2 cpe:/a:ibm:rational_doors_next_generation:4.0.0 cpe:/a:ibm:rational_doors_next_generation:4.0.1 cpe:/a:ibm:rational_doors_next_generation:4.0.2 cpe:/a:ibm:rational_doors_next_generation:4.0.3 cpe:/a:ibm:rational_doors_next_generation:4.0.4 cpe:/a:ibm:rational_doors_next_generation:4.0.5 cpe:/a:ibm:rational_doors_next_generation:4.0.6 cpe:/a:ibm:rational_doors_next_generation:4.0.7 cpe:/a:ibm:rational_doors_next_generation:5.0.0 cpe:/a:ibm:rational_doors_next_generation:5.0.1 cpe:/a:ibm:rational_doors_next_generation:5.0.2 cpe:/a:ibm:rational_doors_next_generation:6.0.0 cpe:/a:ibm:rational_doors_next_generation:6.0.1 cpe:/a:ibm:rational_doors_next_generation:6.0.2 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.0 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.1 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.2 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.3 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.4 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.5 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.6 cpe:/a:ibm:rational_engineering_lifecycle_manager:4.0.7 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0.0 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0.1 cpe:/a:ibm:rational_engineering_lifecycle_manager:5.0.2 cpe:/a:ibm:rational_engineering_lifecycle_manager:6.0.0 cpe:/a:ibm:rational_engineering_lifecycle_manager:6.0.1 cpe:/a:ibm:rational_engineering_lifecycle_manager:6.0.2 cpe:/a:ibm:rational_quality_manager:3.0.1.6 cpe:/a:ibm:rational_quality_manager:4.0.0 cpe:/a:ibm:rational_quality_manager:4.0.1 cpe:/a:ibm:rational_quality_manager:4.0.2 cpe:/a:ibm:rational_quality_manager:4.0.3 cpe:/a:ibm:rational_quality_manager:4.0.4 cpe:/a:ibm:rational_quality_manager:4.0.5 cpe:/a:ibm:rational_quality_manager:4.0.6 cpe:/a:ibm:rational_quality_manager:4.0.7 cpe:/a:ibm:rational_quality_manager:5.0.0 cpe:/a:ibm:rational_quality_manager:5.0.1 cpe:/a:ibm:rational_quality_manager:5.0.2 cpe:/a:ibm:rational_quality_manager:6.0.0 cpe:/a:ibm:rational_quality_manager:6.0.1 cpe:/a:ibm:rational_quality_manager:6.0.2 cpe:/a:ibm:rational_rhapsody_design_manager:4.0 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.1 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.2 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.3 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.4 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.5 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.6 cpe:/a:ibm:rational_rhapsody_design_manager:4.0.7 cpe:/a:ibm:rational_rhapsody_design_manager:5.0.0 cpe:/a:ibm:rational_rhapsody_design_manager:5.0.1 cpe:/a:ibm:rational_rhapsody_design_manager:5.0.2 cpe:/a:ibm:rational_rhapsody_design_manager:6.0.0 cpe:/a:ibm:rational_rhapsody_design_manager:6.0.1 cpe:/a:ibm:rational_rhapsody_design_manager:6.0.2 cpe:/a:ibm:rational_software_architect_design_manager:4.0.0 cpe:/a:ibm:rational_software_architect_design_manager:4.0.1 cpe:/a:ibm:rational_software_architect_design_manager:4.0.2 cpe:/a:ibm:rational_software_architect_design_manager:4.0.3 cpe:/a:ibm:rational_software_architect_design_manager:4.0.4 cpe:/a:ibm:rational_software_architect_design_manager:4.0.5 cpe:/a:ibm:rational_software_architect_design_manager:4.0.6 cpe:/a:ibm:rational_software_architect_design_manager:4.0.7 cpe:/a:ibm:rational_software_architect_design_manager:5.0.0 cpe:/a:ibm:rational_software_architect_design_manager:5.0.1 cpe:/a:ibm:rational_software_architect_design_manager:5.0.2 cpe:/a:ibm:rational_software_architect_design_manager:6.0.0 cpe:/a:ibm:rational_software_architect_design_manager:6.0.1 cpe:/a:ibm:rational_software_architect_design_manager:6.0.2 cpe:/a:ibm:rational_team_concert:3.0.1.6 cpe:/a:ibm:rational_team_concert:4.0.0 cpe:/a:ibm:rational_team_concert:4.0.1 cpe:/a:ibm:rational_team_concert:4.0.2 cpe:/a:ibm:rational_team_concert:4.0.3 cpe:/a:ibm:rational_team_concert:4.0.4 cpe:/a:ibm:rational_team_concert:4.0.5 cpe:/a:ibm:rational_team_concert:4.0.6 cpe:/a:ibm:rational_team_concert:4.0.7 cpe:/a:ibm:rational_team_concert:5.0.0 cpe:/a:ibm:rational_team_concert:5.0.1 cpe:/a:ibm:rational_team_concert:5.0.2 cpe:/a:ibm:rational_team_concert:6.0.0 cpe:/a:ibm:rational_team_concert:6.0.1 cpe:/a:ibm:rational_team_concert:6.0.2

CVE-2016-0273

2016-11-24T14:59:02.207-05:00

2016-11-29T22:02:50.977-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 94557 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991478 Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2016-0274

2018-03-09T14:29:00.447-05:00

2018-03-26T13:45:30.463-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-26T13:29:01.800-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 XF ibm-ftm-cve20160274-clickjacking(111076) IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to conduct clickjacking attacks via a crafted web site. IBM X-Force ID: 111076.

CVE-2016-0275

2018-03-09T14:29:00.490-05:00

2018-03-27T12:41:58.233-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-26T13:48:05.707-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows local users to obtain sensitive information via vectors related to cacheable HTTPS responses.

CVE-2016-0276

2018-03-09T14:29:00.740-05:00

2018-03-26T13:32:29.873-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-03-26T12:49:35.343-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977245 XF ibm-ftm-cve20160276-code-exec(111084) IBM Financial Transaction Manager (FTM) for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager (FTM) for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager (FTM) for Corporate Payment Services (CPS) for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013 allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object. IBM X-Force ID: 111084.

cpe:/a:ibm:domino:8.5.0 cpe:/a:ibm:domino:8.5.1 cpe:/a:ibm:domino:8.5.1.1 cpe:/a:ibm:domino:8.5.1.2 cpe:/a:ibm:domino:8.5.1.3 cpe:/a:ibm:domino:8.5.1.4 cpe:/a:ibm:domino:8.5.2 cpe:/a:ibm:domino:8.5.2.1 cpe:/a:ibm:domino:8.5.2.2 cpe:/a:ibm:domino:8.5.2.3 cpe:/a:ibm:domino:8.5.3 cpe:/a:ibm:domino:8.5.3.1 cpe:/a:ibm:domino:8.5.3.2 cpe:/a:ibm:domino:8.5.3.3 cpe:/a:ibm:domino:8.5.3.4 cpe:/a:ibm:domino:8.5.3.5 cpe:/a:ibm:domino:9.0.0 cpe:/a:ibm:domino:9.0.1 cpe:/a:ibm:domino:9.0.1.1 cpe:/a:ibm:domino:9.0.1.2 cpe:/a:ibm:domino:9.0.1.3 cpe:/a:ibm:domino:9.0.1.4 cpe:/a:ibm:domino:9.0.1.5

CVE-2016-0277

2016-06-26T10:59:02.373-04:00

2016-07-28T16:09:19.710-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-07-28T15:09:03.413-04:00

SECTRACK 1036091 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983292 Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0278, CVE-2016-0279, and CVE-2016-0301.

CVE-2016-0278

2016-06-26T10:59:03.437-04:00

2017-11-14T21:29:08.297-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1036091 MISC http://www.talosintelligence.com/reports/TALOS-2016-0090/ CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983292 Heap-based buffer overflow in the KeyView PDF filter in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 allows remote attackers to execute arbitrary code via a crafted PDF document, a different vulnerability than CVE-2016-0277, CVE-2016-0279, and CVE-2016-0301.

CVE-2016-0279

2016-06-26T10:59:04.437-04:00

2016-07-28T16:10:31.397-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-07-28T15:09:37.297-04:00

cpe:/a:ibm:information_server_framework:8.5 cpe:/a:ibm:information_server_framework:8.7 cpe:/a:ibm:information_server_framework:9.1 cpe:/a:ibm:information_server_framework:11.3 cpe:/a:ibm:information_server_framework:11.5 cpe:/a:ibm:infosphere_information_governance_catalog:11.3 cpe:/a:ibm:infosphere_information_governance_catalog:11.5 cpe:/a:ibm:infosphere_information_server_business_glossary:8.7 cpe:/a:ibm:infosphere_information_server_business_glossary:9.1

CVE-2016-0280

2016-08-07T21:59:01.133-04:00

2017-08-31T21:29:01.600-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92133 SECTRACK 1036418 AIXAPAR JR55452 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981766 Cross-site scripting (XSS) vulnerability in IBM Information Server Framework 8.5, Information Server Framework and InfoSphere Information Server Business Glossary 8.7 before FP2, Information Server Framework and InfoSphere Information Server Business Glossary 9.1 before 9.1.2.0, Information Server Framework and InfoSphere Information Governance Catalog 11.3 before 11.3.1.2, and Information Server Framework and InfoSphere Information Governance Catalog 11.5 before 11.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:vios:2.2.0.10 cpe:/a:ibm:vios:2.2.0.11 cpe:/a:ibm:vios:2.2.0.12 cpe:/a:ibm:vios:2.2.0.13 cpe:/a:ibm:vios:2.2.1.0 cpe:/a:ibm:vios:2.2.1.1 cpe:/a:ibm:vios:2.2.1.3 cpe:/o:ibm:aix:5.3 cpe:/o:ibm:aix:6.1 cpe:/o:ibm:aix:7.1 cpe:/o:ibm:aix:7.2 cpe:/o:ibm:vios:2.2.0.10 cpe:/o:ibm:vios:2.2.0.11 cpe:/o:ibm:vios:2.2.0.12 cpe:/o:ibm:vios:2.2.0.13 cpe:/o:ibm:vios:2.2.1.0 cpe:/o:ibm:vios:2.2.1.1 cpe:/o:ibm:vios:2.2.1.3 cpe:/o:ibm:vios:2.2.1.4 cpe:/o:ibm:vios:2.2.1.5 cpe:/o:ibm:vios:2.2.1.6 cpe:/o:ibm:vios:2.2.1.7 cpe:/o:ibm:vios:2.2.1.8 cpe:/o:ibm:vios:2.2.1.9 cpe:/o:ibm:vios:2.2.2.0 cpe:/o:ibm:vios:2.2.2.1 cpe:/o:ibm:vios:2.2.2.2 cpe:/o:ibm:vios:2.2.2.3 cpe:/o:ibm:vios:2.2.2.4 cpe:/o:ibm:vios:2.2.2.5 cpe:/o:ibm:vios:2.2.3.0 cpe:/o:ibm:vios:2.2.3.1 cpe:/o:ibm:vios:2.2.3.2 cpe:/o:ibm:vios:2.2.3.3 cpe:/o:ibm:vios:2.2.3.4

CVE-2016-0281

2016-08-07T21:59:02.367-04:00

2017-08-31T21:29:01.663-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://aix.software.ibm.com/aix/efixes/security/mustendd_advisory.asc BID 92193 SECTRACK 1036481 AIXAPAR IV80569 AIXAPAR IV81357 AIXAPAR IV81459 AIXAPAR IV82421 AIXAPAR IV84184 The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or FC5899 adapter crash) via crafted packets.

cpe:/a:ibm:lotus_inotes:8.5.0.0 cpe:/a:ibm:lotus_inotes:8.5.0.1 cpe:/a:ibm:lotus_inotes:8.5.1.0 cpe:/a:ibm:lotus_inotes:8.5.1.1 cpe:/a:ibm:lotus_inotes:8.5.1.2 cpe:/a:ibm:lotus_inotes:8.5.1.3 cpe:/a:ibm:lotus_inotes:8.5.1.4 cpe:/a:ibm:lotus_inotes:8.5.1.5 cpe:/a:ibm:lotus_inotes:8.5.2.0 cpe:/a:ibm:lotus_inotes:8.5.2.1 cpe:/a:ibm:lotus_inotes:8.5.2.2 cpe:/a:ibm:lotus_inotes:8.5.2.3 cpe:/a:ibm:lotus_inotes:8.5.2.4 cpe:/a:ibm:lotus_inotes:8.5.3.0 cpe:/a:ibm:lotus_inotes:8.5.3.1 cpe:/a:ibm:lotus_inotes:8.5.3.2 cpe:/a:ibm:lotus_inotes:8.5.3.3 cpe:/a:ibm:lotus_inotes:8.5.3.4 cpe:/a:ibm:lotus_inotes:8.5.3.5 cpe:/a:ibm:lotus_inotes:8.5.3.6

CVE-2016-0282

2016-11-24T14:59:03.707-05:00

2017-07-27T21:29:00.360-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 94558 SECTRACK 1037383 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991722 Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 FP6 IF2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYHAAHNUS.

cpe:/a:ibm:websphere_application_server:8.5.5.0::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.1::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.2::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.3::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.4::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.5::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.6::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.7::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.8::~~liberty~~~

CVE-2016-0283

2016-03-19T11:59:00.127-04:00

2016-12-02T22:16:16.770-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035330 AIXAPAR PI58003 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21978293 Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2016-0284

2016-11-24T14:59:04.753-05:00

2016-11-29T22:02:53.133-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov BID 94555 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991478 The XML parser in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:ibm:rational_team_concert:3.0.1.6 cpe:/a:ibm:rational_team_concert:4.0.0 cpe:/a:ibm:rational_team_concert:4.0.1 cpe:/a:ibm:rational_team_concert:4.0.2 cpe:/a:ibm:rational_team_concert:4.0.3 cpe:/a:ibm:rational_team_concert:4.0.4 cpe:/a:ibm:rational_team_concert:4.0.5 cpe:/a:ibm:rational_team_concert:4.0.6 cpe:/a:ibm:rational_team_concert:4.0.7 cpe:/a:ibm:rational_team_concert:5.0.0 cpe:/a:ibm:rational_team_concert:5.0.1 cpe:/a:ibm:rational_team_concert:5.0.2 cpe:/a:ibm:rational_team_concert:6.0.0 cpe:/a:ibm:rational_team_concert:6.0.1 cpe:/a:ibm:rational_team_concert:6.0.2

CVE-2016-0285

2016-11-24T14:59:05.927-05:00

2016-11-29T22:02:54.277-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 94550 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991478 Cross-site scripting (XSS) vulnerability in IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted field.

cpe:/a:ibm:tivoli_business_service_manager:6.1.0 cpe:/a:ibm:tivoli_business_service_manager:6.1.1

CVE-2016-0286

2018-03-09T14:29:00.803-05:00

2018-03-26T13:31:37.397-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-26T12:29:47.507-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21986852 XF ibm-tivoli-cve20160286-info-disc(111234) IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote authenticated users to obtain administrator passwords by leveraging unspecified privileges. BM X-Force ID: 111234.

cpe:/a:ibm:i_access:7.1

CVE-2016-0287

2016-07-07T21:59:03.947-04:00

2017-11-02T21:29:01.200-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91706 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=nas8N1021418 AIXAPAR SI60523 MISC https://www.tenable.com/security/research/tra-2016-18 IBM i Access 7.1 on Windows allows local users to discover registry passwords via unspecified vectors.

cpe:/a:ibm:security_appscan:8.7.0.0::~~standard~~~ cpe:/a:ibm:security_appscan:8.7.0.1::~~standard~~~ cpe:/a:ibm:security_appscan:8.8.0.0::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.0.0::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.0.1::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.1.0::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.1.1::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.2.0::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.2.1::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.3.0::~~standard~~~ cpe:/a:ibm:security_appscan:9.0.3.1::~~standard~~~

CVE-2016-0288

2016-06-01T11:59:00.233-04:00

2016-11-29T22:02:55.527-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1035927 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980055 IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:ibm:maximo_asset_management:7.1 cpe:/a:ibm:maximo_asset_management:7.5 cpe:/a:ibm:maximo_asset_management:7.5.0.0 cpe:/a:ibm:maximo_asset_management:7.5.0.1 cpe:/a:ibm:maximo_asset_management:7.5.0.2 cpe:/a:ibm:maximo_asset_management:7.5.0.3 cpe:/a:ibm:maximo_asset_management:7.5.0.4 cpe:/a:ibm:maximo_asset_management:7.5.0.5 cpe:/a:ibm:maximo_asset_management:7.5.0.6 cpe:/a:ibm:maximo_asset_management:7.5.0.7 cpe:/a:ibm:maximo_asset_management:7.5.0.8 cpe:/a:ibm:maximo_asset_management:7.5.0.9 cpe:/a:ibm:maximo_asset_management:7.6 cpe:/a:ibm:maximo_asset_management:7.6.0.0 cpe:/a:ibm:maximo_asset_management:7.6.0.1 cpe:/a:ibm:maximo_asset_management:7.6.0.2 cpe:/a:ibm:maximo_asset_management:7.6.0.3

CVE-2016-0289

2016-04-05T13:59:06.677-04:00

2016-04-06T08:05:16.360-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-04-05T17:49:01.070-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979519 shiprec.xml in the SHIPREC application in IBM Maximo Asset Management 7.1 and 7.5 before 7.5.0.10 and 7.6 before 7.6.0.4 allows remote authenticated users to bypass intended item-selection restrictions via unspecified vectors.

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.1.2 cpe:/a:ibm:bigfix_platform:9.1.3 cpe:/a:ibm:bigfix_platform:9.1.4 cpe:/a:ibm:bigfix_platform:9.1.5 cpe:/a:ibm:bigfix_platform:9.1.6 cpe:/a:ibm:bigfix_platform:9.1.7 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.2.0 cpe:/a:ibm:bigfix_platform:9.2.1 cpe:/a:ibm:bigfix_platform:9.2.2 cpe:/a:ibm:bigfix_platform:9.2.3 cpe:/a:ibm:bigfix_platform:9.2.4 cpe:/a:ibm:bigfix_platform:9.2.5 cpe:/a:ibm:bigfix_platform:9.2.6 cpe:/a:ibm:bigfix_platform:9.2.7

CVE-2016-0291

2018-02-28T12:29:00.470-05:00

2018-03-17T06:33:11.883-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2018-03-15T09:35:35.687-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985748 XF ibm-mdm-cve20160291-command-injection(111302) IBM BigFix Platform 9.0, 9.1 before 9.1.8, and 9.2 before 9.2.8 allow remote authenticated users to execute arbitrary commands by leveraging report server access. IBM X-Force ID: 111302.

cpe:/a:ibm:bigfix:9.0 cpe:/a:ibm:bigfix:9.1 cpe:/a:ibm:bigfix:9.2 cpe:/a:ibm:bigfix:9.5

CVE-2016-0292

2016-08-30T13:59:00.143-04:00

2017-06-09T09:40:22.480-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-08T17:34:26.497-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985907 WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows local users to discover the cleartext system password by reading a report.

CVE-2016-0293

2016-08-31T21:59:01.177-04:00

2016-11-28T14:52:58.757-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92593 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985743 Cross-site scripting (XSS) vulnerability in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.1.8 and 9.2.x before 9.2.8 allows remote attackers to inject arbitrary web script or HTML via a modified .beswrpt file.

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.5 cpe:/a:ibm:bigfix_platform:9.5.0 cpe:/a:ibm:bigfix_platform:9.5.1

CVE-2016-0295

2018-02-28T12:29:00.580-05:00

2018-03-16T13:52:22.900-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-03-15T09:06:17.457-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985830 XF ibm-mdm-cve20160295-csrf(111363) Cross-site request forgery (CSRF) vulnerability in the IBM BigFix Platform 9.0, 9.1, 9.2, and 9.5 before 9.5.2 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111363.

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.5

CVE-2016-0296

2017-02-01T15:59:00.177-05:00

2017-02-05T15:37:45.813-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-03T14:31:49.430-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21993213 BID 94213 IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.5

CVE-2016-0297

2017-02-01T15:59:00.207-05:00

2017-02-05T15:38:09.923-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-03T15:23:09.513-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21993214 BID 94188 IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) could allow a remote attacker to obtain sensitive information due to a missing HTTP Strict-Transport-Security Header through man in the middle techniques.

cpe:/a:ibm:security_guardium:10.0

CVE-2016-0298

2016-06-28T21:59:05.887-04:00

2016-06-29T12:53:11.790-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-29T12:29:23.240-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981749 Directory traversal vulnerability in IBM Security Guardium Database Activity Monitor 10 before 10.0p100 allows remote authenticated users to read arbitrary files via a crafted URL.

cpe:/a:ibm:tririga_application_platform:3.3.0.0 cpe:/a:ibm:tririga_application_platform:3.3.0.1 cpe:/a:ibm:tririga_application_platform:3.3.0.2 cpe:/a:ibm:tririga_application_platform:3.3.1.0 cpe:/a:ibm:tririga_application_platform:3.3.1.1 cpe:/a:ibm:tririga_application_platform:3.3.1.2 cpe:/a:ibm:tririga_application_platform:3.3.1.3 cpe:/a:ibm:tririga_application_platform:3.3.2.0 cpe:/a:ibm:tririga_application_platform:3.3.2.1 cpe:/a:ibm:tririga_application_platform:3.3.2.3 cpe:/a:ibm:tririga_application_platform:3.3.2.4 cpe:/a:ibm:tririga_application_platform:3.3.2.5 cpe:/a:ibm:tririga_application_platform:3.4.0.0 cpe:/a:ibm:tririga_application_platform:3.4.1.1 cpe:/a:ibm:tririga_application_platform:3.4.1.2 cpe:/a:ibm:tririga_application_platform:3.4.1.3 cpe:/a:ibm:tririga_application_platform:3.4.2.0 cpe:/a:ibm:tririga_application_platform:3.4.2.1 cpe:/a:ibm:tririga_application_platform:3.4.2.2 cpe:/a:ibm:tririga_application_platform:3.5.0.0

CVE-2016-0299

2018-02-28T12:29:00.673-05:00

2018-03-17T06:17:46.597-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-15T08:26:36.830-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981155 XF ibm-tririga-cve20160299-info-disc(111382) IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to obtain sensitive information via vectors involving a database query. IBM X-Force ID: 111382.

CVE-2016-0300

2018-02-02T16:29:00.417-05:00

2018-02-14T10:24:37.200-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T10:03:49.023-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979760 XF ibm-tririga-cve20160300-sec-bypass(111412) IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. IBM X-Force ID: 111412.

CVE-2016-0301

2016-06-26T10:59:05.717-04:00

2016-07-28T16:11:03.027-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-07-28T15:09:53.017-04:00

cpe:/a:ibm:tivoli_integrated_portal:2.2.0.0 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.1 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.3 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.5 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.7 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.9 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.11 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.13 cpe:/a:ibm:tivoli_integrated_portal:2.2.0.15

CVE-2016-0303

2018-02-02T16:29:00.463-05:00

2018-02-15T10:28:32.253-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T11:27:57.337-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981591 Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:ibm:domino:8.5.0 cpe:/a:ibm:domino:8.5.1 cpe:/a:ibm:domino:8.5.1.1 cpe:/a:ibm:domino:8.5.1.2 cpe:/a:ibm:domino:8.5.1.3 cpe:/a:ibm:domino:8.5.1.4 cpe:/a:ibm:domino:8.5.1.5 cpe:/a:ibm:domino:8.5.2 cpe:/a:ibm:domino:8.5.2.1 cpe:/a:ibm:domino:8.5.2.2 cpe:/a:ibm:domino:8.5.2.3 cpe:/a:ibm:domino:8.5.2.4 cpe:/a:ibm:domino:8.5.3 cpe:/a:ibm:domino:8.5.3.1 cpe:/a:ibm:domino:8.5.3.2 cpe:/a:ibm:domino:8.5.3.3 cpe:/a:ibm:domino:8.5.3.4 cpe:/a:ibm:domino:8.5.3.5 cpe:/a:ibm:domino:8.5.3.6 cpe:/a:ibm:domino:9.0.0 cpe:/a:ibm:domino:9.0.1 cpe:/a:ibm:domino:9.0.1.1 cpe:/a:ibm:domino:9.0.1.2 cpe:/a:ibm:domino:9.0.1.3 cpe:/a:ibm:domino:9.0.1.4 cpe:/a:ibm:domino:9.0.1.5

CVE-2016-0304

2016-06-28T21:59:06.840-04:00

2016-06-29T12:54:52.897-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-06-29T12:25:51.370-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983328 The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, aka SPR KLYHA7MM3J. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.

cpe:/a:ibm:connections:4.0.0.0 cpe:/a:ibm:connections:4.5.0.0 cpe:/a:ibm:connections:5.0.0.0 cpe:/a:ibm:connections:5.5.0.0

CVE-2016-0305

2017-02-08T17:59:00.417-05:00

2017-02-09T21:59:00.840-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21986770 BID 92436 IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

cpe:/a:ibm:websphere_application_server:7.0.0.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:7.0.0.29 cpe:/a:ibm:websphere_application_server:7.0.0.31 cpe:/a:ibm:websphere_application_server:7.0.0.33 cpe:/a:ibm:websphere_application_server:7.0.0.35 cpe:/a:ibm:websphere_application_server:7.0.0.37 cpe:/a:ibm:websphere_application_server:7.0.0.39 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.0.0.6 cpe:/a:ibm:websphere_application_server:8.0.0.7 cpe:/a:ibm:websphere_application_server:8.0.0.8 cpe:/a:ibm:websphere_application_server:8.0.0.9 cpe:/a:ibm:websphere_application_server:8.0.0.10 cpe:/a:ibm:websphere_application_server:8.0.0.11 cpe:/a:ibm:websphere_application_server:8.0.0.12 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1 cpe:/a:ibm:websphere_application_server:8.5.0.2 cpe:/a:ibm:websphere_application_server:8.5.5.0 cpe:/a:ibm:websphere_application_server:8.5.5.1 cpe:/a:ibm:websphere_application_server:8.5.5.2 cpe:/a:ibm:websphere_application_server:8.5.5.3 cpe:/a:ibm:websphere_application_server:8.5.5.4 cpe:/a:ibm:websphere_application_server:8.5.5.5 cpe:/a:ibm:websphere_application_server:8.5.5.6 cpe:/a:ibm:websphere_application_server:8.5.5.7 cpe:/a:ibm:websphere_application_server:8.5.5.8 cpe:/a:ibm:websphere_application_server:8.5.5.9

CVE-2016-0306

2016-05-17T10:08:00.123-04:00

2016-11-28T14:52:59.787-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 85978 AIXAPAR PI56190 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979231 IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.41, 8.0 before 8.0.0.13, and 8.5 before 8.5.5.10, when FIPS 140-2 is enabled, misconfigures TLS, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

cpe:/a:ibm:connections:4.0.0.0 cpe:/a:ibm:connections:4.5.0.0 cpe:/a:ibm:connections:5.0.0.0 cpe:/a:ibm:connections:5.5.0.0

CVE-2016-0307

2017-02-08T17:59:00.447-05:00

2017-02-09T21:59:00.887-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21986770 BID 92440 IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.

cpe:/a:ibm:connections:4.0.0.0 cpe:/a:ibm:connections:4.5.0.0 cpe:/a:ibm:connections:5.0.0.0 cpe:/a:ibm:connections:5.5.0.0

CVE-2016-0308

2017-02-08T17:59:00.480-05:00

2017-02-09T21:59:00.937-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21986770 BID 92439 IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.

cpe:/a:ibm:connections:4.0.0.0 cpe:/a:ibm:connections:4.5.0.0 cpe:/a:ibm:connections:5.0.0.0 cpe:/a:ibm:connections:5.5.0.0

CVE-2016-0310

2017-02-08T17:59:00.510-05:00

2017-02-09T21:59:00.983-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21988338 BID 92437 IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain.

cpe:/a:ibm:tivoli_business_service_manager:6.1.0 cpe:/a:ibm:tivoli_business_service_manager:6.1.1

CVE-2016-0311

2018-02-02T16:29:00.527-05:00

2018-02-14T11:09:45.523-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T10:40:55.973-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21986853 XF ibm-tivoli-cve20160311-xss(111480) CONFIRM https://www.ibm.com/blogs/psirt/ibm-security-bulletin-cross-site-scripting-vulnerability-in-tivoli-business-service-manager-cve-2016-0311/ Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111480.

cpe:/a:ibm:tririga_application_platform:3.3.1

CVE-2016-0312

2018-02-02T16:29:00.603-05:00

2018-02-14T10:39:55.393-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T09:50:06.753-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979762 XF ibm-tririga-cve20160312-info-disc(111486) IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to Document Manager. IBM X-Force ID: 111486.

cpe:/a:ibm:jazz_reporting_service:5.0 cpe:/a:ibm:jazz_reporting_service:5.0.1 cpe:/a:ibm:jazz_reporting_service:5.0.2 cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0313

2016-07-07T21:59:05.337-04:00

2016-07-08T11:21:07.313-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-08T11:14:13.770-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983147 Cross-site scripting (XSS) vulnerability in the Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2888 and CVE-2016-0350.

cpe:/a:ibm:jazz_reporting_service:5.0 cpe:/a:ibm:jazz_reporting_service:5.0.1 cpe:/a:ibm:jazz_reporting_service:5.0.2 cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0314

2016-07-07T21:59:06.350-04:00

2016-11-28T14:53:00.897-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91697 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983147 The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 allow remote authenticated users to conduct clickjacking attacks via unspecified vectors.

cpe:/a:ibm:jazz_reporting_service:5.0 cpe:/a:ibm:jazz_reporting_service:5.0.1 cpe:/a:ibm:jazz_reporting_service:5.0.2 cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0315

2016-07-07T21:59:07.273-04:00

2016-07-08T13:07:08.297-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-07-08T11:48:19.790-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983147 The Report Builder and Data Collection Component (DCC) in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2 ifix016 and 6.x before 6.0.1 ifix005 maintain session ID validity after a logout action, which allows remote authenticated users to hijack sessions by leveraging an unattended workstation.

cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1 cpe:/a:ibm:jazz_reporting_service:6.0.2

CVE-2016-0316

2016-11-25T15:59:00.360-05:00

2016-11-28T18:38:13.427-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-28T14:48:52.833-05:00

BID 92472 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983137 Cross-site scripting (XSS) vulnerability in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 and 6.0.2 before iFix003 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0317

2016-11-25T15:59:02.267-05:00

2016-11-28T19:03:58.193-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-28T14:47:45.823-05:00

BID 92463 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983137 Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote attackers to conduct clickjacking attacks via unspecified vectors.

cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0318

2016-11-25T15:59:03.703-05:00

2016-11-28T19:02:22.257-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-11-28T14:43:56.890-05:00

BID 92466 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983137 Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 does not destroy a Session ID upon a logout action, which allows remote attackers to obtain access by leveraging an unattended workstation.

cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0319

2016-11-25T15:59:04.750-05:00

2016-11-29T12:09:10.633-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-11-29T10:43:33.347-05:00

BID 92475 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983137 The XML parser in Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service 6.0 and 6.0.1 before 6.0.1 iFix006 allows remote authenticated administrators to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:ibm:urbancode_deploy:6.0 cpe:/a:ibm:urbancode_deploy:6.0.1 cpe:/a:ibm:urbancode_deploy:6.0.1.1 cpe:/a:ibm:urbancode_deploy:6.0.1.2 cpe:/a:ibm:urbancode_deploy:6.0.1.3 cpe:/a:ibm:urbancode_deploy:6.0.1.4 cpe:/a:ibm:urbancode_deploy:6.0.1.5 cpe:/a:ibm:urbancode_deploy:6.0.1.6 cpe:/a:ibm:urbancode_deploy:6.0.1.7 cpe:/a:ibm:urbancode_deploy:6.0.1.8 cpe:/a:ibm:urbancode_deploy:6.0.1.9 cpe:/a:ibm:urbancode_deploy:6.0.1.10 cpe:/a:ibm:urbancode_deploy:6.0.1.11 cpe:/a:ibm:urbancode_deploy:6.0.1.12 cpe:/a:ibm:urbancode_deploy:6.0.1.13 cpe:/a:ibm:urbancode_deploy:6.0.1.14 cpe:/a:ibm:urbancode_deploy:6.1 cpe:/a:ibm:urbancode_deploy:6.1.0.1 cpe:/a:ibm:urbancode_deploy:6.1.0.2 cpe:/a:ibm:urbancode_deploy:6.1.0.3 cpe:/a:ibm:urbancode_deploy:6.1.0.4 cpe:/a:ibm:urbancode_deploy:6.1.1 cpe:/a:ibm:urbancode_deploy:6.1.1.1 cpe:/a:ibm:urbancode_deploy:6.1.1.2 cpe:/a:ibm:urbancode_deploy:6.1.1.3 cpe:/a:ibm:urbancode_deploy:6.1.1.4 cpe:/a:ibm:urbancode_deploy:6.1.1.5 cpe:/a:ibm:urbancode_deploy:6.1.1.6 cpe:/a:ibm:urbancode_deploy:6.1.1.7 cpe:/a:ibm:urbancode_deploy:6.1.1.8 cpe:/a:ibm:urbancode_deploy:6.1.2 cpe:/a:ibm:urbancode_deploy:6.1.3 cpe:/a:ibm:urbancode_deploy:6.1.3.1 cpe:/a:ibm:urbancode_deploy:6.1.3.2 cpe:/a:ibm:urbancode_deploy:6.1.3.3 cpe:/a:ibm:urbancode_deploy:6.2.0.0 cpe:/a:ibm:urbancode_deploy:6.2.0.1 cpe:/a:ibm:urbancode_deploy:6.2.0.2 cpe:/a:ibm:urbancode_deploy:6.2.1 cpe:/a:ibm:urbancode_deploy:6.2.1.1 cpe:/a:ibm:urbancode_deploy:6.2.2 cpe:/a:ibm:urbancode_deploy:6.2.2.1

CVE-2016-0320

2017-02-01T17:59:00.243-05:00

2017-02-13T14:44:55.517-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-10T14:25:45.997-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg2C1000222 BID 95974 IBM UrbanCode Deploy could allow an authenticated user to modify Ucd objects due to multiple REST endpoints not properly authorizing users editing UCD objects. This could affect the behavior of legitimately triggered processes.

cpe:/a:ibm:personal_communications:6.0.0 cpe:/a:ibm:personal_communications:6.0.1 cpe:/a:ibm:personal_communications:6.0.2 cpe:/a:ibm:personal_communications:6.0.3 cpe:/a:ibm:personal_communications:6.0.4 cpe:/a:ibm:personal_communications:6.0.5 cpe:/a:ibm:personal_communications:6.0.6 cpe:/a:ibm:personal_communications:6.0.7 cpe:/a:ibm:personal_communications:6.0.8 cpe:/a:ibm:personal_communications:6.0.9 cpe:/a:ibm:personal_communications:6.0.10 cpe:/a:ibm:personal_communications:6.0.11 cpe:/a:ibm:personal_communications:6.0.12 cpe:/a:ibm:personal_communications:6.0.13 cpe:/a:ibm:personal_communications:6.0.14 cpe:/a:ibm:personal_communications:6.0.15 cpe:/a:ibm:personal_communications:6.0.16 cpe:/a:ibm:personal_communications:12.0.0

CVE-2016-0321

2016-07-17T18:59:00.177-04:00

2016-11-28T14:53:05.977-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91751 AIXAPAR IT12006 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981692 IBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows local users to discover passwords by leveraging access to the victim account and executing a PowerShell script.

cpe:/a:ibm:connections:4.0.0.0 cpe:/a:ibm:connections:4.5.0.0 cpe:/a:ibm:connections:5.0.0.0 cpe:/a:ibm:connections:5.5.0.0

CVE-2016-0322

2016-06-29T21:59:00.140-04:00

2016-06-30T09:08:05.407-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-30T08:46:50.677-04:00

AIXAPAR LO88783 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982611 Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document.

cpe:/a:ibm:bluemix:-

CVE-2016-0323

2016-05-17T10:08:01.437-04:00

2016-05-19T10:03:50.493-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-17T14:08:31.630-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21979682 The Auto-Scaling agent in Liberty for Java in IBM Bluemix before 2.7-20160321-1358 allows remote authenticated users to disable X.509 certificate validation, and consequently bypass an intended HTTPS trust-management feature, via unspecified vectors.

cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.0.0 cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.0.1 cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.0.2 cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.0.3 cpe:/a:ibm:security_identity_manager_virtual_appliance:7.0.1.0

CVE-2016-0324

2018-01-12T12:29:00.677-05:00

2018-01-29T08:32:15.203-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2018-01-25T12:55:26.707-05:00

ALLOWS_ADMIN_ACCESS

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981438 XF ibm-spim-cve20160324-command-injection(111640) IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges via unspecified vectors. IBM X-Force ID: 111640.

CVE-2016-0325

2016-11-24T14:59:06.957-05:00

2016-11-28T14:53:06.977-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 94539 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991478 IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 allow remote authenticated users to execute arbitrary OS commands via a crafted request.

cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.3 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.4 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.5 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.6 cpe:/a:ibm:rational_collaborative_lifecycle_management:4.0.7 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:5.0.2 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.0 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1 cpe:/a:ibm:rational_quality_manager:3.0.1.6 cpe:/a:ibm:rational_quality_manager:4.0 cpe:/a:ibm:rational_quality_manager:4.0.0.1 cpe:/a:ibm:rational_quality_manager:4.0.0.2 cpe:/a:ibm:rational_quality_manager:4.0.1 cpe:/a:ibm:rational_quality_manager:4.0.2 cpe:/a:ibm:rational_quality_manager:4.0.3 cpe:/a:ibm:rational_quality_manager:4.0.4 cpe:/a:ibm:rational_quality_manager:4.0.5 cpe:/a:ibm:rational_quality_manager:4.0.6 cpe:/a:ibm:rational_quality_manager:4.0.7 cpe:/a:ibm:rational_quality_manager:5.0.0 cpe:/a:ibm:rational_quality_manager:5.0.1 cpe:/a:ibm:rational_quality_manager:5.0.2 cpe:/a:ibm:rational_quality_manager:6.0.0 cpe:/a:ibm:rational_quality_manager:6.0.1

CVE-2016-0326

2016-10-21T23:59:08.720-04:00

2016-11-28T14:53:08.133-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 93824 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21989735 IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1 ifix3 allow remote authenticated users to execute arbitrary OS commands via a crafted "HTML request."

CVE-2016-0327

2018-01-12T12:29:00.727-05:00

2018-01-29T08:35:20.927-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-01-25T12:53:35.673-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981438 XF ibm-sim-cve20160327-command-injection(111643) IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges via unspecified vectors. IBM X-Force ID: 111643.

CVE-2016-0328

2016-10-21T23:59:10.347-04:00

2016-11-28T14:53:09.133-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 93402 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21990226 IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain administrator privileges for command execution via unspecified vectors.

cpe:/a:ibm:emptoris_sourcing:10.0.2.0 cpe:/a:ibm:emptoris_sourcing:10.0.2.2 cpe:/a:ibm:emptoris_sourcing:10.0.2.3 cpe:/a:ibm:emptoris_sourcing:10.0.2.5 cpe:/a:ibm:emptoris_sourcing:10.0.2.6 cpe:/a:ibm:emptoris_sourcing:10.0.2.7 cpe:/a:ibm:emptoris_sourcing:10.0.4.0

CVE-2016-0329

2018-02-02T16:29:00.667-05:00

2018-02-16T11:28:15.067-05:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-16T10:39:44.757-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982629 XF ibm-emptoris-cve20160329-url-redirect(111692) Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 before 10.0.4.0_iFix8, and 10.1.0.0 before 10.1.0.0_iFix3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 111692.

cpe:/a:ibm:security_identity_manager_adapter:7.0.0.0 cpe:/a:ibm:security_identity_manager_adapter:7.0.0.1 cpe:/a:ibm:security_identity_manager_adapter:7.0.0.2 cpe:/a:ibm:security_identity_manager_adapter:7.0.0.3 cpe:/a:ibm:security_identity_manager_adapter:7.0.1.0 cpe:/a:ibm:security_identity_manager_adapter:7.0.1.1

CVE-2016-0330

2016-07-15T14:59:02.140-04:00

2017-08-31T21:29:01.710-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1036255 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985736 IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles password creation, which makes it easier for remote attackers to obtain access by leveraging an attack against the password algorithm.

cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.1 cpe:/a:ibm:rational_collaborative_lifecycle_management:6.0.2 cpe:/a:ibm:rational_team_concert:6.0.1 cpe:/a:ibm:rational_team_concert:6.0.2

CVE-2016-0331

2016-09-12T06:59:00.130-04:00

2017-07-29T21:29:00.833-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92840 SECTRACK 1036814 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21989899 Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 6.0.1 and 6.0.2 before 6.0.2 iFix2 and Rational Collaborative Lifecycle Management 6.0.1 and 6.0.2 before 6.0.2 iFix2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2016-0332

2018-01-12T12:29:00.757-05:00

2018-01-29T08:10:43.917-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-01-25T12:52:18.497-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981438 XF ibm-sim-cve20160332-brute-force(111695) IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach. IBM X-Force ID: 111695.

cpe:/a:ibm:security_identity_manager:7.0.0.0 cpe:/a:ibm:security_identity_manager:7.0.0.1 cpe:/a:ibm:security_identity_manager:7.0.0.2 cpe:/a:ibm:security_identity_manager:7.0.0.3 cpe:/a:ibm:security_identity_manager:7.0.1.0

CVE-2016-0335

2018-01-12T12:29:00.803-05:00

2018-01-29T08:07:59.017-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2018-01-25T11:28:23.290-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981438 XF ibm-sim-cve20160335-csrf(111736) Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. IBM X-Force ID: 111736.

CVE-2016-0336

2018-01-12T12:29:00.850-05:00

2018-01-29T08:08:19.097-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-01-25T11:30:42.330-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981438 XF ibm-sim-cve20160336-xss(111737) Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111737.

CVE-2016-0338

2016-07-15T14:59:03.233-04:00

2017-08-31T21:29:01.773-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1036255 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985736 IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows local users to discover cleartext passwords by (1) reading a configuration file or (2) examining a process.

CVE-2016-0339

2016-07-15T14:59:04.297-04:00

2017-08-31T21:29:01.817-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91689 SECTRACK 1036255 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985736 IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session identifiers after logout, which makes it easier for remote attackers to spoof users by leveraging knowledge of "traffic records."

CVE-2016-0340

2016-07-15T14:59:05.203-04:00

2017-08-31T21:29:01.867-04:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov BID 91692 SECTRACK 1036255 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985736 IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 mishandles session expiration, which allows remote attackers to hijack sessions by leveraging an unattended workstation.

cpe:/a:ibm:b2b_advanced_communications:1.0 cpe:/a:ibm:b2b_advanced_communications:1.0.0.1 cpe:/a:ibm:b2b_advanced_communications:1.0.0.2 cpe:/a:ibm:b2b_advanced_communications:1.0.0.3 cpe:/a:ibm:multi-enterprise_integration_gateway:1.0.0

CVE-2016-0341

2016-05-14T21:59:00.160-04:00

2016-05-19T12:03:02.167-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-16T14:11:34.337-04:00

AIXAPAR IT14835 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981462 IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.0.0.2 through 1.0.0.4 do not require HTTPS, which might allow remote attackers to obtain sensitive information by sniffing the network.

CVE-2016-0342

2018-02-02T16:29:00.747-05:00

2018-02-15T13:12:24.577-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-02-14T12:36:38.423-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980252 XF ibm-tririga-cve20160342-info-disc(111783) IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary reports by leveraging an incorrect grant of access. IBM X-Force ID: 111783.

CVE-2016-0343

2018-02-21T11:29:00.537-05:00

2018-03-09T13:03:24.577-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-09T11:31:07.727-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980229 XF ibm-tririga-cve20160343-info-disc(111784) IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain sensitive information by reading an error message. IBM X-Force ID: 111784.

CVE-2016-0344

2018-02-21T11:29:00.597-05:00

2018-03-09T13:12:35.697-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-09T11:26:10.093-05:00

XF ibm-tririga-cve20160344-xss(111785) CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980234 Cross-site scripting (XSS) vulnerability in the My Reports component in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111785.

CVE-2016-0345

2018-02-21T11:29:00.660-05:00

2018-03-09T13:03:17.080-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-09T11:35:54.183-05:00

XF ibm-tririga-cve20160345-info-disc(111786) CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980233 IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to obtain the installation path via vectors involving Birt report rendering. IBM X-Force ID: 111786.

CVE-2016-0346

2016-07-03T17:59:01.633-04:00

2017-08-31T21:29:01.913-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 85864 SECTRACK 1036221 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984323 Cross-site scripting (XSS) vulnerability in IBM Cognos Business Intelligence 10.2 before IF20, 10.2.1 before IF17, 10.2.1.1 before IF16, 10.2.2 before IF12, and 10.1.1 before IF19 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:tririga_application_platform:3.3.0.0 cpe:/a:ibm:tririga_application_platform:3.3.1.0 cpe:/a:ibm:tririga_application_platform:3.3.2.0 cpe:/a:ibm:tririga_application_platform:3.4.0.0

CVE-2016-0348

2018-02-21T11:29:00.707-05:00

2018-03-09T13:03:34.110-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-03-09T12:05:33.533-05:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980237 XF ibm-tririga-cve20160348-csrf(111813) Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. IBM X-Force ID: 111813.

cpe:/a:ibm:business_process_manager:8.5.6.0 cpe:/a:ibm:business_process_manager:8.5.7.0

CVE-2016-0349

2016-06-29T21:59:01.580-04:00

2016-11-29T22:02:56.650-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov SECTRACK 1036185 AIXAPAR JR55701 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981094 IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call.

cpe:/a:ibm:jazz_reporting_service:5.0 cpe:/a:ibm:jazz_reporting_service:5.0.1 cpe:/a:ibm:jazz_reporting_service:5.0.2 cpe:/a:ibm:jazz_reporting_service:6.0 cpe:/a:ibm:jazz_reporting_service:6.0.1

CVE-2016-0350

2016-07-07T21:59:08.243-04:00

2016-07-08T13:13:23.260-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-08T11:51:28.380-04:00

CVE-2016-0351

2018-02-21T11:29:00.753-05:00

2018-03-13T11:27:36.917-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-12T15:04:27.037-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21989198 XF ibm-sim-cve20160351-info-disc(111890) IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. IBM X-Force ID: 111890.

cpe:/a:ibm:security_privileged_identity_manager:2.0.0 cpe:/a:ibm:security_privileged_identity_manager:2.0.1 cpe:/a:ibm:security_privileged_identity_manager:2.0.2

CVE-2016-0353

2016-11-24T14:59:08.080-05:00

2016-11-28T14:53:14.527-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 94543 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21988706 IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

cpe:/a:ibm:sametime:8.5.2.0 cpe:/a:ibm:sametime:8.5.2.1 cpe:/a:ibm:sametime:9.0.0.0 cpe:/a:ibm:sametime:9.0.0.1 cpe:/a:ibm:sametime:9.0.1

CVE-2016-0354

2017-08-29T14:29:00.200-04:00

2017-09-06T21:29:00.917-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22006439 BID 100599 SECTRACK 1039231 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/111893 IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user to upload a malicious file to a Sametime meeting room, that could be downloaded by unsuspecting users which could be executed with user privileges. IBM X-Force ID: 111893.

cpe:/a:ibm:sametime:8.5.2.0 cpe:/a:ibm:sametime:8.5.2.1 cpe:/a:ibm:sametime:9.0.0.0 cpe:/a:ibm:sametime:9.0.0.1 cpe:/a:ibm:sametime:9.0.1

CVE-2016-0355

2017-08-29T14:29:00.263-04:00

2017-09-06T21:29:00.977-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22006439 BID 100599 SECTRACK 1039231 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/111894 IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111894.

cpe:/a:ibm:sametime:8.5.2.0 cpe:/a:ibm:sametime:8.5.2.1 cpe:/a:ibm:sametime:9.0.0.0 cpe:/a:ibm:sametime:9.0.0.1 cpe:/a:ibm:sametime:9.0.1

CVE-2016-0356

2017-08-29T14:29:00.310-04:00

2017-09-06T21:29:01.023-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22006439 BID 100599 SECTRACK 1039231 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/111895 IBM Sametime Enterprise Meeting Server 8.5.2 and 9.0 could allow an authenticated user that has been invited to a Sametime meeting room, to cause the screen sharing to cease through the use of cross-site request forgery. IBM X-Force ID: 111895.

CVE-2016-0357

2016-07-15T14:59:06.203-04:00

2017-08-31T21:29:01.960-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 87528 SECTRACK 1036255 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985736 IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.1 before 7.0.1-ISS-SIM-FP0003 allows remote attackers to conduct clickjacking attacks via a crafted web site.

cpe:/a:ibm:sametime:8.5.2.0 cpe:/a:ibm:sametime:8.5.2.1 cpe:/a:ibm:sametime:9.0.0.0 cpe:/a:ibm:sametime:9.0.0.1 cpe:/a:ibm:sametime:9.0.1

CVE-2016-0358

2017-08-29T17:29:00.197-04:00

2017-09-03T09:19:51.453-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2017-09-01T13:09:05.647-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22006441 BID 100572 MISC https://exchange.xforce.ibmcloud.com/vulnerabilities/111928 IBM Sametime 8.5.2 and 9.0 could allow an unauthorized authenticated user to enumerate group chat ID numbers and join meetings that he was not invited to. IBM X-Force ID: 111928.

cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.10 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.12 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.14 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.16 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.18 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.22 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.24 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:7.0.0.28 cpe:/a:ibm:websphere_application_server:7.0.0.29 cpe:/a:ibm:websphere_application_server:7.0.0.31 cpe:/a:ibm:websphere_application_server:7.0.0.32 cpe:/a:ibm:websphere_application_server:7.0.0.33 cpe:/a:ibm:websphere_application_server:7.0.0.34 cpe:/a:ibm:websphere_application_server:7.0.0.35 cpe:/a:ibm:websphere_application_server:7.0.0.36 cpe:/a:ibm:websphere_application_server:7.0.0.37 cpe:/a:ibm:websphere_application_server:7.0.0.38 cpe:/a:ibm:websphere_application_server:7.0.0.39 cpe:/a:ibm:websphere_application_server:7.0.0.41 cpe:/a:ibm:websphere_application_server:8.0 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.0.0.6 cpe:/a:ibm:websphere_application_server:8.0.0.7 cpe:/a:ibm:websphere_application_server:8.0.0.8 cpe:/a:ibm:websphere_application_server:8.0.0.9 cpe:/a:ibm:websphere_application_server:8.0.0.10 cpe:/a:ibm:websphere_application_server:8.0.0.11 cpe:/a:ibm:websphere_application_server:8.0.0.12 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.5.4 cpe:/a:ibm:websphere_application_server:8.5.5.5 cpe:/a:ibm:websphere_application_server:8.5.5.6 cpe:/a:ibm:websphere_application_server:8.5.5.7 cpe:/a:ibm:websphere_application_server:8.5.5.8 cpe:/a:ibm:websphere_application_server:8.5.5.9

CVE-2016-0359

2016-07-03T17:59:03.023-04:00

2017-08-31T21:29:02.007-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91484 SECTRACK 1036184 AIXAPAR PI58918 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982526 CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 Full before 8.5.5.10, and 8.5 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

cpe:/a:ibm:websphere_mq_jms:7.0.1 cpe:/a:ibm:websphere_mq_jms:7.1 cpe:/a:ibm:websphere_mq_jms:7.5 cpe:/a:ibm:websphere_mq_jms:8.0 cpe:/a:ibm:websphere_mq_jms:9.0

CVE-2016-0360

2017-02-15T14:59:00.157-05:00

2017-07-26T21:29:00.367-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 95317 SECTRACK 1037561 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983457 IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath. IBM Reference #: 1983457.

cpe:/a:ibm:general_parallel_file_system:3.5 cpe:/a:ibm:general_parallel_file_system:3.5.0.3 cpe:/a:ibm:general_parallel_file_system:3.5.0.7 cpe:/a:ibm:general_parallel_file_system:3.5.0.9 cpe:/a:ibm:general_parallel_file_system:3.5.0.11 cpe:/a:ibm:general_parallel_file_system:3.5.0.16 cpe:/a:ibm:general_parallel_file_system:4.1.0.1

CVE-2016-0361

2016-08-07T21:59:03.837-04:00

2017-08-31T21:29:02.053-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 90550 SECTRACK 1036455 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21986595 IBM General Parallel File System (GPFS) 3.5 before 3.5.0.29 efix 6 and 4.1.1 before 4.1.1.4 efix 9, when the Spectrum Scale GUI is used with DB2 on Linux, UNIX and Windows, allows remote authenticated users to obtain sensitive information via unspecified vectors, as demonstrated by discovering ADMIN passwords.

cpe:/a:ibm:tririga_application_platform:3.3.0.0 cpe:/a:ibm:tririga_application_platform:3.3.0.1 cpe:/a:ibm:tririga_application_platform:3.3.0.2 cpe:/a:ibm:tririga_application_platform:3.3.1.0 cpe:/a:ibm:tririga_application_platform:3.3.1.1 cpe:/a:ibm:tririga_application_platform:3.3.1.2 cpe:/a:ibm:tririga_application_platform:3.3.1.3 cpe:/a:ibm:tririga_application_platform:3.3.2.0 cpe:/a:ibm:tririga_application_platform:3.3.2.1 cpe:/a:ibm:tririga_application_platform:3.3.2.2 cpe:/a:ibm:tririga_application_platform:3.3.2.3 cpe:/a:ibm:tririga_application_platform:3.3.2.4 cpe:/a:ibm:tririga_application_platform:3.3.2.5 cpe:/a:ibm:tririga_application_platform:3.4.0.0 cpe:/a:ibm:tririga_application_platform:3.4.0.1 cpe:/a:ibm:tririga_application_platform:3.4.1.0 cpe:/a:ibm:tririga_application_platform:3.4.1.1 cpe:/a:ibm:tririga_application_platform:3.4.1.2 cpe:/a:ibm:tririga_application_platform:3.4.1.3 cpe:/a:ibm:tririga_application_platform:3.4.2.0 cpe:/a:ibm:tririga_application_platform:3.4.2.1 cpe:/a:ibm:tririga_application_platform:3.4.2.2 cpe:/a:ibm:tririga_application_platform:3.4.2.3 cpe:/a:ibm:tririga_application_platform:3.5.0.0 cpe:/a:ibm:tririga_application_platform:3.5.0.1

CVE-2016-0362

2016-06-30T21:59:00.137-04:00

2016-08-11T09:36:50.797-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-08-10T14:03:33.997-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980749 IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet or Internet hosts, via a crafted proxy request to a web service.

cpe:/a:ibm:java_sdk:6.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.11.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.12.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.14.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.3::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.20::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.2::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.8.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.31::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.2.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.31::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.1.10::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.11::~~technology~~~ cpe:/a:redhat:satellite:5.6 cpe:/a:redhat:satellite:5.7 cpe:/o:novell:suse_linux_enterprise_module_for_legacy_software:12 cpe:/o:novell:suse_linux_enterprise_server:11.0:sp2:~~ltss~~~ cpe:/o:novell:suse_linux_enterprise_server:11.0:sp3:~~ltss~~~ cpe:/o:novell:suse_linux_enterprise_server:11.0:sp4 cpe:/o:novell:suse_linux_enterprise_server:12.0 cpe:/o:novell:suse_linux_enterprise_server:12.0:sp1 cpe:/o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4 cpe:/o:novell:suse_linux_enterprise_software_development_kit:12.0 cpe:/o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1 cpe:/o:novell:suse_manager:2.1 cpe:/o:novell:suse_manager_proxy:2.1 cpe:/o:novell:suse_openstack_cloud:5 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:7.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_eus:6.7 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.3 cpe:/o:redhat:enterprise_linux_server_eus:7.4 cpe:/o:redhat:enterprise_linux_server_eus:7.5 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0363

2016-06-03T10:59:01.530-04:00

2019-06-24T10:25:00.687-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-06-24T08:27:28.957-04:00

SUSE SUSE-SU-2016:1299 SUSE SUSE-SU-2016:1300 SUSE SUSE-SU-2016:1303 SUSE SUSE-SU-2016:1378 SUSE SUSE-SU-2016:1379 SUSE SUSE-SU-2016:1388 SUSE SUSE-SU-2016:1458 SUSE SUSE-SU-2016:1475 REDHAT RHSA-2016:0701 REDHAT RHSA-2016:0702 REDHAT RHSA-2016:0708 REDHAT RHSA-2016:0716 REDHAT RHSA-2016:1039 FULLDISC 20160405 Re: [SE-2012-01] Broken security fix in IBM Java 7/8 FULLDISC 20160404 [SE-2012-01] Broken security fix in IBM Java 7/8 MISC http://www.security-explorations.com/materials/SE-2012-01-IBM-4.pdf BID 85895 SECTRACK 1035953 AIXAPAR IX90172 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980826 REDHAT RHSA-2016:1430 REDHAT RHSA-2017:1216 The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) uses the invoke method of the java.lang.reflect.Method class in an AccessController doPrivileged block, which allows remote attackers to call setSecurityManager and bypass a sandbox protection mechanism via vectors related to a Proxy object instance implementing the java.lang.reflect.InvocationHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3009.

CVE-2016-0364

2016-06-30T21:59:01.153-04:00

2016-07-01T09:55:50.230-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-01T09:00:19.527-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000152 IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.

CVE-2016-0365

2016-06-30T21:59:02.107-04:00

2016-11-28T14:53:19.870-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91526 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000149 IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows remote attackers to bypass authentication and obtain sensitive artifact information via unspecified vectors.

cpe:/a:ibm:security_privileged_identity_manager:2.0

CVE-2016-0366

2018-02-21T11:29:00.817-05:00

2018-03-12T14:46:37.727-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-12T13:48:58.060-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21986260 XF ibm-sim-cve20160366-weak-security(112071) IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 might allow remote attackers to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 112071.

CVE-2016-0367

2018-02-21T11:29:00.880-05:00

2018-03-12T14:46:17.067-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-12T13:35:30.027-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21989198 XF ibm-sim-cve20160367-info-disc(112072) IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive information by reading an error message. IBM X-Force ID: 112072.

cpe:/a:ibm:forms_experience_builder:8.5 cpe:/a:ibm:forms_experience_builder:8.5.1 cpe:/a:ibm:forms_experience_builder:8.6.0

CVE-2016-0369

2018-02-21T11:29:00.940-05:00

2018-03-17T06:29:56.600-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-03-13T11:07:33.513-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21988727 XF ibm-forms-cve20160369-info-disc(112088) XML external entity (XXE) vulnerability in IBM Forms Experience Builder 8.5, 8.5.1, and 8.6 allows remote authenticated users to obtain sensitive information via crafted XML data. IBM X-Force ID: 112088.

cpe:/a:ibm:forms_experience_builder:8.5.0.0 cpe:/a:ibm:forms_experience_builder:8.5.1.0 cpe:/a:ibm:forms_experience_builder:8.5.1.1 cpe:/a:ibm:forms_experience_builder:8.6.0.0 cpe:/a:ibm:forms_experience_builder:8.6.1 cpe:/a:ibm:forms_experience_builder:8.6.1.1 cpe:/a:ibm:forms_experience_builder:8.6.2 cpe:/a:ibm:forms_experience_builder:8.6.2.1

CVE-2016-0370

2016-08-31T21:59:02.193-04:00

2016-11-28T14:53:20.900-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92471 AIXAPAR LO88449 AIXAPAR LO88451 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21988726 Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.

cpe:/a:ibm:tivoli_storage_manager:5.5 cpe:/a:ibm:tivoli_storage_manager:6.1 cpe:/a:ibm:tivoli_storage_manager:6.2 cpe:/a:ibm:tivoli_storage_manager:6.3.0.0 cpe:/a:ibm:tivoli_storage_manager:6.3.2.5 cpe:/a:ibm:tivoli_storage_manager:6.4.0.0 cpe:/a:ibm:tivoli_storage_manager:6.4.3.3 cpe:/a:ibm:tivoli_storage_manager:7.1.0.0 cpe:/a:ibm:tivoli_storage_manager:7.1.6.2

CVE-2016-0371

2017-02-01T16:59:00.100-05:00

2017-02-15T08:54:18.360-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-14T10:57:24.493-05:00

BID 94148 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985114 The Tivoli Storage Manager (TSM) password may be displayed in plain text via application trace output while application tracing is enabled.

CVE-2016-0372

2016-11-24T14:59:09.143-05:00

2016-11-28T14:53:21.980-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 94541 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21991478 IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational DOORS Next Generation 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Engineering Lifecycle Manager 4.x before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Rhapsody Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; and Rational Software Architect Design Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5 do not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

cpe:/a:ibm:urbancode_deploy:6.0 cpe:/a:ibm:urbancode_deploy:6.0.1.0 cpe:/a:ibm:urbancode_deploy:6.0.1.1 cpe:/a:ibm:urbancode_deploy:6.0.1.2 cpe:/a:ibm:urbancode_deploy:6.0.1.3 cpe:/a:ibm:urbancode_deploy:6.0.1.4 cpe:/a:ibm:urbancode_deploy:6.0.1.5 cpe:/a:ibm:urbancode_deploy:6.0.1.6 cpe:/a:ibm:urbancode_deploy:6.0.1.7 cpe:/a:ibm:urbancode_deploy:6.0.1.8 cpe:/a:ibm:urbancode_deploy:6.0.1.9 cpe:/a:ibm:urbancode_deploy:6.0.1.10 cpe:/a:ibm:urbancode_deploy:6.0.1.11 cpe:/a:ibm:urbancode_deploy:6.0.1.12 cpe:/a:ibm:urbancode_deploy:6.0.1.13 cpe:/a:ibm:urbancode_deploy:6.1 cpe:/a:ibm:urbancode_deploy:6.1.0.1 cpe:/a:ibm:urbancode_deploy:6.1.0.2 cpe:/a:ibm:urbancode_deploy:6.1.0.3 cpe:/a:ibm:urbancode_deploy:6.1.0.4 cpe:/a:ibm:urbancode_deploy:6.1.1 cpe:/a:ibm:urbancode_deploy:6.1.1.0 cpe:/a:ibm:urbancode_deploy:6.1.1.1 cpe:/a:ibm:urbancode_deploy:6.1.1.2 cpe:/a:ibm:urbancode_deploy:6.1.1.3 cpe:/a:ibm:urbancode_deploy:6.1.1.4 cpe:/a:ibm:urbancode_deploy:6.1.1.5 cpe:/a:ibm:urbancode_deploy:6.1.1.6 cpe:/a:ibm:urbancode_deploy:6.1.1.7 cpe:/a:ibm:urbancode_deploy:6.1.1.8 cpe:/a:ibm:urbancode_deploy:6.1.2 cpe:/a:ibm:urbancode_deploy:6.1.3 cpe:/a:ibm:urbancode_deploy:6.1.3.1 cpe:/a:ibm:urbancode_deploy:6.1.3.2 cpe:/a:ibm:urbancode_deploy:6.1.3.3 cpe:/a:ibm:urbancode_deploy:6.1.3.4 cpe:/a:ibm:urbancode_deploy:6.1.3.5 cpe:/a:ibm:urbancode_deploy:6.1.3.6 cpe:/a:ibm:urbancode_deploy:6.1.3.7 cpe:/a:ibm:urbancode_deploy:6.1.3.8 cpe:/a:ibm:urbancode_deploy:6.2 cpe:/a:ibm:urbancode_deploy:6.2.0.0 cpe:/a:ibm:urbancode_deploy:6.2.0.1 cpe:/a:ibm:urbancode_deploy:6.2.0.2 cpe:/a:ibm:urbancode_deploy:6.2.0.201 cpe:/a:ibm:urbancode_deploy:6.2.1 cpe:/a:ibm:urbancode_deploy:6.2.1.0 cpe:/a:ibm:urbancode_deploy:6.2.1.1 cpe:/a:ibm:urbancode_deploy:6.2.1.2 cpe:/a:ibm:urbancode_deploy:6.2.2 cpe:/a:ibm:urbancode_deploy:6.2.2.0 cpe:/a:ibm:urbancode_deploy:6.2.2.1

CVE-2016-0373

2018-08-30T12:29:00.557-04:00

2019-10-09T19:16:11.790-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219 XF ibm-ucd-cve20160373-info-disc(112119) IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.

cpe:/a:ibm:tririga_application_platform:3.3.0.0 cpe:/a:ibm:tririga_application_platform:3.3.0.1 cpe:/a:ibm:tririga_application_platform:3.3.0.2 cpe:/a:ibm:tririga_application_platform:3.3.1.0 cpe:/a:ibm:tririga_application_platform:3.3.1.1 cpe:/a:ibm:tririga_application_platform:3.3.1.2 cpe:/a:ibm:tririga_application_platform:3.3.1.3 cpe:/a:ibm:tririga_application_platform:3.3.2.0 cpe:/a:ibm:tririga_application_platform:3.3.2.1 cpe:/a:ibm:tririga_application_platform:3.3.2.2 cpe:/a:ibm:tririga_application_platform:3.3.2.3 cpe:/a:ibm:tririga_application_platform:3.3.2.4 cpe:/a:ibm:tririga_application_platform:3.3.2.5 cpe:/a:ibm:tririga_application_platform:3.4.0.0 cpe:/a:ibm:tririga_application_platform:3.4.0.1 cpe:/a:ibm:tririga_application_platform:3.4.1.0 cpe:/a:ibm:tririga_application_platform:3.4.1.1 cpe:/a:ibm:tririga_application_platform:3.4.1.2 cpe:/a:ibm:tririga_application_platform:3.4.1.3 cpe:/a:ibm:tririga_application_platform:3.4.2.0 cpe:/a:ibm:tririga_application_platform:3.4.2.1 cpe:/a:ibm:tririga_application_platform:3.4.2.2 cpe:/a:ibm:tririga_application_platform:3.4.2.3 cpe:/a:ibm:tririga_application_platform:3.5.0.0 cpe:/a:ibm:tririga_application_platform:3.5.0.1

CVE-2016-0374

2016-06-30T21:59:03.370-04:00

2016-07-01T13:31:46.720-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-07-01T09:57:25.053-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981729 The builder tools in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authenticated users to gain privileges for application modification via unspecified vectors.

cpe:/a:ibm:messagesight:1.1.0.0 cpe:/a:ibm:messagesight:1.1.0.1 cpe:/a:ibm:messagesight:1.2 cpe:/a:ibm:messagesight:1.2.0.0 cpe:/a:ibm:messagesight:1.2.0.1 cpe:/a:ibm:messagesight:1.2.0.2 cpe:/a:ibm:messagesight:1.2.0.3 cpe:/a:ibm:messagesight:2.0.0.0

CVE-2016-0375

2016-06-30T21:59:04.340-04:00

2016-07-08T11:22:42.750-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2016-07-07T19:07:06.070-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985064 JMS Client in IBM MessageSight 1.1.x through 1.1.0.1, 1.2.x through 1.2.0.3, and 2.0.x through 2.0.0.0 allows remote authenticated users to obtain administrator privileges for executing arbitrary commands via unspecified vectors.

cpe:/a:ibm:java_sdk:6.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.8.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.9.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.10.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.11.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.12.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.13.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.14.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.1::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.15.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.3::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.20::~~technology~~~ cpe:/a:ibm:java_sdk:6.0.16.21::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.2::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.7::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.15::~~technology~~~ cpe:/a:ibm:java_sdk:6.1.8.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.3.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.4.2::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.5.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.6.1::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.7.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.8.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.0.9.31::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.1.0::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.2.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.10::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.20::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.30::~~technology~~~ cpe:/a:ibm:java_sdk:7.1.3.31::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.0.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.1.10::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.0::~~technology~~~ cpe:/a:ibm:java_sdk:8.0.2.11::~~technology~~~ cpe:/a:redhat:satellite:5.6 cpe:/a:redhat:satellite:5.7 cpe:/o:novell:suse_linux_enterprise_module_for_legacy_software:12 cpe:/o:novell:suse_linux_enterprise_server:11.0:sp2:~~ltss~~~ cpe:/o:novell:suse_linux_enterprise_server:11.0:sp3:~~ltss~~~ cpe:/o:novell:suse_linux_enterprise_server:11.0:sp4 cpe:/o:novell:suse_linux_enterprise_server:12.0 cpe:/o:novell:suse_linux_enterprise_server:12.0:sp1 cpe:/o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4 cpe:/o:novell:suse_linux_enterprise_software_development_kit:12.0 cpe:/o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1 cpe:/o:novell:suse_manager:2.1 cpe:/o:novell:suse_manager_proxy:2.1 cpe:/o:novell:suse_openstack_cloud:5 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:6.0 cpe:/o:redhat:enterprise_linux_hpc_node_supplementary:7.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_eus:6.7 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.3 cpe:/o:redhat:enterprise_linux_server_eus:7.4 cpe:/o:redhat:enterprise_linux_server_eus:7.5 cpe:/o:redhat:enterprise_linux_workstation:5.0 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0376

2016-06-03T10:59:02.890-04:00

2019-06-24T12:48:18.120-04:00

5.1

NETWORK

HIGH

NONE

PARTIAL

http://nvd.nist.gov

2019-06-24T08:52:45.767-04:00

SUSE SUSE-SU-2016:1299 SUSE SUSE-SU-2016:1300 SUSE SUSE-SU-2016:1303 SUSE SUSE-SU-2016:1378 SUSE SUSE-SU-2016:1379 SUSE SUSE-SU-2016:1388 SUSE SUSE-SU-2016:1458 SUSE SUSE-SU-2016:1475 REDHAT RHSA-2016:0701 REDHAT RHSA-2016:0702 REDHAT RHSA-2016:0708 REDHAT RHSA-2016:0716 REDHAT RHSA-2016:1039 FULLDISC 20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8 MISC http://www.security-explorations.com/materials/SE-2012-01-IBM-5.pdf BUGTRAQ 20160412 [SE-2012-01] Yet another broken security fix in IBM Java 7/8 BID 89192 SECTRACK 1035953 AIXAPAR IX90171 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980826 REDHAT RHSA-2016:1430 REDHAT RHSA-2017:1216 The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.

cpe:/a:ibm:websphere_application_server:7.0.0.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.10 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.12 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.14 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.16 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.18 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.22 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.24 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:7.0.0.28 cpe:/a:ibm:websphere_application_server:7.0.0.29 cpe:/a:ibm:websphere_application_server:7.0.0.31 cpe:/a:ibm:websphere_application_server:7.0.0.32 cpe:/a:ibm:websphere_application_server:7.0.0.33 cpe:/a:ibm:websphere_application_server:7.0.0.34 cpe:/a:ibm:websphere_application_server:7.0.0.35 cpe:/a:ibm:websphere_application_server:7.0.0.36 cpe:/a:ibm:websphere_application_server:7.0.0.37 cpe:/a:ibm:websphere_application_server:7.0.0.38 cpe:/a:ibm:websphere_application_server:7.0.0.39 cpe:/a:ibm:websphere_application_server:7.0.0.40 cpe:/a:ibm:websphere_application_server:7.0.0.41 cpe:/a:ibm:websphere_application_server:7.0.0.42 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.0.0.6 cpe:/a:ibm:websphere_application_server:8.0.0.7 cpe:/a:ibm:websphere_application_server:8.0.0.8 cpe:/a:ibm:websphere_application_server:8.0.0.9 cpe:/a:ibm:websphere_application_server:8.0.0.10 cpe:/a:ibm:websphere_application_server:8.0.0.11 cpe:/a:ibm:websphere_application_server:8.0.0.12 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.1 cpe:/a:ibm:websphere_application_server:8.5.0.2 cpe:/a:ibm:websphere_application_server:8.5.5.0 cpe:/a:ibm:websphere_application_server:8.5.5.1 cpe:/a:ibm:websphere_application_server:8.5.5.2 cpe:/a:ibm:websphere_application_server:8.5.5.3 cpe:/a:ibm:websphere_application_server:8.5.5.4 cpe:/a:ibm:websphere_application_server:8.5.5.5 cpe:/a:ibm:websphere_application_server:8.5.5.6 cpe:/a:ibm:websphere_application_server:8.5.5.7 cpe:/a:ibm:websphere_application_server:8.5.5.8 cpe:/a:ibm:websphere_application_server:8.5.5.9

CVE-2016-0377

2016-10-21T23:59:11.580-04:00

2017-08-15T21:29:04.070-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 92514 SECTRACK 1036653 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21980645 The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors.

cpe:/a:ibm:websphere_application_server:16.0.0.2::~~liberty~~~

CVE-2016-0378

2016-11-24T14:59:10.283-05:00

2016-11-28T14:53:25.480-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93143 AIXAPAR PI54459 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981529 IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3, when the installation lacks a default error page, allows remote attackers to obtain sensitive information by triggering an exception.

cpe:/a:ibm:websphere_mq:7.5 cpe:/a:ibm:websphere_mq:7.5.0.1 cpe:/a:ibm:websphere_mq:7.5.0.2 cpe:/a:ibm:websphere_mq:7.5.0.3 cpe:/a:ibm:websphere_mq:7.5.0.4 cpe:/a:ibm:websphere_mq:7.5.0.5 cpe:/a:ibm:websphere_mq:7.5.0.6 cpe:/a:ibm:websphere_mq:8.0 cpe:/a:ibm:websphere_mq:8.0.0.1 cpe:/a:ibm:websphere_mq:8.0.0.2 cpe:/a:ibm:websphere_mq:8.0.0.3 cpe:/a:ibm:websphere_mq:8.0.0.4

CVE-2016-0379

2016-09-26T00:59:02.320-04:00

2016-11-28T14:53:26.793-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov BID 93146 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984565 IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by leveraging queue-manager rights.

cpe:/a:ibm:sterling_connect_direct:4.1.0.0::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.1.0.1::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.1.0.2::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.1.0.3::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.1.0.4::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.2.0.0::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.2.0.1::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.2.0.2::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.2.0.3::~~~unix~~ cpe:/a:ibm:sterling_connect_direct:4.2.0.4::~~~unix~~

CVE-2016-0380

2016-08-07T21:59:05.633-04:00

2018-06-13T08:18:13.510-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-06-12T11:01:05.387-04:00

BID 92336 AIXAPAR IT14769 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21988278 IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.

cpe:/a:ibm:cognos_tm1:10.2.2

CVE-2016-0381

2016-05-14T21:59:01.457-04:00

2016-11-30T22:02:23.137-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1035930 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981936 IBM Cognos TM1 10.2.2 before FP5, when the host/pmhub/pm/admin AdminGroups setting is empty, allows remote authenticated users to cause a denial of service (configuration outage) via a non-empty value.

cpe:/a:ibm:tealeaf_consumer_experience:8.7 cpe:/a:ibm:tealeaf_consumer_experience:8.7.0 cpe:/a:ibm:tealeaf_consumer_experience:8.7.1 cpe:/a:ibm:tealeaf_consumer_experience:8.8 cpe:/a:ibm:tealeaf_consumer_experience:8.8.0 cpe:/a:ibm:tealeaf_consumer_experience:8.8.1 cpe:/a:ibm:tealeaf_consumer_experience:8.8.2 cpe:/a:ibm:tealeaf_consumer_experience:9.0 cpe:/a:ibm:tealeaf_consumer_experience:9.0.1 cpe:/a:ibm:tealeaf_consumer_experience:9.0.2

CVE-2016-0382

2017-05-03T13:59:00.143-04:00

2017-05-12T13:13:59.087-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-05-12T11:53:34.657-04:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg22000590 BID 98301 The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by network infrastructure components such as IIS. IBM X-Force ID: 112356.

cpe:/a:ibm:websphere_application_server:7.0 cpe:/a:ibm:websphere_application_server:7.0.0.0 cpe:/a:ibm:websphere_application_server:7.0.0.1 cpe:/a:ibm:websphere_application_server:7.0.0.2 cpe:/a:ibm:websphere_application_server:7.0.0.3 cpe:/a:ibm:websphere_application_server:7.0.0.4 cpe:/a:ibm:websphere_application_server:7.0.0.5 cpe:/a:ibm:websphere_application_server:7.0.0.6 cpe:/a:ibm:websphere_application_server:7.0.0.7 cpe:/a:ibm:websphere_application_server:7.0.0.8 cpe:/a:ibm:websphere_application_server:7.0.0.9 cpe:/a:ibm:websphere_application_server:7.0.0.10 cpe:/a:ibm:websphere_application_server:7.0.0.11 cpe:/a:ibm:websphere_application_server:7.0.0.12 cpe:/a:ibm:websphere_application_server:7.0.0.13 cpe:/a:ibm:websphere_application_server:7.0.0.14 cpe:/a:ibm:websphere_application_server:7.0.0.15 cpe:/a:ibm:websphere_application_server:7.0.0.16 cpe:/a:ibm:websphere_application_server:7.0.0.17 cpe:/a:ibm:websphere_application_server:7.0.0.18 cpe:/a:ibm:websphere_application_server:7.0.0.19 cpe:/a:ibm:websphere_application_server:7.0.0.21 cpe:/a:ibm:websphere_application_server:7.0.0.22 cpe:/a:ibm:websphere_application_server:7.0.0.23 cpe:/a:ibm:websphere_application_server:7.0.0.24 cpe:/a:ibm:websphere_application_server:7.0.0.25 cpe:/a:ibm:websphere_application_server:7.0.0.27 cpe:/a:ibm:websphere_application_server:7.0.0.28 cpe:/a:ibm:websphere_application_server:7.0.0.29 cpe:/a:ibm:websphere_application_server:7.0.0.31 cpe:/a:ibm:websphere_application_server:7.0.0.32 cpe:/a:ibm:websphere_application_server:7.0.0.33 cpe:/a:ibm:websphere_application_server:7.0.0.34 cpe:/a:ibm:websphere_application_server:7.0.0.35 cpe:/a:ibm:websphere_application_server:7.0.0.36 cpe:/a:ibm:websphere_application_server:7.0.0.37 cpe:/a:ibm:websphere_application_server:7.0.0.38 cpe:/a:ibm:websphere_application_server:7.0.0.39 cpe:/a:ibm:websphere_application_server:7.0.0.41 cpe:/a:ibm:websphere_application_server:8.0 cpe:/a:ibm:websphere_application_server:8.0.0.0 cpe:/a:ibm:websphere_application_server:8.0.0.1 cpe:/a:ibm:websphere_application_server:8.0.0.2 cpe:/a:ibm:websphere_application_server:8.0.0.3 cpe:/a:ibm:websphere_application_server:8.0.0.4 cpe:/a:ibm:websphere_application_server:8.0.0.5 cpe:/a:ibm:websphere_application_server:8.0.0.6 cpe:/a:ibm:websphere_application_server:8.0.0.7 cpe:/a:ibm:websphere_application_server:8.0.0.8 cpe:/a:ibm:websphere_application_server:8.0.0.9 cpe:/a:ibm:websphere_application_server:8.0.0.10 cpe:/a:ibm:websphere_application_server:8.0.0.11 cpe:/a:ibm:websphere_application_server:8.0.0.12 cpe:/a:ibm:websphere_application_server:8.5.0.0 cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.5.1:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.5.2:-:liberty_profile cpe:/a:ibm:websphere_application_server:8.5.5.4 cpe:/a:ibm:websphere_application_server:8.5.5.5 cpe:/a:ibm:websphere_application_server:8.5.5.6 cpe:/a:ibm:websphere_application_server:8.5.5.7 cpe:/a:ibm:websphere_application_server:8.5.5.8 cpe:/a:ibm:websphere_application_server:8.5.5.9 cpe:/a:ibm:websphere_application_server:9.0.0.0

CVE-2016-0385

2016-09-01T06:59:00.140-04:00

2017-08-15T21:29:04.197-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BID 92505 SECTRACK 1036654 AIXAPAR PI60026 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982588 Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.

CVE-2016-0386

2016-07-02T10:59:00.147-04:00

2016-07-06T07:52:08.823-04:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-07-05T12:57:57.000-04:00

AIXAPAR IV83657 Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to hijack the authentication of administrators for requests that delete employees.

cpe:/a:ibm:tririga_application_platform:3.3.0.0 cpe:/a:ibm:tririga_application_platform:3.3.0.1 cpe:/a:ibm:tririga_application_platform:3.3.1.0 cpe:/a:ibm:tririga_application_platform:3.3.1.1 cpe:/a:ibm:tririga_application_platform:3.3.1.2 cpe:/a:ibm:tririga_application_platform:3.3.2.0 cpe:/a:ibm:tririga_application_platform:3.3.2.1 cpe:/a:ibm:tririga_application_platform:3.3.2.2 cpe:/a:ibm:tririga_application_platform:3.3.2.3 cpe:/a:ibm:tririga_application_platform:3.3.2.4 cpe:/a:ibm:tririga_application_platform:3.3.2.5 cpe:/a:ibm:tririga_application_platform:3.4.0.0 cpe:/a:ibm:tririga_application_platform:3.4.0.1 cpe:/a:ibm:tririga_application_platform:3.4.1.0 cpe:/a:ibm:tririga_application_platform:3.4.1.1 cpe:/a:ibm:tririga_application_platform:3.4.1.2 cpe:/a:ibm:tririga_application_platform:3.4.1.3 cpe:/a:ibm:tririga_application_platform:3.4.2.0 cpe:/a:ibm:tririga_application_platform:3.4.2.1 cpe:/a:ibm:tririga_application_platform:3.4.2.2 cpe:/a:ibm:tririga_application_platform:3.4.2.3 cpe:/a:ibm:tririga_application_platform:3.5.0.0 cpe:/a:ibm:tririga_application_platform:3.5.0.1

CVE-2016-0387

2016-07-02T10:59:01.240-04:00

2016-11-28T14:53:28.903-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981740 Cross-site scripting (XSS) vulnerability in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-2883.

cpe:/a:ibm:websphere_application_server:8.5.5.2::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.3::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.4::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.5::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.6::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.7::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.8::~~liberty~~~ cpe:/a:ibm:websphere_application_server:8.5.5.9::~~liberty~~~

CVE-2016-0389

2016-07-07T10:59:01.830-04:00

2016-11-28T14:53:30.933-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91515 AIXAPAR PI62052 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982012 Admin Center in IBM WebSphere Application Server (WAS) 8.5.5.2 through 8.5.5.9 Liberty before Liberty Fix Pack 16.0.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.

cpe:/a:ibm:algo_one:4.9.1 cpe:/a:ibm:algo_one:5.0.0 cpe:/a:ibm:algo_one:5.1.0

CVE-2016-0390

2016-05-14T21:59:02.847-04:00

2016-05-16T10:05:41.690-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-16T09:24:09.670-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21981321 Cross-site scripting (XSS) vulnerability in IBM Algorithmics Algo One Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:watson_developer_cloud:-

CVE-2016-0391

2016-07-02T10:59:02.257-04:00

2016-07-07T14:03:42.233-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-07-07T11:39:36.390-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21982615 The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

cpe:/a:ibm:elastic_storage_server:2.5.0 cpe:/a:ibm:elastic_storage_server:2.5.1 cpe:/a:ibm:elastic_storage_server:2.5.2 cpe:/a:ibm:elastic_storage_server:2.5.3 cpe:/a:ibm:elastic_storage_server:2.5.4 cpe:/a:ibm:elastic_storage_server:2.5.5 cpe:/a:ibm:elastic_storage_server:3.0.0 cpe:/a:ibm:elastic_storage_server:3.0.1 cpe:/a:ibm:elastic_storage_server:3.0.2 cpe:/a:ibm:elastic_storage_server:3.0.3 cpe:/a:ibm:elastic_storage_server:3.0.4 cpe:/a:ibm:elastic_storage_server:3.0.5 cpe:/a:ibm:elastic_storage_server:3.5.0 cpe:/a:ibm:elastic_storage_server:3.5.1 cpe:/a:ibm:elastic_storage_server:3.5.2 cpe:/a:ibm:elastic_storage_server:3.5.3 cpe:/a:ibm:elastic_storage_server:3.5.4 cpe:/a:ibm:elastic_storage_server:4.0.0 cpe:/a:ibm:elastic_storage_server:4.0.1 cpe:/a:ibm:elastic_storage_server:4.0.2 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.0 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.1 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.2 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.3 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.4 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.5 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.6 cpe:/a:ibm:general_parallel_file_system_storage_server:2.0.7

CVE-2016-0392

2016-06-19T16:59:02.160-04:00

2018-10-09T15:58:42.223-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/137373/IBM-GPFS-Spectrum-Scale-Command-Injection.html BUGTRAQ 20160607 [CVE-2016-0392] IBM GPFS / Spectrum Scale Command Injection BID 91082 SECTRACK 1036458 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1005875 AIXAPAR IV84206 IBM General Parallel File System (GPFS) in GPFS Storage Server 2.0.0 through 2.0.7 and Elastic Storage Server 2.5.x through 2.5.5, 3.x before 3.5.5, and 4.x before 4.0.3, as distributed in Spectrum Scale RAID, allows local users to gain privileges via a crafted parameter to a setuid program.

cpe:/a:ibm:maximo_asset_management:7.5.0.0 cpe:/a:ibm:maximo_asset_management:7.5.0.1 cpe:/a:ibm:maximo_asset_management:7.5.0.2 cpe:/a:ibm:maximo_asset_management:7.5.0.3 cpe:/a:ibm:maximo_asset_management:7.5.0.4 cpe:/a:ibm:maximo_asset_management:7.5.0.5 cpe:/a:ibm:maximo_asset_management:7.5.0.6 cpe:/a:ibm:maximo_asset_management:7.5.0.7 cpe:/a:ibm:maximo_asset_management:7.5.0.8 cpe:/a:ibm:maximo_asset_management:7.5.0.9 cpe:/a:ibm:maximo_asset_management:7.5.0.10 cpe:/a:ibm:maximo_asset_management:7.6.0.0 cpe:/a:ibm:maximo_asset_management:7.6.0.1 cpe:/a:ibm:maximo_asset_management:7.6.0.2 cpe:/a:ibm:maximo_asset_management:7.6.0.3 cpe:/a:ibm:maximo_asset_management:7.6.0.4 cpe:/a:ibm:maximo_asset_management:7.6.0.5

CVE-2016-0393

2016-07-17T18:59:01.193-04:00

2016-11-28T14:53:33.120-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91744 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21986053 IBM Maximo Asset Management 7.5 before 7.5.0.10-TIV-MBS-IFIX002 and 7.6 before 7.6.0.5-TIV-MAMMT-FP001 allows remote attackers to obtain sensitive URL information by reading log files.

cpe:/a:ibm:integration_bus:9.0 cpe:/a:ibm:integration_bus:9.0.0.1 cpe:/a:ibm:integration_bus:9.0.0.2 cpe:/a:ibm:integration_bus:10.0 cpe:/a:ibm:websphere_message_broker:8.0 cpe:/a:ibm:websphere_message_broker:8.0.0.1 cpe:/a:ibm:websphere_message_broker:8.0.0.2 cpe:/a:ibm:websphere_message_broker:8.0.0.3 cpe:/a:ibm:websphere_message_broker:8.0.0.4 cpe:/a:ibm:websphere_message_broker:8.0.0.5

CVE-2016-0394

2017-02-01T15:59:00.237-05:00

2017-02-07T14:43:51.037-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-07T14:43:24.193-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21985013 BID 94577 IBM Integration Bus and WebSphere Message broker sets incorrect permissions for an object that could allow a local attacker to manipulate certain files.

cpe:/a:ibm:bigfix_platform:9.0 cpe:/a:ibm:bigfix_platform:9.1 cpe:/a:ibm:bigfix_platform:9.2 cpe:/a:ibm:bigfix_platform:9.5

CVE-2016-0396

2017-02-01T15:59:00.270-05:00

2017-02-07T14:44:44.900-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-02-03T13:52:31.937-05:00

CONFIRM http://www.ibm.com/support/docview.wss?uid=swg21993206 BID 94155 IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than expected.

cpe:/a:ibm:bigfix_webreports:9.0 cpe:/a:ibm:bigfix_webreports:9.1 cpe:/a:ibm:bigfix_webreports:9.2 cpe:/a:ibm:bigfix_webreports:9.5

CVE-2016-0397

2016-08-30T13:59:01.317-04:00

2016-11-28T14:53:34.277-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92467 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21985907 WebReports in IBM BigFix Platform (formerly Tivoli Endpoint Manager) 9.x before 9.5.2 allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic.

cpe:/a:ibm:cognos_analytics:11.0.0

CVE-2016-0398

2016-07-02T10:59:03.273-04:00

2016-07-05T19:51:09.397-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-05T14:48:40.883-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21977070 IBM Cognos Analytics (CA) 11.0 before 11.0.2 allows remote attackers to conduct content-spoofing attacks via a crafted URL.

cpe:/a:ibm:maximo_asset_management:7.1 cpe:/a:ibm:maximo_asset_management:7.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.1 cpe:/a:ibm:maximo_asset_management:7.1.1.2 cpe:/a:ibm:maximo_asset_management:7.1.1.3 cpe:/a:ibm:maximo_asset_management:7.1.1.5 cpe:/a:ibm:maximo_asset_management:7.1.1.6 cpe:/a:ibm:maximo_asset_management:7.1.1.7 cpe:/a:ibm:maximo_asset_management:7.1.1.8 cpe:/a:ibm:maximo_asset_management:7.1.1.9 cpe:/a:ibm:maximo_asset_management:7.1.1.10 cpe:/a:ibm:maximo_asset_management:7.1.1.11 cpe:/a:ibm:maximo_asset_management:7.1.1.12 cpe:/a:ibm:maximo_asset_management:7.1.1.13 cpe:/a:ibm:maximo_asset_management:7.1.2 cpe:/a:ibm:maximo_asset_management:7.5.0.0 cpe:/a:ibm:maximo_asset_management:7.5.0.1 cpe:/a:ibm:maximo_asset_management:7.5.0.2 cpe:/a:ibm:maximo_asset_management:7.5.0.3 cpe:/a:ibm:maximo_asset_management:7.5.0.4 cpe:/a:ibm:maximo_asset_management:7.5.0.5 cpe:/a:ibm:maximo_asset_management:7.5.0.6 cpe:/a:ibm:maximo_asset_management:7.5.0.7 cpe:/a:ibm:maximo_asset_management:7.5.0.8 cpe:/a:ibm:maximo_asset_management:7.5.0.9 cpe:/a:ibm:maximo_asset_management:7.5.0.10 cpe:/a:ibm:maximo_asset_management:7.6.0.4 cpe:/a:ibm:maximo_asset_management:7.6.0.5

CVE-2016-0399

2016-07-02T10:59:04.193-04:00

2016-07-06T07:30:27.157-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-07-05T13:05:03.890-04:00

CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21984134 Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5 before 7.5.0.9 IFIX007, and 7.6 before 7.6.0.5 FP005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

cpe:/a:ibm:websphere_extreme_scale:7.1.0 cpe:/a:ibm:websphere_extreme_scale:7.1.0.2 cpe:/a:ibm:websphere_extreme_scale:7.1.1 cpe:/a:ibm:websphere_extreme_scale:8.5.0 cpe:/a:ibm:websphere_extreme_scale:8.5.0.1 cpe:/a:ibm:websphere_extreme_scale:8.5.0.2 cpe:/a:ibm:websphere_extreme_scale:8.6.0.0 cpe:/a:ibm:websphere_extreme_scale:8.6.0.1 cpe:/a:ibm:websphere_extreme_scale:8.6.0.2 cpe:/a:ibm:websphere_extreme_scale:8.6.0.3 cpe:/a:ibm:websphere_extreme_scale:8.6.0.4 cpe:/a:ibm:websphere_extreme_scale:8.6.0.5 cpe:/a:ibm:websphere_extreme_scale:8.6.0.6 cpe:/a:ibm:websphere_extreme_scale:8.6.0.7

CVE-2016-0400

2016-07-02T10:59:05.197-04:00

2017-09-02T21:29:02.890-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov AIXAPAR PI60897 AIXAPAR PI60898 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=swg21983036 EXPLOIT-DB 40039 CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.9

CVE-2016-0401

2016-01-20T21:59:13.047-05:00

2017-09-09T21:29:05.810-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect integrity via unknown vectors related to Scheduler, a different vulnerability than CVE-2016-0429.

cpe:/a:oracle:jdk:1.6.0:update_105 cpe:/a:oracle:jdk:1.7.0:update_91 cpe:/a:oracle:jdk:1.8.0:update_66 cpe:/a:oracle:jre:1.6.0:update_105 cpe:/a:oracle:jre:1.7.0:update_91 cpe:/a:oracle:jre:1.8.0:update_66 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10

CVE-2016-0402

2016-01-20T21:59:14.050-05:00

2017-06-30T21:29:29.907-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 SUSE openSUSE-SU-2016:0263 SUSE SUSE-SU-2016:0265 SUSE openSUSE-SU-2016:0268 SUSE SUSE-SU-2016:0269 SUSE openSUSE-SU-2016:0270 SUSE openSUSE-SU-2016:0272 SUSE openSUSE-SU-2016:0279 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0053 REDHAT RHSA-2016:0054 REDHAT RHSA-2016:0055 REDHAT RHSA-2016:0056 REDHAT RHSA-2016:0057 REDHAT RHSA-2016:0067 DEBIAN DSA-3458 DEBIAN DSA-3465 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 81096 SECTRACK 1034715 UBUNTU USN-2884-1 UBUNTU USN-2885-1 REDHAT RHSA-2016:1430 GENTOO GLSA-201603-14 GENTOO GLSA-201610-08 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.

cpe:/o:oracle:solaris:11

CVE-2016-0403

2016-01-20T21:59:14.970-05:00

2016-12-07T13:30:27.537-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to SMB Utilities.

cpe:/a:oracle:fusion_middleware:11.1.2.2

CVE-2016-0404

2016-01-20T21:59:15.893-05:00

2017-09-09T21:29:05.857-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.2.2 allows remote attackers to affect integrity via vectors related to Admin.

cpe:/a:oracle:oracle_and_sun_systems_product_suite:3.3 cpe:/a:oracle:oracle_and_sun_systems_product_suite:4.0

CVE-2016-0405

2016-01-20T21:59:17.050-05:00

2016-12-07T13:30:28.487-05:00

1.7

LOCAL

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect confidentiality via vectors related to Cluster Manageability and Serviceability.

cpe:/o:oracle:solaris:11

CVE-2016-0406

2016-01-20T21:59:18.017-05:00

2016-12-07T13:30:29.410-05:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via vectors related to Libc.

cpe:/a:oracle:peoplesoft_enterprise_human_capital_management_human_resources:9.1 cpe:/a:oracle:peoplesoft_enterprise_human_capital_management_human_resources:9.2

CVE-2016-0407

2016-04-21T06:59:02.600-04:00

2016-12-02T22:16:18.850-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0408

2016-04-21T06:59:03.740-04:00

2016-12-02T22:16:19.880-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 through 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to the Activity Guide sub-component.

cpe:/a:oracle:peoplesoft_products:9.1 cpe:/a:oracle:peoplesoft_products:9.2

CVE-2016-0409

2016-01-20T21:59:19.067-05:00

2016-06-09T14:20:43.393-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:39:47.347-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Security.

CVE-2016-0410

2017-05-11T10:29:56.467-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4

CVE-2016-0411

2016-01-20T21:59:20.097-05:00

2016-12-07T13:30:30.347-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1 and 11.2.0.4 allows local users to affect confidentiality, integrity, and availability via vectors related to Agent Next Gen.

cpe:/a:oracle:peoplesoft_supply_chain_management_eprocurement:9.1 cpe:/a:oracle:peoplesoft_supply_chain_management_eprocurement:9.2

CVE-2016-0412

2016-01-20T21:59:21.127-05:00

2016-06-09T14:20:12.923-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:39:59.957-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise SCM eProcurement component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect integrity via unknown vectors related to Manage Requisition Status.

cpe:/a:oracle:fusion_middleware:11.1.1.7

CVE-2016-0413

2016-01-20T21:59:22.267-05:00

2017-09-09T21:29:05.903-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle Identity Federation component in Oracle Fusion Middleware 11.1.1.7 allows remote authenticated users to affect integrity via vectors related to Federation protocol support.

cpe:/o:oracle:solaris:11

CVE-2016-0414

2016-01-20T21:59:23.237-05:00

2016-12-07T13:30:31.287-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0418.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0415

2016-01-20T21:59:24.267-05:00

2016-12-07T13:30:32.207-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to UI Framework.

cpe:/o:oracle:solaris:11

CVE-2016-0416

2016-01-20T21:59:25.207-05:00

2016-12-07T13:30:33.083-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:solaris_cluster:3.3 cpe:/a:oracle:solaris_cluster:4.2

CVE-2016-0417

2016-01-20T21:59:26.160-05:00

2016-12-07T13:30:34.177-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.2 allows local users to affect confidentiality, integrity, and availability via vectors related to HA for MySQL.

cpe:/o:oracle:solaris:11

CVE-2016-0418

2016-01-20T21:59:27.567-05:00

2016-12-07T13:30:35.083-05:00

6.1

LOCAL

LOW

NONE

PARTIAL

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0414.

cpe:/o:oracle:solaris:11

CVE-2016-0419

2016-01-20T21:59:28.567-05:00

2016-12-07T13:30:36.007-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0431.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0420

2016-01-20T21:59:29.503-05:00

2018-02-19T21:29:00.683-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138509/JD-Edwards-9.1-EnterpriseOne-Server-Create-Users.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-011: JD Edwards Server Manager Create users CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 MISC https://www.onapsis.com/research/security-advisories/jd-edwards-server-manager-create-user Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via unknown vectors related to Monitoring and Diagnostics.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0421

2016-01-20T21:59:30.520-05:00

2018-02-19T21:29:00.777-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138508/JD-Edwards-9.1-EnterpriseOne-Server-Manager-Shutdown.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-010: JD Edwards Server Manager Shutdown CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 MISC https://www.onapsis.com/research/security-advisories/jd-edwards-server-manager-shutdown Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Monitoring and Diagnostics SEC.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0422

2016-01-20T21:59:31.393-05:00

2018-02-19T21:29:00.857-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138507/JD-Edwards-9.1-EnterpriseOne-Server-JDENet-Password-Disclosure.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-009: JD Edwards JDENet Password Disclosure CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 MISC https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-password-disclosure Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0424.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0423

2016-01-20T21:59:32.520-05:00

2018-02-19T21:29:00.933-05:00

7.3

NETWORK

HIGH

NONE

COMPLETE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138512/JD-Edwards-9.1-EnterpriseOne-Server-JDENET-Denial-Of-Service.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-014: JD Edwards JDENET function DoS CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 MISC https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-end-file-dos Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Enterprise Infrastructure SEC.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0424

2016-01-20T21:59:33.567-05:00

2018-02-19T21:29:01.027-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138510/JD-Edwards-9.1-EnterpriseOne-Server-Denial-Of-Service.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-012: JD Edwards JDENET function DoS CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 MISC https://www.onapsis.com/research/security-advisories/jd-edwards-jdenet-type-8-dos Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect availability via vectors related to Enterprise Infrastructure SEC, a different vulnerability than CVE-2016-0422.

cpe:/a:oracle:jd_edwards_products:9.1 cpe:/a:oracle:jd_edwards_products:9.2

CVE-2016-0425

2016-01-20T21:59:34.597-05:00

2018-02-19T21:29:01.107-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/138511/JD-Edwards-9.1-EnterpriseOne-Server-Password-Disclosure.html FULLDISC 20160825 Onapsis Security Advisory ONAPSIS-2016-00171: JD Edwards Server Manager Password Disclosure CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034722 Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Monitoring and Diagnostics.

cpe:/o:oracle:solaris:11

CVE-2016-0426

2016-01-20T21:59:35.457-05:00

2016-12-07T13:30:42.723-05:00

3.6

LOCAL

LOW

NONE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality and availability via unknown vectors related to Solaris Kernel Zones.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.4.0.2 cpe:/a:oracle:enterprise_manager_grid_control:12.5.0.2

CVE-2016-0427

2016-01-20T21:59:36.393-05:00

2016-12-07T13:30:43.663-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Framework.

cpe:/o:oracle:solaris:11

CVE-2016-0428

2016-01-20T21:59:37.690-05:00

2016-12-07T13:30:44.630-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Verified Boot.

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.9

CVE-2016-0429

2016-01-20T21:59:38.630-05:00

2017-09-09T21:29:05.950-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.9

CVE-2016-0430

2016-01-20T21:59:39.503-05:00

2017-09-09T21:29:05.997-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 and 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support, a different vulnerability than CVE-2016-0439.

cpe:/o:oracle:solaris:11

CVE-2016-0431

2016-01-20T21:59:40.380-05:00

2016-12-07T13:30:45.820-05:00

1.2

LOCAL

HIGH

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2016-0419.

cpe:/a:oracle:fusion_middleware:8.5.0 cpe:/a:oracle:fusion_middleware:8.5.1 cpe:/a:oracle:fusion_middleware:8.5.2

CVE-2016-0432

2016-01-20T21:59:41.240-05:00

2017-09-09T21:29:06.043-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6014, and CVE-2015-6015.

cpe:/a:oracle:fusion_middleware:11.1.1.9

CVE-2016-0433

2016-01-20T21:59:42.317-05:00

2017-09-09T21:29:06.090-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.9.0 allows remote attackers to affect confidentiality via vectors related to SSL support.

cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0 cpe:/a:oracle:retail_applications:14.1

CVE-2016-0434

2016-01-20T21:59:43.240-05:00

2016-06-09T14:19:59.060-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:40:20.490-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034718 Unspecified vulnerability in the Oracle Retail Point-of-Service component in Oracle Retail Applications 13.4, 14.0, and 14.1 allows local users to affect confidentiality via vectors related to Mobile POS, a different vulnerability than CVE-2016-0436, CVE-2016-0437, and CVE-2016-0438.

cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0 cpe:/a:oracle:retail_applications:14.1

CVE-2016-0435

2016-01-20T21:59:44.270-05:00

2016-06-09T14:20:28.707-04:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:40:28.867-04:00

cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0 cpe:/a:oracle:retail_applications:14.1

CVE-2016-0436

2016-01-20T21:59:45.287-05:00

2016-06-09T14:21:32.273-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:40:35.740-04:00

cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0 cpe:/a:oracle:retail_applications:14.1

CVE-2016-0437

2016-01-20T21:59:46.240-05:00

2016-06-09T14:21:02.927-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T12:40:47.930-04:00

cpe:/a:oracle:retail_applications:13.4 cpe:/a:oracle:retail_applications:14.0 cpe:/a:oracle:retail_applications:14.1

CVE-2016-0438

2016-01-20T21:59:47.443-05:00

2016-06-08T11:09:25.653-04:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:49:11.607-04:00

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.9

CVE-2016-0439

2016-01-20T21:59:48.490-05:00

2017-09-09T21:29:06.137-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/o:oracle:solaris:11

CVE-2016-0440

2016-01-20T21:59:49.520-05:00

2016-12-07T18:43:46.257-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T17:30:00.557-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect availability via vectors related to NFSv4.

cpe:/a:oracle:fusion_middleware:3.1.2

CVE-2016-0441

2016-01-20T21:59:50.380-05:00

2016-06-08T11:10:16.550-04:00

6.8

NETWORK

HIGH

SINGLE_INSTANCE

COMPLETE

PARTIAL

http://nvd.nist.gov

2016-06-08T10:49:45.097-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034712 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Embedded Server.

cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0442

2016-01-20T21:59:51.287-05:00

2016-12-07T13:30:48.273-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Loader Service.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0443

2016-01-20T21:59:52.457-05:00

2016-12-07T13:30:49.287-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 12.1.0.4, and 12.1.0.5 allows remote attackers to affect confidentiality via unknown vectors related to Agent Next Gen.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0444

2016-01-20T21:59:53.333-05:00

2016-12-07T13:30:50.320-05:00

4.4

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0447 and CVE-2016-0449.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0445

2016-01-20T21:59:54.317-05:00

2016-12-07T13:30:51.413-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0446

2016-01-20T21:59:55.287-05:00

2016-12-07T13:30:52.430-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality via unknown vectors related to Agent Next Gen.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0447

2016-01-20T21:59:56.240-05:00

2016-12-07T13:30:53.537-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0449.

cpe:/a:oracle:jdk:1.6.0:update_105 cpe:/a:oracle:jdk:1.7.0:update_91 cpe:/a:oracle:jdk:1.8.0:update_66 cpe:/a:oracle:jre:1.6.0:update_105 cpe:/a:oracle:jre:1.8.0:update_66 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10

CVE-2016-0448

2016-01-20T21:59:57.380-05:00

2017-06-30T21:29:29.967-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 SUSE openSUSE-SU-2016:0263 SUSE SUSE-SU-2016:0265 SUSE openSUSE-SU-2016:0268 SUSE SUSE-SU-2016:0269 SUSE openSUSE-SU-2016:0270 SUSE openSUSE-SU-2016:0272 SUSE openSUSE-SU-2016:0279 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0053 REDHAT RHSA-2016:0054 REDHAT RHSA-2016:0055 REDHAT RHSA-2016:0056 REDHAT RHSA-2016:0057 REDHAT RHSA-2016:0067 DEBIAN DSA-3458 DEBIAN DSA-3465 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 81123 SECTRACK 1034715 UBUNTU USN-2884-1 UBUNTU USN-2885-1 REDHAT RHSA-2016:1430 GENTOO GLSA-201603-14 GENTOO GLSA-201610-08 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0449

2016-01-20T21:59:58.240-05:00

2016-12-07T13:30:55.913-05:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Agent Next Gen, a different vulnerability than CVE-2016-0444 and CVE-2016-0447.

cpe:/a:oracle:goldengate:11.2 cpe:/a:oracle:goldengate:12.1.2

CVE-2016-0450

2016-01-20T21:59:59.303-05:00

2017-01-03T14:40:33.417-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-01-03T12:40:44.637-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81117 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-021 MISC https://redr2e.com/cve-to-poc-cve-2016-0450/ Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect availability via unknown vectors.

cpe:/a:oracle:goldengate:11.2 cpe:/a:oracle:goldengate:12.1.2

CVE-2016-0451

2016-01-20T22:00:00.227-05:00

2017-01-03T14:46:46.317-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2017-01-03T12:59:43.607-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81125 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-022 MISC https://redr2e.com/cve-to-poc-cve-2016-0451/ Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0452.

cpe:/a:oracle:goldengate:11.2 cpe:/a:oracle:goldengate:12.1.2

CVE-2016-0452

2016-01-20T22:00:01.413-05:00

2016-12-07T17:19:12.273-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T17:09:07.653-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81122 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-023 Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0451.

cpe:/a:oracle:fusion_middleware:3.1.2

CVE-2016-0453

2016-01-20T22:00:02.570-05:00

2016-06-08T11:11:35.780-04:00

1.8

ADJACENT_NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:49:51.833-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034712 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.1.2 allows remote attackers to affect integrity via unknown vectors related to Embedded Server.

cpe:/a:oracle:e-business_suite:12.1 cpe:/a:oracle:e-business_suite:12.2

CVE-2016-0454

2016-01-20T22:00:03.570-05:00

2017-09-09T21:29:06.183-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Mobile Application Servlet component in Oracle E-Business Suite 12.1 and 12.2 allows local users to affect confidentiality via vectors related to MWA Server Manager.

cpe:/a:oracle:enterprise_manager_grid_control:11.1.0.1 cpe:/a:oracle:enterprise_manager_grid_control:11.2.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.4 cpe:/a:oracle:enterprise_manager_grid_control:12.1.0.5

CVE-2016-0455

2016-01-20T22:00:04.523-05:00

2016-12-07T13:31:00.103-05:00

5.2

LOCAL

LOW

SINGLE_INSTANCE

COMPLETE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034734 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 11.1.0.1, 11.2.0.4, 12.1.0.4, and 12.1.0.5 allows local users to affect confidentiality and availability via unknown vectors related to Agent Next Gen.

cpe:/a:oracle:e-business_suite:12.1 cpe:/a:oracle:e-business_suite:12.2

CVE-2016-0456

2016-01-20T22:00:05.663-05:00

2018-12-10T14:29:13.937-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 MISC https://erpscan.io/advisories/erpscan-16-006-oracle-e-business-suite-xxe-injection-vulnerability/ Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0457. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/copxmllcmservicecontroller.js.

cpe:/a:oracle:e-business_suite:12.1 cpe:/a:oracle:e-business_suite:12.2

CVE-2016-0457

2016-01-20T22:00:06.943-05:00

2018-12-10T14:29:14.360-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 MISC https://erpscan.io/advisories/erpscan-16-007-oracle-e-business-suite-xxe-injection-vulnerability/ Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.

cpe:/o:oracle:solaris:11

CVE-2016-0458

2016-01-20T22:00:07.867-05:00

2016-12-07T17:19:08.350-05:00

4.0

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T17:10:44.183-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via vectors related to Kernel DAX.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.1.3 cpe:/a:oracle:e-business_suite:12.2.3 cpe:/a:oracle:e-business_suite:12.2.4 cpe:/a:oracle:e-business_suite:12.2.5

CVE-2016-0459

2016-01-20T22:00:08.867-05:00

2017-09-09T21:29:06.373-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect integrity via unknown vectors related to Popup Windows.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0460

2016-01-20T22:00:09.897-05:00

2016-06-08T12:30:24.447-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:49:18.813-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.55 allows remote attackers to affect integrity via unknown vectors related to Fluid Homepage and NavBar.

cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1 cpe:/a:oracle:database_server:12.1.0.2

CVE-2016-0461

2016-01-20T22:00:10.867-05:00

2016-12-07T18:42:49.217-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T17:11:01.763-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034709 Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect availability via unknown vectors.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54

CVE-2016-0462

2016-01-20T22:00:11.883-05:00

2016-08-30T13:28:10.987-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-08-30T08:29:02.617-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via unknown vectors related to Multichannel Framework, a different vulnerability than CVE-2015-2650.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0463

2016-01-20T22:00:12.930-05:00

2016-06-08T11:13:26.310-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:45:29.517-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality via unknown vectors related to Portal.

cpe:/a:oracle:fusion_middleware:10.3.6 cpe:/a:oracle:fusion_middleware:12.1.2.0 cpe:/a:oracle:fusion_middleware:12.1.3.0

CVE-2016-0464

2016-01-20T22:00:13.897-05:00

2017-09-09T21:29:06.420-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81185 SECTRACK 1034716 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to WLS-Console.

cpe:/a:oracle:oracle_and_sun_systems_product_suite:3.3 cpe:/a:oracle:oracle_and_sun_systems_product_suite:4.0

CVE-2016-0465

2016-01-20T22:00:15.007-05:00

2016-12-07T13:31:03.867-05:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4 allows local users to affect availability via unknown vectors related to Resource Group Manager.

CVE-2016-0466

2016-01-20T22:00:15.977-05:00

2017-06-30T21:29:30.030-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 SUSE openSUSE-SU-2016:0263 SUSE SUSE-SU-2016:0265 SUSE openSUSE-SU-2016:0268 SUSE SUSE-SU-2016:0269 SUSE openSUSE-SU-2016:0270 SUSE openSUSE-SU-2016:0272 SUSE openSUSE-SU-2016:0279 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0053 REDHAT RHSA-2016:0054 REDHAT RHSA-2016:0055 REDHAT RHSA-2016:0056 REDHAT RHSA-2016:0057 REDHAT RHSA-2016:0067 DEBIAN DSA-3458 DEBIAN DSA-3465 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 81118 SECTRACK 1034715 UBUNTU USN-2884-1 UBUNTU USN-2885-1 REDHAT RHSA-2016:1430 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10148 GENTOO GLSA-201603-14 GENTOO GLSA-201610-08 Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect availability via vectors related to JAXP.

cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1 cpe:/a:oracle:database_server:12.1.0.2

CVE-2016-0467

2016-01-20T22:00:17.023-05:00

2016-12-07T13:31:06.073-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034709 Unspecified vulnerability in the Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors.

cpe:/a:oracle:business_intelligence:11.1.1.7.0::~~enterprise~~~ cpe:/a:oracle:business_intelligence:11.1.1.9.0::~~enterprise~~~ cpe:/a:oracle:business_intelligence:12.2.1.0.0::~~enterprise~~~

CVE-2016-0468

2016-04-21T06:59:04.677-04:00

2016-12-02T22:16:23.320-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035618 Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to Analytics Web General.

cpe:/a:oracle:micros_c2:9.89.0.0

CVE-2016-0469

2016-04-21T06:59:05.523-04:00

2016-12-02T22:16:24.383-05:00

4.6

LOCAL

LOW

SINGLE_INSTANCE

COMPLETE

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035600 Unspecified vulnerability in the Oracle Retail MICROS C2 component in Oracle Retail Applications 9.89.0.0 allows local users to affect confidentiality via vectors related to POS.

cpe:/a:oracle:fusion_middleware:11.1.1.7.0 cpe:/a:oracle:fusion_middleware:11.1.1.9 cpe:/a:oracle:fusion_middleware:12.2.1

CVE-2016-0470

2016-01-20T22:00:17.897-05:00

2017-09-09T21:29:06.480-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to BI Publisher Security.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54

CVE-2016-0471

2016-01-20T22:00:19.757-05:00

2016-06-08T11:13:50.720-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:44:33.213-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via unknown vectors related to Multichannel Framework.

cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1 cpe:/a:oracle:database_server:12.1.0.2

CVE-2016-0472

2016-01-20T22:00:20.650-05:00

2016-12-07T13:31:07.103-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034709 Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality and availability via unknown vectors.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0473

2016-01-20T22:00:21.557-05:00

2016-06-08T11:15:37.030-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:44:52.200-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via unknown vectors related to Fluid Core.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0474

2016-01-20T22:00:22.603-05:00

2016-06-08T11:15:55.033-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:45:22.593-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology.

cpe:/a:oracle:jdk:1.8.0:update_66 cpe:/a:oracle:jre:1.8.0:update_66 cpe:/a:oracle:jrockit:r28.3.8

CVE-2016-0475

2016-01-20T22:00:23.570-05:00

2017-06-30T21:29:30.077-04:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0055 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html SECTRACK 1034715 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10148 GENTOO GLSA-201610-08 Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

cpe:/a:oracle:enterprise_manager_grid_control:12.4.0.2 cpe:/a:oracle:enterprise_manager_grid_control:12.5.0.2

CVE-2016-0476

2016-01-20T22:00:24.540-05:00

2016-12-07T13:31:09.243-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81199 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-045 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0477 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0477

2016-01-20T22:00:26.010-05:00

2016-12-07T13:31:10.463-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81153 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-041 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0478. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the (1) repository, (2) workspace, or (3) scenario parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0478

2016-01-20T22:00:27.273-05:00

2016-12-07T13:31:11.463-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81163 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-036 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0476 and CVE-2016-0477. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptName parameter.

cpe:/a:oracle:business_intelligence:11.1.1.7.0::~~enterprise~~~ cpe:/a:oracle:business_intelligence:11.1.1.9.0::~~enterprise~~~ cpe:/a:oracle:business_intelligence:12.2.1.0.0::~~enterprise~~~

CVE-2016-0479

2016-04-21T06:59:06.350-04:00

2016-12-02T22:16:25.553-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035618 Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality and integrity via vectors related to Analytics Scorecard.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0480

2016-01-20T22:00:28.243-05:00

2016-12-07T13:31:12.697-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81070 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-043 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0481, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the TMAPReportImage parameter.

cpe:/a:oracle:enterprise_manager_grid_control:12.4.0.2 cpe:/a:oracle:enterprise_manager_grid_control:12.5.0.2

CVE-2016-0481

2016-01-20T22:00:29.197-05:00

2016-12-07T13:31:13.807-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81097 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-044 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0482, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scheduleReportName parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0482

2016-01-20T22:00:30.353-05:00

2016-12-07T13:31:14.837-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81100 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-037 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0485, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.

cpe:/a:oracle:jdk:1.6.0:update_105 cpe:/a:oracle:jdk:1.7.0:update_91 cpe:/a:oracle:jdk:1.8.0:update_66 cpe:/a:oracle:jre:1.6.0:update_105 cpe:/a:oracle:jre:1.7.0:update_91 cpe:/a:oracle:jre:1.8.0:update_66 cpe:/a:oracle:jrockit:r28.3.8 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10

CVE-2016-0483

2016-01-20T22:00:31.307-05:00

2017-06-30T21:29:30.160-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 SUSE openSUSE-SU-2016:0263 SUSE SUSE-SU-2016:0265 SUSE openSUSE-SU-2016:0268 SUSE SUSE-SU-2016:0269 SUSE openSUSE-SU-2016:0270 SUSE openSUSE-SU-2016:0272 SUSE openSUSE-SU-2016:0279 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0053 REDHAT RHSA-2016:0054 REDHAT RHSA-2016:0055 REDHAT RHSA-2016:0056 REDHAT RHSA-2016:0057 REDHAT RHSA-2016:0067 DEBIAN DSA-3458 DEBIAN DSA-3465 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html SECTRACK 1034715 UBUNTU USN-2884-1 UBUNTU USN-2885-1 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-032 REDHAT RHSA-2016:1430 GENTOO GLSA-201603-14 GENTOO GLSA-201610-08 Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0484

2016-01-20T22:00:32.430-05:00

2016-12-07T13:31:16.997-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81102 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-034 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the scriptPath parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0485

2016-01-20T22:00:33.383-05:00

2016-12-22T09:37:24.600-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:41:52.353-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81105 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-046 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0486. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the reportName parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0486

2016-01-20T22:00:34.400-05:00

2016-12-22T09:22:11.647-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:38:04.710-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81107 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-040 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0480, CVE-2016-0481, CVE-2016-0482, and CVE-2016-0485. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the DownloadServlet servlet, which allows remote attackers to read arbitrary files via directory traversal sequences in the exportFileName parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0487

2016-01-20T22:00:35.383-05:00

2016-12-22T09:28:56.287-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:40:04.120-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81124 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-033 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0490. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the process method in the ActionServlet servlet, which allows remote attackers to bypass authentication via directory traversal sequences following an unspecified URI string.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0488

2016-01-20T22:00:36.353-05:00

2016-12-22T09:38:31.343-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:42:37.610-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81104 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-035 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0492. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function in the admin pages, which allows remote attackers to bypass authentication and gain administrator access via directory traversal sequences following a URI entry that does not require authentication.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0489

2016-01-20T22:00:37.540-05:00

2016-12-22T09:39:23.007-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:39:21.767-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81184 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-038 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Test Manager for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the ActionServlet servlet, which allows remote authenticated users to upload and execute arbitrary files via directory traversal sequences in the tempfilename parameter in a ReportImage action.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0490

2016-01-20T22:00:38.510-05:00

2016-12-22T09:38:11.357-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:42:07.293-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81173 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-039 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Test Manager for Web Apps, a different vulnerability than CVE-2016-0487. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the UploadServlet servlet, which allows remote attackers to upload and execute arbitrary files via directory traversal sequences in a filename header.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0491

2016-01-20T22:00:39.387-05:00

2016-12-22T09:38:46.987-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:44:20.157-05:00

MISC http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload BID 81169 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-047 EXPLOIT-DB 39691 EXPLOIT-DB 39852 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.

cpe:/a:oracle:application_testing_suite:12.4.0.2 cpe:/a:oracle:application_testing_suite:12.5.0.2

CVE-2016-0492

2016-01-20T22:00:40.353-05:00

2016-12-22T09:39:30.850-05:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:45:05.540-05:00

MISC http://packetstormsecurity.com/files/137175/Oracle-ATS-Arbitrary-File-Upload.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/oracle_ats_file_upload BID 81158 SECTRACK 1034734 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-042 EXPLOIT-DB 39691 EXPLOIT-DB 39852 Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.

cpe:/o:oracle:solaris:11

CVE-2016-0493

2016-01-20T22:00:41.323-05:00

2016-12-07T14:36:20.537-05:00

3.3

LOCAL

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T14:06:00.600-05:00

CVE-2016-0494

2016-01-20T22:00:42.463-05:00

2017-06-30T21:29:30.217-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0256 SUSE openSUSE-SU-2016:0263 SUSE SUSE-SU-2016:0265 SUSE openSUSE-SU-2016:0268 SUSE SUSE-SU-2016:0269 SUSE openSUSE-SU-2016:0270 SUSE openSUSE-SU-2016:0272 SUSE openSUSE-SU-2016:0279 REDHAT RHSA-2016:0049 REDHAT RHSA-2016:0050 REDHAT RHSA-2016:0053 REDHAT RHSA-2016:0054 REDHAT RHSA-2016:0055 REDHAT RHSA-2016:0056 REDHAT RHSA-2016:0057 REDHAT RHSA-2016:0067 DEBIAN DSA-3458 DEBIAN DSA-3465 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html SECTRACK 1034715 UBUNTU USN-2884-1 UBUNTU USN-2885-1 REDHAT RHSA-2016:1430 GENTOO GLSA-201603-14 GENTOO GLSA-201610-08 Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

cpe:/a:oracle:vm_virtualbox:4.0.0 cpe:/a:oracle:vm_virtualbox:4.0.2 cpe:/a:oracle:vm_virtualbox:4.0.4 cpe:/a:oracle:vm_virtualbox:4.0.6 cpe:/a:oracle:vm_virtualbox:4.0.8 cpe:/a:oracle:vm_virtualbox:4.0.10 cpe:/a:oracle:vm_virtualbox:4.0.12 cpe:/a:oracle:vm_virtualbox:4.0.14 cpe:/a:oracle:vm_virtualbox:4.0.16 cpe:/a:oracle:vm_virtualbox:4.0.18 cpe:/a:oracle:vm_virtualbox:4.0.20 cpe:/a:oracle:vm_virtualbox:4.0.22 cpe:/a:oracle:vm_virtualbox:4.0.24 cpe:/a:oracle:vm_virtualbox:4.0.26 cpe:/a:oracle:vm_virtualbox:4.0.31 cpe:/a:oracle:vm_virtualbox:4.0.32 cpe:/a:oracle:vm_virtualbox:4.0.34 cpe:/a:oracle:vm_virtualbox:4.0.36 cpe:/a:oracle:vm_virtualbox:4.1.0 cpe:/a:oracle:vm_virtualbox:4.1.2 cpe:/a:oracle:vm_virtualbox:4.1.4 cpe:/a:oracle:vm_virtualbox:4.1.6 cpe:/a:oracle:vm_virtualbox:4.1.8 cpe:/a:oracle:vm_virtualbox:4.1.10 cpe:/a:oracle:vm_virtualbox:4.1.12 cpe:/a:oracle:vm_virtualbox:4.1.14 cpe:/a:oracle:vm_virtualbox:4.1.16 cpe:/a:oracle:vm_virtualbox:4.1.18 cpe:/a:oracle:vm_virtualbox:4.1.20 cpe:/a:oracle:vm_virtualbox:4.1.22 cpe:/a:oracle:vm_virtualbox:4.1.24 cpe:/a:oracle:vm_virtualbox:4.1.26 cpe:/a:oracle:vm_virtualbox:4.1.28 cpe:/a:oracle:vm_virtualbox:4.1.30 cpe:/a:oracle:vm_virtualbox:4.1.32 cpe:/a:oracle:vm_virtualbox:4.1.34 cpe:/a:oracle:vm_virtualbox:4.1.39 cpe:/a:oracle:vm_virtualbox:4.1.40 cpe:/a:oracle:vm_virtualbox:4.1.42 cpe:/a:oracle:vm_virtualbox:4.1.44 cpe:/a:oracle:vm_virtualbox:4.2.0 cpe:/a:oracle:vm_virtualbox:4.2.2 cpe:/a:oracle:vm_virtualbox:4.2.4 cpe:/a:oracle:vm_virtualbox:4.2.6 cpe:/a:oracle:vm_virtualbox:4.2.8 cpe:/a:oracle:vm_virtualbox:4.2.10 cpe:/a:oracle:vm_virtualbox:4.2.12 cpe:/a:oracle:vm_virtualbox:4.2.14 cpe:/a:oracle:vm_virtualbox:4.2.16 cpe:/a:oracle:vm_virtualbox:4.2.18 cpe:/a:oracle:vm_virtualbox:4.2.20 cpe:/a:oracle:vm_virtualbox:4.2.22 cpe:/a:oracle:vm_virtualbox:4.2.24 cpe:/a:oracle:vm_virtualbox:4.2.26 cpe:/a:oracle:vm_virtualbox:4.2.28 cpe:/a:oracle:vm_virtualbox:4.2.30 cpe:/a:oracle:vm_virtualbox:4.2.31 cpe:/a:oracle:vm_virtualbox:4.2.32 cpe:/a:oracle:vm_virtualbox:4.2.34 cpe:/a:oracle:vm_virtualbox:4.2.36 cpe:/a:oracle:vm_virtualbox:4.3.0 cpe:/a:oracle:vm_virtualbox:4.3.2 cpe:/a:oracle:vm_virtualbox:4.3.4 cpe:/a:oracle:vm_virtualbox:4.3.6 cpe:/a:oracle:vm_virtualbox:4.3.8 cpe:/a:oracle:vm_virtualbox:4.3.10 cpe:/a:oracle:vm_virtualbox:4.3.12 cpe:/a:oracle:vm_virtualbox:4.3.14 cpe:/a:oracle:vm_virtualbox:4.3.16 cpe:/a:oracle:vm_virtualbox:4.3.18 cpe:/a:oracle:vm_virtualbox:4.3.22 cpe:/a:oracle:vm_virtualbox:4.3.24 cpe:/a:oracle:vm_virtualbox:4.3.26 cpe:/a:oracle:vm_virtualbox:4.3.28 cpe:/a:oracle:vm_virtualbox:4.3.29 cpe:/a:oracle:vm_virtualbox:4.3.30 cpe:/a:oracle:vm_virtualbox:4.3.32 cpe:/a:oracle:vm_virtualbox:4.3.34 cpe:/a:oracle:vm_virtualbox:4.3.35 cpe:/a:oracle:vm_virtualbox:5.0.0 cpe:/a:oracle:vm_virtualbox:5.0.2 cpe:/a:oracle:vm_virtualbox:5.0.4 cpe:/a:oracle:vm_virtualbox:5.0.6 cpe:/a:oracle:vm_virtualbox:5.0.8 cpe:/a:oracle:vm_virtualbox:5.0.10 cpe:/a:oracle:vm_virtualbox:5.0.12 cpe:/a:oracle:vm_virtualbox:5.0.13 cpe:/o:debian:debian_linux:8.0

CVE-2016-0495

2016-01-20T22:00:43.510-05:00

2019-02-14T14:12:19.570-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2019-02-14T10:59:51.183-05:00

DEBIAN DSA-3454 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81214 SECTRACK 1034731 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.

cpe:/a:oracle:micros_cwdirect:12.5 cpe:/a:oracle:micros_cwdirect:13.0 cpe:/a:oracle:micros_cwdirect:14.0 cpe:/a:oracle:micros_cwdirect:15.0 cpe:/a:oracle:micros_cwdirect:16.0 cpe:/a:oracle:micros_cwdirect:17.0 cpe:/a:oracle:micros_cwdirect:18.0

CVE-2016-0496

2016-01-20T22:00:44.510-05:00

2016-06-08T13:33:20.803-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:47:28.297-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034718 Unspecified vulnerability in the MICROS CWDirect component in Oracle Retail Applications 12.5, 13.0, 14.0, 15.0, 16.0, 17.0, and 18.0 allows remote attackers to affect confidentiality via unknown vectors related to Order Entry.

cpe:/a:oracle:agile_engineering_data_management:6.1.2.2 cpe:/a:oracle:agile_engineering_data_management:6.1.3.0 cpe:/a:oracle:agile_engineering_data_management:6.2.0.0

CVE-2016-0497

2016-01-20T22:00:45.590-05:00

2016-12-07T14:36:08.850-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-07T14:04:51.480-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034727 Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows remote attackers to affect integrity via unknown vectors related to Web Client.

cpe:/a:oracle:agile_engineering_data_management:6.1.2.2 cpe:/a:oracle:agile_engineering_data_management:6.1.3.0 cpe:/a:oracle:agile_engineering_data_management:6.2.0.0

CVE-2016-0498

2016-01-20T22:00:46.543-05:00

2016-12-07T14:36:12.600-05:00

1.5

LOCAL

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-07T14:04:42.853-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034727 Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.2.2, 6.1.3.0, and 6.2.0.0 allows local users to affect confidentiality via unknown vectors related to Install.

cpe:/a:oracle:database_server:11.2.0.4 cpe:/a:oracle:database_server:12.1.0.1 cpe:/a:oracle:database_server:12.1.0.2

CVE-2016-0499

2016-01-20T22:00:47.963-05:00

2016-12-07T14:34:19.897-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2016-12-07T14:04:31.850-05:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034709 Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4794.

cpe:/a:oracle:retail_order_broker_cloud_service:4.0 cpe:/a:oracle:retail_order_broker_cloud_service:4.1

CVE-2016-0500

2016-01-20T22:00:48.933-05:00

2016-06-08T13:31:26.480-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-08T10:46:47.183-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034718 Unspecified vulnerability in the Oracle Retail Order Broker Cloud Service component in Oracle Retail Applications 4.0 and 4.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to System Administration.

cpe:/a:oracle:secure_global_desktop:5.2

CVE-2016-0501

2016-01-20T22:00:49.793-05:00

2016-06-08T13:31:10.577-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-08T10:47:37.707-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034729 Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.2 allows remote attackers to affect availability via vectors related to SGD Core.

CVE-2016-0502

2016-01-20T22:00:50.667-05:00

2019-02-14T14:09:50.287-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-14T11:03:53.910-05:00

SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034708 Unspecified vulnerability in Oracle MySQL 5.5.31 and earlier and 5.6.11 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.7.9 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0503

2016-01-20T22:00:51.590-05:00

2018-10-30T12:27:35.843-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81126 SECTRACK 1034708 UBUNTU USN-2881-1 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0504.

CVE-2016-0504

2016-01-20T22:00:52.700-05:00

2018-10-30T12:27:35.843-04:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81077 SECTRACK 1034708 UBUNTU USN-2881-1 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2016-0503.

cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:oracle:linux:7.0 cpe:/o:oracle:solaris:11.3 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0505

2016-01-20T22:00:53.573-05:00

2019-02-19T13:04:25.037-05:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov

2019-02-19T12:41:06.077-05:00

cpe:/a:oracle:retail_order_management_system_cloud_service:3.5 cpe:/a:oracle:retail_order_management_system_cloud_service:4.5 cpe:/a:oracle:retail_order_management_system_cloud_service:4.7 cpe:/a:oracle:retail_order_management_system_cloud_service:5.0 cpe:/a:oracle:retail_order_management_system_cloud_service:15.0

CVE-2016-0506

2016-01-20T22:00:54.417-05:00

2016-06-08T13:36:51.440-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:47:52.067-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034718 Unspecified vulnerability in the Oracle Retail Order Management System Cloud Service component in Oracle Retail Applications 3.5, 4.5, 4.7, 5.0, and 15.0 allows remote attackers to affect confidentiality via unknown vectors related to Order Entry.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0507

2016-01-20T22:00:55.450-05:00

2017-09-09T21:29:06.527-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle iReceivables component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to AR Web Utilities, a different vulnerability than CVE-2016-0519.

cpe:/a:oracle:ilearning:6.0 cpe:/a:oracle:ilearning:6.1

CVE-2016-0508

2016-01-20T22:00:56.387-05:00

2016-06-08T13:32:24.487-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:47:45.067-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034717 Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Administration.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0509

2016-01-20T22:00:57.637-05:00

2017-09-09T21:29:06.577-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Internet Expenses component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to AP Web Utilities.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0510

2016-01-20T22:00:58.513-05:00

2017-09-09T21:29:06.623-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Business Views Catalog.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0511

2016-01-20T22:00:59.387-05:00

2017-09-09T21:29:06.670-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0512

2016-01-20T22:01:00.263-05:00

2017-09-09T21:29:06.717-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Self Service - Common Modules.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0513

2016-01-20T22:01:01.120-05:00

2017-09-09T21:29:06.763-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0514

2016-01-20T22:01:02.387-05:00

2017-09-09T21:29:06.827-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0515.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0515

2016-01-20T22:01:03.357-05:00

2017-09-09T21:29:06.873-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0514.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0516

2016-01-20T22:01:04.293-05:00

2017-09-09T21:29:06.920-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Quality component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to QA / Order Management Integration.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0517

2016-01-20T22:01:05.183-05:00

2017-09-09T21:29:06.967-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0518

2016-01-20T22:01:06.107-05:00

2017-09-09T21:29:07.013-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0519

2016-01-20T22:01:07.310-05:00

2017-09-09T21:29:07.077-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

cpe:/a:oracle:application_object_library:11.5.10.2

CVE-2016-0520

2016-01-20T22:01:08.247-05:00

2017-09-09T21:29:07.123-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to Java APIs.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0521

2016-01-20T22:01:09.340-05:00

2017-09-09T21:29:07.170-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle iProcurement component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Redirection.

cpe:/a:oracle:retail_open_commerce_platform_cloud_service:3.5 cpe:/a:oracle:retail_open_commerce_platform_cloud_service:4.5 cpe:/a:oracle:retail_open_commerce_platform_cloud_service:4.7 cpe:/a:oracle:retail_open_commerce_platform_cloud_service:5.0

CVE-2016-0522

2016-01-20T22:01:10.247-05:00

2016-06-08T13:33:01.247-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-06-08T10:45:11.767-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034718 Unspecified vulnerability in the Oracle Retail Open Commerce Platform Cloud Service component in Oracle Retail Applications 3.5, 4.5, 4.7, and 5.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Framework.

cpe:/a:oracle:interaction_blending:11.5.10.2 cpe:/a:oracle:interaction_blending:12.1.1 cpe:/a:oracle:interaction_blending:12.1.2 cpe:/a:oracle:interaction_blending:12.1.3 cpe:/a:oracle:interaction_blending:12.2.3 cpe:/a:oracle:interaction_blending:12.2.4 cpe:/a:oracle:interaction_blending:12.2.5

CVE-2016-0523

2016-01-20T22:01:11.137-05:00

2017-09-09T21:29:07.217-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Interaction Blending component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Blending Administration.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0524

2016-01-20T22:01:12.310-05:00

2017-09-09T21:29:07.263-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Work Provider Administration.

cpe:/a:oracle:universal_work_queue:11.5.10.2 cpe:/a:oracle:universal_work_queue:12.1.1 cpe:/a:oracle:universal_work_queue:12.1.2 cpe:/a:oracle:universal_work_queue:12.1.3

CVE-2016-0525

2016-01-20T22:01:13.293-05:00

2017-09-09T21:29:07.310-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Work Provider Administration.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.1.3 cpe:/a:oracle:e-business_suite:12.2.3 cpe:/a:oracle:e-business_suite:12.2.4 cpe:/a:oracle:e-business_suite:12.2.5

CVE-2016-0526

2016-01-20T22:01:14.293-05:00

2017-09-09T21:29:07.357-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via unknown vectors related to Wireless Framework.

cpe:/a:oracle:e-business_suite:12.1.1 cpe:/a:oracle:e-business_suite:12.1.2 cpe:/a:oracle:e-business_suite:12.1.3 cpe:/a:oracle:e-business_suite:12.2.3 cpe:/a:oracle:e-business_suite:12.2.4 cpe:/a:oracle:e-business_suite:12.2.5

CVE-2016-0527

2016-01-20T22:01:15.263-05:00

2017-09-09T21:29:07.403-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0528, CVE-2016-0529, and CVE-2016-0530.

CVE-2016-0528

2016-01-20T22:01:16.263-05:00

2017-09-09T21:29:07.433-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0529, and CVE-2016-0530.

cpe:/a:oracle:customer_interaction_history:12.1.1 cpe:/a:oracle:customer_interaction_history:12.1.2 cpe:/a:oracle:customer_interaction_history:12.1.3 cpe:/a:oracle:customer_interaction_history:12.2.3 cpe:/a:oracle:customer_interaction_history:12.2.4 cpe:/a:oracle:customer_interaction_history:12.2.5

CVE-2016-0529

2016-01-20T22:01:17.497-05:00

2017-09-09T21:29:07.480-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0528, and CVE-2016-0530.

CVE-2016-0530

2016-01-20T22:01:18.467-05:00

2017-09-09T21:29:07.527-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Interaction History component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to User GUI, a different vulnerability than CVE-2016-0527, CVE-2016-0528, and CVE-2016-0529.

cpe:/a:oracle:applications_manager:12.1.3

CVE-2016-0531

2016-01-20T22:01:19.497-05:00

2017-09-09T21:29:07.577-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Oracle Diagnostics Interfaces.

cpe:/a:oracle:crm_technical_foundation:11.5.10.2 cpe:/a:oracle:crm_technical_foundation:12.1.3 cpe:/a:oracle:crm_technical_foundation:12.2.3 cpe:/a:oracle:crm_technical_foundation:12.2.4 cpe:/a:oracle:crm_technical_foundation:12.2.5

CVE-2016-0532

2016-01-20T22:01:20.437-05:00

2017-09-09T21:29:07.623-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security Assignments.

cpe:/a:oracle:crm_technical_foundation:11.5.10.2 cpe:/a:oracle:crm_technical_foundation:12.1.3

CVE-2016-0533

2016-01-20T22:01:21.327-05:00

2017-09-09T21:29:07.670-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Messaging.

cpe:/a:oracle:project_contracts:12.1.1 cpe:/a:oracle:project_contracts:12.1.2 cpe:/a:oracle:project_contracts:12.1.3

CVE-2016-0534

2016-01-20T22:01:22.513-05:00

2017-09-09T21:29:07.700-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Project Contracts component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Printing.

cpe:/o:oracle:solaris:10 cpe:/o:oracle:solaris:11

CVE-2016-0535

2016-01-20T22:01:23.437-05:00

2016-12-07T13:31:41.827-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034735 Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect availability via vectors related to RPC.

cpe:/a:oracle:universal_work_queue:11.5.10.2

CVE-2016-0536

2016-01-20T22:01:24.357-05:00

2017-09-09T21:29:07.747-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Universal Work Queue component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to error messages.

cpe:/a:oracle:human_resources:11.5.10.2

CVE-2016-0537

2016-01-20T22:01:25.280-05:00

2017-09-09T21:29:07.793-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:financial_consolidation_hub:11.5.10.2 cpe:/a:oracle:financial_consolidation_hub:12.1.1 cpe:/a:oracle:financial_consolidation_hub:12.1.2 cpe:/a:oracle:financial_consolidation_hub:12.1.3

CVE-2016-0538

2016-01-20T22:01:26.250-05:00

2017-09-09T21:29:07.840-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Financial Consolidation Hub component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Business Intelligence.

cpe:/a:oracle:report_manager:11.5.10.2 cpe:/a:oracle:report_manager:12.1.3 cpe:/a:oracle:report_manager:12.2.3 cpe:/a:oracle:report_manager:12.2.4

CVE-2016-0539

2016-01-20T22:01:27.390-05:00

2017-09-09T21:29:07.887-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors.

cpe:/a:oracle:configurator:11.5.10.2 cpe:/a:oracle:configurator:12.1 cpe:/a:oracle:configurator:12.2

CVE-2016-0540

2016-01-20T22:01:28.343-05:00

2016-12-07T13:31:43.123-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034727 Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors related to UI Servlet, a different vulnerability than CVE-2016-0541.

cpe:/a:oracle:configurator:11.5.10.2 cpe:/a:oracle:configurator:12.1 cpe:/a:oracle:configurator:12.2

CVE-2016-0541

2016-01-20T22:01:29.297-05:00

2016-12-07T13:31:44.140-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:field_service:12.1.1 cpe:/a:oracle:field_service:12.1.2 cpe:/a:oracle:field_service:12.1.3 cpe:/a:oracle:field_service:12.2.3 cpe:/a:oracle:field_service:12.2.4 cpe:/a:oracle:field_service:12.2.5

CVE-2016-0542

2016-01-20T22:01:30.203-05:00

2017-09-09T21:29:07.920-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect integrity via unknown vectors related to Field Service Map.

cpe:/a:oracle:marketing:11.5.10.2

CVE-2016-0543

2016-01-20T22:01:31.047-05:00

2017-09-09T21:29:07.967-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Preview.

cpe:/a:oracle:marketing:11.5.10.2

CVE-2016-0544

2016-01-20T22:01:32.110-05:00

2017-09-09T21:29:08.013-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Architecture.

cpe:/a:oracle:customer_intelligence:11.5.10.2 cpe:/a:oracle:customer_intelligence:12.1.1 cpe:/a:oracle:customer_intelligence:12.1.2 cpe:/a:oracle:customer_intelligence:12.1.3 cpe:/a:oracle:customer_intelligence:12.2.3 cpe:/a:oracle:customer_intelligence:12.2.4 cpe:/a:oracle:customer_intelligence:12.2.5

CVE-2016-0545

2016-01-20T22:01:33.077-05:00

2017-09-09T21:29:08.060-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0551, CVE-2016-0552, CVE-2016-0559, and CVE-2016-0560.

CVE-2016-0546

2016-01-20T22:01:33.983-05:00

2019-02-19T13:14:30.650-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-02-19T12:39:47.607-05:00

SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0534 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 DEBIAN DSA-3453 DEBIAN DSA-3459 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 81066 SECTRACK 1034708 UBUNTU USN-2881-1 REDHAT RHSA-2016:1132 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1301493 CONFIRM https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-47.html CONFIRM https://dev.mysql.com/doc/relnotes/mysql/5.6/en/news-5-6-28.html CONFIRM https://github.com/mysql/mysql-server/commit/0dbd5a8797ed4bd18e8b883988fb62177eb0f73f CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/ CONFIRM https://mariadb.com/kb/en/mdb-10023-rn/ Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that these are multiple buffer overflows in the mysqlshow tool that allow remote database servers to have unspecified impact via a long table or database name.

cpe:/a:oracle:e-business_intelligence:11.5.10.2

CVE-2016-0547

2016-01-20T22:01:34.907-05:00

2017-09-09T21:29:08.107-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:e-business_intelligence:11.5.10.2

CVE-2016-0548

2016-01-20T22:01:35.780-05:00

2017-09-09T21:29:08.153-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:e-business_intelligence:11.5.10.2

CVE-2016-0549

2016-01-20T22:01:36.827-05:00

2017-09-09T21:29:08.200-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:oracle:customer_relationship_management_technical_foundation:12.1.3 cpe:/a:oracle:customer_relationship_management_technical_foundation:12.2.3 cpe:/a:oracle:customer_relationship_management_technical_foundation:12.2.4 cpe:/a:oracle:customer_relationship_management_technical_foundation:12.2.5

CVE-2016-0550

2016-01-20T22:01:37.827-05:00

2017-09-09T21:29:08.247-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to CRM HTML Administration.

CVE-2016-0551

2016-01-20T22:01:38.827-05:00

2017-09-09T21:29:08.293-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0552, CVE-2016-0559, and CVE-2016-0560.

CVE-2016-0552

2016-01-20T22:01:39.907-05:00

2017-09-09T21:29:08.357-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0559, and CVE-2016-0560.

cpe:/a:oracle:e-business_intelligence:11.5.10.2 cpe:/a:oracle:e-business_intelligence:12.1.1 cpe:/a:oracle:e-business_intelligence:12.1.2 cpe:/a:oracle:e-business_intelligence:12.1.3

CVE-2016-0553

2016-01-20T22:01:40.953-05:00

2017-09-09T21:29:08.403-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors.

cpe:/a:oracle:interaction_center_intelligence:11.5.10.2 cpe:/a:oracle:interaction_center_intelligence:12.1.1 cpe:/a:oracle:interaction_center_intelligence:12.1.2 cpe:/a:oracle:interaction_center_intelligence:12.1.3

CVE-2016-0554

2016-01-20T22:01:42.173-05:00

2017-09-09T21:29:08.450-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Interaction Center Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Business Intelligence.

cpe:/a:oracle:cadview-3d:11.5.10.2 cpe:/a:oracle:cadview-3d:12.1.1 cpe:/a:oracle:cadview-3d:12.1.2 cpe:/a:oracle:cadview-3d:12.1.3

CVE-2016-0555

2016-01-20T22:01:43.157-05:00

2017-09-09T21:29:08.497-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CADView-3D component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Studio.

cpe:/a:oracle:e-business_suite:11.5.10.2 cpe:/a:oracle:e-business_suite:12.1.1 cpe:/a:oracle:e-business_suite:12.1.2 cpe:/a:oracle:e-business_suite:12.1.3

CVE-2016-0556

2016-01-20T22:01:44.140-05:00

2017-09-09T21:29:08.543-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Administration, a different vulnerability than CVE-2016-0557.

cpe:/a:oracle:advanced_collections:11.5.10.2 cpe:/a:oracle:advanced_collections:12.1.1 cpe:/a:oracle:advanced_collections:12.1.2 cpe:/a:oracle:advanced_collections:12.1.3

CVE-2016-0557

2016-01-20T22:01:45.127-05:00

2017-09-09T21:29:08.590-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Administration, a different vulnerability than CVE-2016-0556.

cpe:/a:oracle:service_contracts:11.5.10.2 cpe:/a:oracle:service_contracts:12.1.1 cpe:/a:oracle:service_contracts:12.1.2 cpe:/a:oracle:service_contracts:12.1.3

CVE-2016-0558

2016-01-20T22:01:46.093-05:00

2017-09-09T21:29:08.637-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Service Contracts component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Renewals.

CVE-2016-0559

2016-01-20T22:01:47.343-05:00

2017-09-09T21:29:08.717-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0552, and CVE-2016-0560.

CVE-2016-0560

2016-01-20T22:01:48.283-05:00

2017-09-09T21:29:08.763-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0545, CVE-2016-0551, CVE-2016-0552, and CVE-2016-0559.

cpe:/a:oracle:e-business_intelligence:11.5.10.2 cpe:/a:oracle:e-business_intelligence:12.1.1 cpe:/a:oracle:e-business_intelligence:12.1.2 cpe:/a:oracle:e-business_intelligence:12.1.3

CVE-2016-0561

2016-01-20T22:01:49.250-05:00

2017-09-09T21:29:08.810-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0564.

cpe:/a:oracle:common_applications:11.5.10.2 cpe:/a:oracle:common_applications:12.1.1 cpe:/a:oracle:common_applications:12.1.2 cpe:/a:oracle:common_applications:12.1.3

CVE-2016-0562

2016-01-20T22:01:50.407-05:00

2017-09-09T21:29:08.857-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Common Applications component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via vectors related to CRM User Management Framework.

cpe:/a:oracle:crm_technical_foundation:11.5.10.2 cpe:/a:oracle:crm_technical_foundation:12.1.3

CVE-2016-0563

2016-01-20T22:01:51.313-05:00

2017-09-09T21:29:08.903-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2 and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Common Techstack.

cpe:/a:oracle:e-business_intelligence:11.5.10.2 cpe:/a:oracle:e-business_intelligence:12.1.1 cpe:/a:oracle:e-business_intelligence:12.1.2 cpe:/a:oracle:e-business_intelligence:12.1.3

CVE-2016-0564

2016-01-20T22:01:52.563-05:00

2017-09-09T21:29:08.950-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0561.

cpe:/a:oracle:marketing:11.5.10.2 cpe:/a:oracle:marketing:12.1.1 cpe:/a:oracle:marketing:12.1.2 cpe:/a:oracle:marketing:12.1.3

CVE-2016-0565

2016-01-20T22:01:53.547-05:00

2017-09-09T21:29:08.997-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.

cpe:/a:oracle:marketing:11.5.10.2 cpe:/a:oracle:marketing:12.1.1 cpe:/a:oracle:marketing:12.1.2 cpe:/a:oracle:marketing:12.1.3 cpe:/a:oracle:marketing:12.2.3 cpe:/a:oracle:marketing:12.2.4 cpe:/a:oracle:marketing:12.2.5

CVE-2016-0566

2016-01-20T22:01:54.580-05:00

2017-09-09T21:29:09.027-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality via unknown vectors related to Deliverables.

cpe:/a:oracle:e-business_intelligence:11.5.10.2 cpe:/a:oracle:e-business_intelligence:12.1.1 cpe:/a:oracle:e-business_intelligence:12.1.2 cpe:/a:oracle:e-business_intelligence:12.1.3

CVE-2016-0567

2016-01-20T22:01:55.563-05:00

2017-09-09T21:29:09.077-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Embedded Data Warehouse.

cpe:/a:oracle:email_center:12.1.1 cpe:/a:oracle:email_center:12.1.2 cpe:/a:oracle:email_center:12.1.3

CVE-2016-0568

2016-01-20T22:01:56.457-05:00

2017-09-09T21:29:09.123-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Email Center component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Server Components.

cpe:/a:oracle:e-business_intelligence:11.5.10.2 cpe:/a:oracle:e-business_intelligence:12.1.1 cpe:/a:oracle:e-business_intelligence:12.1.2 cpe:/a:oracle:e-business_intelligence:12.1.3

CVE-2016-0569

2016-01-20T22:01:57.970-05:00

2017-09-09T21:29:09.170-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors.

cpe:/a:oracle:human_capital_management_configuration_workbench:12.1.1 cpe:/a:oracle:human_capital_management_configuration_workbench:12.1.2 cpe:/a:oracle:human_capital_management_configuration_workbench:12.1.3

CVE-2016-0570

2016-01-20T22:01:58.877-05:00

2017-09-09T21:29:09.217-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors.

cpe:/a:oracle:balanced_scorecard:11.5.10.2 cpe:/a:oracle:balanced_scorecard:12.1

CVE-2016-0571

2016-01-20T22:01:59.800-05:00

2017-09-09T21:29:09.263-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Balanced Scorecard component in Oracle E-Business Suite 11.5.10.2 and 12.1 allows remote attackers to affect confidentiality via unknown vectors.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0 cpe:/a:oracle:weblogic_server:12.2.1.0.0

CVE-2016-0572

2016-01-20T22:02:00.737-05:00

2018-10-30T12:27:31.390-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034716 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0 cpe:/a:oracle:weblogic_server:12.2.1.0.0

CVE-2016-0573

2016-01-20T22:02:01.753-05:00

2018-10-30T12:27:31.390-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81085 SECTRACK 1034716 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0 cpe:/a:oracle:weblogic_server:12.2.1.0.0

CVE-2016-0574

2016-01-20T22:02:02.957-05:00

2018-10-30T12:27:31.390-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81080 SECTRACK 1034716 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0577.

cpe:/a:oracle:e-business_suite:11.5.10.2

CVE-2016-0575

2016-01-20T22:02:03.847-05:00

2017-09-09T21:29:09.450-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Learning Management component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to OTA Self Service.

cpe:/a:oracle:application_object_library:11.5.10.2

CVE-2016-0576

2016-01-20T22:02:04.800-05:00

2017-09-09T21:29:09.497-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to ICX LOVs.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0 cpe:/a:oracle:weblogic_server:12.2.1.0.0

CVE-2016-0577

2016-01-20T22:02:05.767-05:00

2018-10-30T12:27:31.390-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81116 SECTRACK 1034716 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-0574.

cpe:/a:oracle:customer_relationship_management_technical_foundation:11.5.10.2

CVE-2016-0578

2016-01-20T22:02:06.767-05:00

2017-09-09T21:29:09.590-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to BIS Common Components.

cpe:/a:oracle:customer_relationship_management_technical_foundation:11.5.10.2

CVE-2016-0579

2016-01-20T22:02:07.940-05:00

2017-09-09T21:29:09.637-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0582, CVE-2016-0583, and CVE-2016-0584.

cpe:/a:oracle:report_manager:11.5.10.2

CVE-2016-0580

2016-01-20T22:02:08.987-05:00

2017-09-09T21:29:09.683-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via unknown vectors.

cpe:/a:oracle:approvals_management:11.5.10.2

CVE-2016-0581

2016-01-20T22:02:09.893-05:00

2017-09-09T21:29:09.730-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Approvals Management component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via vectors related to AME Page rendering.

cpe:/a:oracle:customer_relationship_management_technical_foundation:11.5.10.2

CVE-2016-0582

2016-01-20T22:02:10.910-05:00

2017-09-09T21:29:09.777-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0583, and CVE-2016-0584.

cpe:/a:oracle:crm_technical_foundation:11.5.10.2

CVE-2016-0583

2016-01-20T22:02:12.113-05:00

2017-09-09T21:29:09.827-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0582, and CVE-2016-0584.

cpe:/a:oracle:customer_relationship_management_technical_foundation:11.5.10.2

CVE-2016-0584

2016-01-20T22:02:13.160-05:00

2017-09-09T21:29:09.873-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle CRM Technology Foundation component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via vectors related to BIS Common Components, a different vulnerability than CVE-2016-0579, CVE-2016-0582, and CVE-2016-0583.

cpe:/a:oracle:application_object_library:11.5.10.2

CVE-2016-0585

2016-01-20T22:02:14.143-05:00

2017-09-09T21:29:09.920-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via vectors related to ICX Error.

cpe:/a:oracle:application_object_library:11.5.10.2

CVE-2016-0586

2016-01-20T22:02:15.143-05:00

2017-09-09T21:29:09.967-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to iHelp.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0587

2016-01-20T22:02:16.037-05:00

2016-06-08T13:32:06.880-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:45:44.473-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality via unknown vectors related to File Processing.

cpe:/a:oracle:general_ledger:11.5.10.2

CVE-2016-0588

2016-01-20T22:02:17.207-05:00

2017-09-09T21:29:10.027-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle General Ledger component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Consolidation Hierarchy Viewer.

cpe:/a:oracle:application_object_library:11.5.10.2

CVE-2016-0589

2016-01-20T22:02:18.207-05:00

2017-09-09T21:29:10.060-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034726 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors.

cpe:/a:oracle:peoplesoft_supply_chain_management_order_management:9.1 cpe:/a:oracle:peoplesoft_supply_chain_management_order_management:9.2

CVE-2016-0590

2016-01-20T22:02:19.177-05:00

2016-06-08T13:34:34.610-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-08T10:45:37.393-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise SCM Order Management component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect integrity via unknown vectors.

cpe:/a:oracle:peoplesoft_supply_chain_management_purchasing:9.1 cpe:/a:oracle:peoplesoft_supply_chain_management_purchasing:9.2

CVE-2016-0591

2016-01-20T22:02:20.160-05:00

2016-06-09T14:17:13.967-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-06-09T09:43:10.863-04:00

CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034720 Unspecified vulnerability in the PeopleSoft Enterprise SCM Purchasing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Supplier Change.

CVE-2016-0592

2016-01-20T22:02:21.130-05:00

2019-02-19T13:15:06.557-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:42:50.343-05:00

DEBIAN DSA-3454 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81224 SECTRACK 1034731 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affect availability via unknown vectors related to Core.

CVE-2016-0593

2017-05-11T10:29:56.500-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:mysql:5.6.21 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2

CVE-2016-0594

2016-01-20T22:02:22.237-05:00

2018-10-30T12:27:35.843-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034708 Unspecified vulnerability in Oracle MySQL 5.6.21 and earlier allows remote authenticated users to affect availability via vectors related to DML.

cpe:/a:oracle:mysql:5.6.27 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0595

2016-01-20T22:02:23.193-05:00

2018-10-30T12:27:35.843-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81121 SECTRACK 1034708 UBUNTU USN-2881-1 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier allows remote authenticated users to affect availability via vectors related to DML.

cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:oracle:linux:7.0 cpe:/o:oracle:solaris:11.3 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0596

2016-01-20T22:02:24.223-05:00

2019-02-19T12:58:11.093-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:54:37.437-05:00

CVE-2016-0597

2016-01-20T22:02:25.223-05:00

2019-02-19T13:10:39.487-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:55:14.050-05:00

CVE-2016-0598

2016-01-20T22:02:26.347-05:00

2019-02-19T13:13:55.930-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:57:13.293-05:00

cpe:/a:oracle:mysql:5.7.9

CVE-2016-0599

2016-01-20T22:02:27.567-05:00

2016-12-07T13:31:55.390-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034708 Unspecified vulnerability in Oracle MySQL 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVE-2016-0600

2016-01-20T22:02:28.553-05:00

2019-02-19T13:07:07.543-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:57:57.343-05:00

cpe:/a:oracle:mysql:5.7.9

CVE-2016-0601

2016-01-20T22:02:29.613-05:00

2016-12-07T13:31:57.657-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:vm_virtualbox:5.0.12

CVE-2016-0602

2016-01-20T22:02:30.600-05:00

2018-10-09T15:58:42.753-04:00

6.2

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov FULLDISC 20160210 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BUGTRAQ 20160205 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox SECTRACK 1034731 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

cpe:/a:oracle:jdk:1.6.0:update_111 cpe:/a:oracle:jdk:1.7.0:update_95 cpe:/a:oracle:jdk:1.8.0:update_71 cpe:/a:oracle:jdk:1.8.0:update_72 cpe:/a:oracle:jre:1.6.0:update_111 cpe:/a:oracle:jre:1.7.0:update_95 cpe:/a:oracle:jre:1.8.0:update_71 cpe:/a:oracle:jre:1.8.0:update_72

CVE-2016-0603

2016-02-08T11:59:01.737-05:00

2018-10-09T15:58:43.113-04:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov FULLDISC 20160210 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox CONFIRM http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0603-2874360.html BUGTRAQ 20160205 [CVE-2016-0602, CVE-2016-0603] Executable installers are vulnerable^WEVIL (case 24): Oracle Java 6/7/8 SE and VirtualBox BID 83008 SECTRACK 1034969 GENTOO GLSA-201610-08 CONFIRM https://security.netapp.com/advisory/ntap-20160217-0001/ Unspecified vulnerability in the Java SE component in Oracle Java SE 6u111, 7u95, 8u71, and 8u72, when running on Windows, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install. NOTE: the previous information is from Oracle's Security Alert for CVE-2016-0603. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

CVE-2016-0604

2017-05-11T10:29:56.530-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:mysql:5.6.26 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0605

2016-01-20T22:02:31.553-05:00

2018-10-30T12:27:37.297-04:00

2.1

NETWORK

HIGH

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:50:11.493-05:00

SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81253 SECTRACK 1034708 Unspecified vulnerability in Oracle MySQL 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors.

CVE-2016-0606

2016-01-20T22:02:32.537-05:00

2019-02-19T14:30:47.143-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-19T12:58:45.783-05:00

cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.7.9 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0607

2016-01-20T22:02:33.600-05:00

2019-04-22T13:48:00.643-04:00

2.8

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:49:07.140-05:00

SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81238 SECTRACK 1034708 UBUNTU USN-2881-1 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to replication.

CVE-2016-0608

2016-01-20T22:02:35.037-05:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:59:24.647-05:00

CVE-2016-0609

2016-01-20T22:02:36.100-05:00

2019-04-22T13:48:00.643-04:00

1.7

NETWORK

HIGH

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T12:59:55.633-05:00

cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:oracle:mysql:5.6.27 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0610

2016-01-20T22:02:37.020-05:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81198 SECTRACK 1034708 UBUNTU USN-2881-1 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10022-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-1019-release-notes/ Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB.

cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.7.9 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0611

2016-01-20T22:02:37.960-05:00

2019-05-01T14:11:23.137-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-05-01T10:04:39.497-04:00

SUSE openSUSE-SU-2016:0367 SUSE openSUSE-SU-2016:0377 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html BID 81164 SECTRACK 1034708 UBUNTU USN-2881-1 Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and 5.7.9 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

CVE-2016-0612

2017-05-11T10:29:56.547-04:00

2017-05-11T10:29:56.563-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0613

2017-05-11T10:29:56.577-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:business_intelligence_publisher:11.1.1.7.0 cpe:/a:oracle:business_intelligence_publisher:11.1.1.9.0 cpe:/a:oracle:business_intelligence_publisher:12.2.1.0.0

CVE-2016-0614

2016-01-20T22:02:38.897-05:00

2017-09-09T21:29:10.170-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html SECTRACK 1034711 Unspecified vulnerability in the Oracle BI Publisher component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors.

CVE-2016-0615

2017-05-11T10:29:56.610-04:00

2017-05-11T10:29:56.623-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:oracle:mysql:5.5.46 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:oracle:linux:7.0 cpe:/o:oracle:solaris:11.3 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0616

2016-01-20T22:02:39.850-05:00

2018-10-30T12:27:32.030-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0534 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 DEBIAN DSA-3453 DEBIAN DSA-3459 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 81176 SECTRACK 1034708 UBUNTU USN-2881-1 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10110-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5547-release-notes/ CONFIRM https://mariadb.com/kb/en/mdb-10023-rn/ Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer.

cpe:/a:oracle:linux:6.0

CVE-2016-0617

2016-09-30T10:59:00.190-04:00

2017-09-09T21:29:10.217-04:00

4.6

LOCAL

LOW

SINGLE_INSTANCE

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html SECTRACK 1034968 Unspecified vulnerability in the kernel-uek component in Oracle Linux 6 allows local users to affect availability via unknown vectors.

cpe:/o:oracle:solaris:11

CVE-2016-0618

2016-01-20T22:02:40.803-05:00

2016-12-22T11:06:39.533-05:00

1.4

LOCAL

LOW

MULTIPLE_INSTANCES

PARTIAL

NONE

http://nvd.nist.gov

2016-12-22T11:02:38.303-05:00

CVE-2016-0619

2017-05-11T10:29:56.640-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0620

2017-05-11T10:29:56.670-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0621

2017-05-11T10:29:56.703-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0622

2017-05-11T10:29:56.733-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:oracle:solaris:11.3

CVE-2016-0623

2016-04-21T06:59:07.193-04:00

2016-12-02T22:16:30.773-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035629 Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect integrity via vectors related to the Automated Installer sub-component.

CVE-2016-0624

2017-05-11T10:29:56.750-04:00

2017-05-11T10:29:56.767-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0625

2017-05-11T10:29:56.780-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0626

2017-05-11T10:29:56.813-04:00

2017-05-11T10:29:56.827-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0627

2017-05-11T10:29:56.860-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0628

2017-05-11T10:29:56.890-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0629

2017-05-11T10:29:56.907-04:00

2017-05-11T10:29:56.920-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0630

2017-05-11T10:29:56.937-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0631

2017-05-11T10:29:56.967-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0632

2017-05-11T10:29:57.000-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0633

2017-05-11T10:29:57.017-04:00

2017-05-11T10:29:57.030-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:gnu:bash:4.3

CVE-2016-0634

2017-08-28T11:29:01.487-04:00

2018-01-04T21:30:27.057-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2017:0725 MLIST [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME MLIST [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME BID 92999 REDHAT RHSA-2017:1931 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1377613 GENTOO GLSA-201612-39 The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

cpe:/a:oracle:documaker:12.5 cpe:/a:oracle:enterprise_manager_ops_center:12.1.4 cpe:/a:oracle:enterprise_manager_ops_center:12.2.2 cpe:/a:oracle:enterprise_manager_ops_center:12.3.2 cpe:/a:oracle:health_sciences_information_manager:1.2.8.3 cpe:/a:oracle:health_sciences_information_manager:2.0.2.3 cpe:/a:oracle:health_sciences_information_manager:3.0.1.0 cpe:/a:oracle:healthcare_master_person_index:2.0.12 cpe:/a:oracle:healthcare_master_person_index:3.0.0 cpe:/a:oracle:healthcare_master_person_index:4.0.1 cpe:/a:oracle:insurance_calculation_engine:9.7.1 cpe:/a:oracle:insurance_calculation_engine:10.1.2 cpe:/a:oracle:insurance_calculation_engine:10.2.2 cpe:/a:oracle:insurance_policy_administration_j2ee:9.6.1 cpe:/a:oracle:insurance_policy_administration_j2ee:9.7.1 cpe:/a:oracle:insurance_policy_administration_j2ee:10.0.1 cpe:/a:oracle:insurance_policy_administration_j2ee:10.1.2 cpe:/a:oracle:insurance_policy_administration_j2ee:10.2.0 cpe:/a:oracle:insurance_policy_administration_j2ee:10.2.2 cpe:/a:oracle:insurance_rules_palette:9.6.1 cpe:/a:oracle:insurance_rules_palette:9.7.1 cpe:/a:oracle:insurance_rules_palette:10.0.1 cpe:/a:oracle:insurance_rules_palette:10.1.2 cpe:/a:oracle:insurance_rules_palette:10.2.0 cpe:/a:oracle:insurance_rules_palette:10.2.2 cpe:/a:oracle:primavera_contract_management:14.2 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:8.2 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:8.3 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2 cpe:/a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1 cpe:/a:oracle:retail_integration_bus:15.0 cpe:/a:oracle:retail_order_broker_cloud_service:5.1 cpe:/a:oracle:retail_order_broker_cloud_service:5.2 cpe:/a:oracle:retail_order_broker_cloud_service:15.0

CVE-2016-0635

2016-07-21T06:12:00.177-04:00

2019-04-23T15:29:26.630-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html BID 91787 BID 91869 SECTRACK 1036377 SECTRACK 1036378 SECTRACK 1036393 SECTRACK 1036397 SECTRACK 1037640 MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CONFIRM https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component in Oracle Health Sciences Applications 1.2.8.3, 2.0.2.3, and 3.0.1.0; the Oracle Healthcare Master Person Index component in Oracle Health Sciences Applications 2.0.12, 3.0.0, and 4.0.1; the Oracle Documaker component in Oracle Insurance Applications before 12.5; the Oracle Insurance Calculation Engine component in Oracle Insurance Applications 9.7.1, 10.1.2, and 10.2.2; the Oracle Insurance Policy Administration J2EE and Oracle Insurance Rules Palette components in Oracle Insurance Applications 9.6.1, 9.7.1, 10.0.1, 10.1.2, 10.2.0, and 10.2.2; the Oracle Retail Integration Bus component in Oracle Retail Applications 15.0; the Oracle Retail Order Broker component in Oracle Retail Applications 5.1, 5.2, and 15.0; the Primavera Contract Management component in Oracle Primavera Products Suite 14.2; the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.2, 8.3, 8.4, 15.1, 15.2, and 16.1; the Oracle Financial Services Analytical Applications Infrastructure component in Oracle Financial Services Applications 8.0.0, 8.0.1, 8.0.2, and 8.0.3; the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce 3.1.1, 3.1.2, 11.0, 11.1, and 11.2; the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5; the Oracle Communications BRM - Elastic Charging Engine 11.2.0.0.0 and 11.3.0.0.0; the Oracle Enterprise Repository Enterprise Repository 12.1.3.0.0; the Oracle Financial Services Behavior Detection Platform 8.0.1 and 8.0.2; the Oracle Hyperion Essbase 12.2.1.1; the Oracle Tuxedo System and Applications Monitor (TSAM) 11.1.1.2.0, 11.1.1.2.1, 11.1.1.2.1, 12.1.1.1.0, 12.1.3.0.0, and 12.2.2.0.0; the Oracle Communications WebRTC Session Controller component of Oracle Communications Applications (subcomponent: Security (Spring)) 7.0, 7.1 and 7.2; the Oracle Endeca Information Discovery Integrator 3.2; the Converged Commerce component of Oracle Retail Applications 16.0.1; the Oracle Identity Manager 11.1.2.3.0; Oracle Enterprise Manager for MySQL Database 12.1.0.4; Oracle Retail Invoice Matching 12.0, 13.0, 13.1, 13.2, 14.0, and 14.1; Oracle Communications Performance Intelligence Center (PIC) Software Prior to 10.2.1 and the Oracle Knowledge component of Oracle Siebel CRM (subcomponent: AnswerFlow (Spring Framework)) version 8.5.1.0 - 8.5.1.7 and 8.6.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

cpe:/a:oracle:jdk:1.7.0:update_97 cpe:/a:oracle:jdk:1.8.0:update_73 cpe:/a:oracle:jdk:1.8.0:update_74 cpe:/a:oracle:jre:1.7.0:update_97 cpe:/a:oracle:jre:1.8.0:update_73 cpe:/a:oracle:jre:1.8.0:update_74 cpe:/a:redhat:icedtea7:2.6.6 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:6.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0636

2016-03-24T14:59:00.120-04:00

2017-11-09T21:29:06.980-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0956 SUSE SUSE-SU-2016:0957 SUSE SUSE-SU-2016:0959 SUSE openSUSE-SU-2016:0971 SUSE openSUSE-SU-2016:0983 SUSE openSUSE-SU-2016:1004 SUSE openSUSE-SU-2016:1005 SUSE openSUSE-SU-2016:1042 REDHAT RHSA-2016:0511 REDHAT RHSA-2016:0512 REDHAT RHSA-2016:0513 REDHAT RHSA-2016:0514 REDHAT RHSA-2016:0515 REDHAT RHSA-2016:0516 DEBIAN DSA-3558 CONFIRM http://www.oracle.com/technetwork/topics/security/alert-cve-2016-0636-2949497.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 85376 SECTRACK 1035401 UBUNTU USN-2942-1 GENTOO GLSA-201606-18 GENTOO GLSA-201610-08 CONFIRM https://security.netapp.com/advisory/ntap-20160328-0001/ Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.

CVE-2016-0637

2017-05-11T10:29:57.047-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0 cpe:/a:oracle:weblogic_server:12.2.1.0.0

CVE-2016-0638

2016-04-21T06:59:08.023-04:00

2018-10-30T12:27:31.390-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035615 MISC https://www.tenable.com/security/research/tra-2016-09 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0639

2016-04-21T06:59:09.070-04:00

2019-02-19T14:33:31.363-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-02-19T13:02:09.013-05:00

SUSE openSUSE-SU-2016:1332 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86418 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.

cpe:/a:ibm:powerkvm:2.1 cpe:/a:ibm:powerkvm:3.1 cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:5.5.47 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:oracle:linux:7.0 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0640

2016-04-21T06:59:09.977-04:00

2019-04-22T13:48:00.643-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:06:11.290-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86427 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML.

CVE-2016-0641

2016-04-21T06:59:10.883-04:00

2019-04-22T13:48:00.643-04:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:10:34.893-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86470 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM.

cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.5.48 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:opensuse:leap:42.1 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0642

2016-04-21T06:59:11.913-04:00

2019-04-22T13:48:00.643-04:00

4.3

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:11:41.037-05:00

cpe:/a:ibm:powerkvm:2.1 cpe:/a:ibm:powerkvm:3.1 cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:5.5.47 cpe:/a:mariadb:mariadb:5.5.48 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.0.24 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:mariadb:mariadb:10.1.13 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.5.48 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0643

2016-04-21T06:59:12.757-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-19T13:23:45.847-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86486 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML.

CVE-2016-0644

2016-04-21T06:59:13.787-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:24:36.490-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86442 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL.

CVE-2016-0645

2017-05-11T10:29:57.077-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0646

2016-04-21T06:59:14.663-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:25:13.053-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86436 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML.

cpe:/a:ibm:powerkvm:2.1 cpe:/a:ibm:powerkvm:3.1 cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:5.5.47 cpe:/a:mariadb:mariadb:5.5.48 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.0.24 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:mariadb:mariadb:10.1.13 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.5.48 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:oracle:linux:7.0 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0647

2016-04-21T06:59:15.490-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:26:27.960-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86495 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS.

cpe:/a:ibm:powerkvm:2.1 cpe:/a:ibm:powerkvm:3.1 cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:5.5.47 cpe:/a:mariadb:mariadb:5.5.48 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.0.24 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:mariadb:mariadb:10.1.13 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.5.48 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:oracle:linux:7.0 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0648

2016-04-21T06:59:16.337-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:27:43.757-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86457 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS.

CVE-2016-0649

2016-04-21T06:59:17.163-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:28:16.773-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86498 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS.

CVE-2016-0650

2016-04-21T06:59:18.007-04:00

2019-04-22T13:48:00.643-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:28:48.900-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86496 SECTRACK 1035606 UBUNTU USN-2953-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5548-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication.

cpe:/a:oracle:mysql:5.5.46 cpe:/o:opensuse:leap:42.1

CVE-2016-0651

2016-04-21T06:59:19.100-04:00

2018-10-30T12:27:32.030-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2016:1279 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0534 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035606 REDHAT RHSA-2016:1132 Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier allows local users to affect availability via vectors related to Optimizer.

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0652

2016-04-21T06:59:20.117-04:00

2016-12-02T22:16:47.027-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035606 Unspecified vulnerability in Oracle MySQL 5.7.10 and earlier allows local users to affect availability via vectors related to DML.

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0653

2016-04-21T06:59:21.087-04:00

2016-12-02T22:16:48.167-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0654

2016-04-21T06:59:22.007-04:00

2016-12-02T22:16:49.260-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.0.24 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:mariadb:mariadb:10.1.13 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0655

2016-04-21T06:59:22.837-04:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:35:06.750-05:00

SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86424 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to InnoDB.

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0656

2016-04-21T06:59:23.727-04:00

2016-12-02T22:16:52.823-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:mysql:5.7.11

CVE-2016-0657

2016-04-21T06:59:24.587-04:00

2016-12-02T22:16:54.090-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035606 UBUNTU USN-2954-1 Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON.

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0658

2016-04-21T06:59:25.397-04:00

2016-12-02T22:16:55.277-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:mysql:5.7.11

CVE-2016-0659

2016-04-21T06:59:26.243-04:00

2016-12-02T22:16:56.497-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

CVE-2016-0660

2017-05-11T10:29:57.110-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0661

2016-04-21T06:59:27.070-04:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:41:12.647-05:00

SUSE openSUSE-SU-2016:1332 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86511 SECTRACK 1035606 UBUNTU USN-2953-1 Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options.

cpe:/a:oracle:mysql:5.7.11

CVE-2016-0662

2016-04-21T06:59:27.977-04:00

2016-12-02T22:16:58.607-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

cpe:/a:oracle:mysql:5.7.10

CVE-2016-0663

2016-04-21T06:59:29.040-04:00

2016-12-02T22:16:59.683-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

CVE-2016-0664

2017-05-11T10:29:57.140-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0665

2016-04-21T06:59:29.883-04:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:42:50.193-05:00

SUSE openSUSE-SU-2016:1332 REDHAT RHSA-2016:0705 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86513 SECTRACK 1035606 UBUNTU USN-2953-1 Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption.

cpe:/a:ibm:powerkvm:2.1 cpe:/a:ibm:powerkvm:3.1 cpe:/a:mariadb:mariadb:5.5.20 cpe:/a:mariadb:mariadb:5.5.21 cpe:/a:mariadb:mariadb:5.5.22 cpe:/a:mariadb:mariadb:5.5.23 cpe:/a:mariadb:mariadb:5.5.24 cpe:/a:mariadb:mariadb:5.5.25 cpe:/a:mariadb:mariadb:5.5.27 cpe:/a:mariadb:mariadb:5.5.28 cpe:/a:mariadb:mariadb:5.5.28a cpe:/a:mariadb:mariadb:5.5.33 cpe:/a:mariadb:mariadb:5.5.33:a cpe:/a:mariadb:mariadb:5.5.34 cpe:/a:mariadb:mariadb:5.5.35 cpe:/a:mariadb:mariadb:5.5.40 cpe:/a:mariadb:mariadb:5.5.43 cpe:/a:mariadb:mariadb:5.5.46 cpe:/a:mariadb:mariadb:5.5.47 cpe:/a:mariadb:mariadb:5.5.48 cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.0.24 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:mariadb:mariadb:10.1.13 cpe:/a:oracle:mysql:5.5.0 cpe:/a:oracle:mysql:5.5.1 cpe:/a:oracle:mysql:5.5.2 cpe:/a:oracle:mysql:5.5.3 cpe:/a:oracle:mysql:5.5.4 cpe:/a:oracle:mysql:5.5.5 cpe:/a:oracle:mysql:5.5.6 cpe:/a:oracle:mysql:5.5.7 cpe:/a:oracle:mysql:5.5.8 cpe:/a:oracle:mysql:5.5.9 cpe:/a:oracle:mysql:5.5.10 cpe:/a:oracle:mysql:5.5.11 cpe:/a:oracle:mysql:5.5.12 cpe:/a:oracle:mysql:5.5.13 cpe:/a:oracle:mysql:5.5.14 cpe:/a:oracle:mysql:5.5.15 cpe:/a:oracle:mysql:5.5.16 cpe:/a:oracle:mysql:5.5.17 cpe:/a:oracle:mysql:5.5.18 cpe:/a:oracle:mysql:5.5.19 cpe:/a:oracle:mysql:5.5.20 cpe:/a:oracle:mysql:5.5.21 cpe:/a:oracle:mysql:5.5.22 cpe:/a:oracle:mysql:5.5.23 cpe:/a:oracle:mysql:5.5.24 cpe:/a:oracle:mysql:5.5.25 cpe:/a:oracle:mysql:5.5.25:a cpe:/a:oracle:mysql:5.5.26 cpe:/a:oracle:mysql:5.5.27 cpe:/a:oracle:mysql:5.5.28 cpe:/a:oracle:mysql:5.5.29 cpe:/a:oracle:mysql:5.5.30 cpe:/a:oracle:mysql:5.5.31 cpe:/a:oracle:mysql:5.5.32 cpe:/a:oracle:mysql:5.5.33 cpe:/a:oracle:mysql:5.5.34 cpe:/a:oracle:mysql:5.5.35 cpe:/a:oracle:mysql:5.5.36 cpe:/a:oracle:mysql:5.5.37 cpe:/a:oracle:mysql:5.5.38 cpe:/a:oracle:mysql:5.5.39 cpe:/a:oracle:mysql:5.5.40 cpe:/a:oracle:mysql:5.5.41 cpe:/a:oracle:mysql:5.5.42 cpe:/a:oracle:mysql:5.5.43 cpe:/a:oracle:mysql:5.5.44 cpe:/a:oracle:mysql:5.5.45 cpe:/a:oracle:mysql:5.5.46 cpe:/a:oracle:mysql:5.5.47 cpe:/a:oracle:mysql:5.5.48 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:oracle:linux:7.0 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0666

2016-04-21T06:59:30.743-04:00

2019-04-22T13:48:00.643-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:47:45.057-05:00

SUSE SUSE-SU-2016:1279 SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 REDHAT RHSA-2016:1480 REDHAT RHSA-2016:1481 REDHAT RHSA-2016:1602 DEBIAN DSA-3557 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html BID 86509 SECTRACK 1035606 UBUNTU USN-2953-1 UBUNTU USN-2954-1 CONFIRM http://www-01.ibm.com/support/docview.wss?uid=isg3T1024168 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10025-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10114-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-5549-release-notes/ Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges.

cpe:/a:oracle:mysql:5.7.11

CVE-2016-0667

2016-04-21T06:59:31.587-04:00

2016-12-02T22:17:02.983-05:00

2.8

NETWORK

MEDIUM

MULTIPLE_INSTANCES

NONE

PARTIAL

cpe:/a:mariadb:mariadb:10.0.0 cpe:/a:mariadb:mariadb:10.0.1 cpe:/a:mariadb:mariadb:10.0.2 cpe:/a:mariadb:mariadb:10.0.3 cpe:/a:mariadb:mariadb:10.0.4 cpe:/a:mariadb:mariadb:10.0.5 cpe:/a:mariadb:mariadb:10.0.6 cpe:/a:mariadb:mariadb:10.0.7 cpe:/a:mariadb:mariadb:10.0.8 cpe:/a:mariadb:mariadb:10.0.9 cpe:/a:mariadb:mariadb:10.0.10 cpe:/a:mariadb:mariadb:10.0.11 cpe:/a:mariadb:mariadb:10.0.12 cpe:/a:mariadb:mariadb:10.0.13 cpe:/a:mariadb:mariadb:10.0.14 cpe:/a:mariadb:mariadb:10.0.15 cpe:/a:mariadb:mariadb:10.0.16 cpe:/a:mariadb:mariadb:10.0.17 cpe:/a:mariadb:mariadb:10.0.18 cpe:/a:mariadb:mariadb:10.0.19 cpe:/a:mariadb:mariadb:10.0.20 cpe:/a:mariadb:mariadb:10.0.21 cpe:/a:mariadb:mariadb:10.0.22 cpe:/a:mariadb:mariadb:10.0.23 cpe:/a:mariadb:mariadb:10.1.0 cpe:/a:mariadb:mariadb:10.1.1 cpe:/a:mariadb:mariadb:10.1.2 cpe:/a:mariadb:mariadb:10.1.3 cpe:/a:mariadb:mariadb:10.1.4 cpe:/a:mariadb:mariadb:10.1.5 cpe:/a:mariadb:mariadb:10.1.6 cpe:/a:mariadb:mariadb:10.1.7 cpe:/a:mariadb:mariadb:10.1.8 cpe:/a:mariadb:mariadb:10.1.9 cpe:/a:mariadb:mariadb:10.1.10 cpe:/a:mariadb:mariadb:10.1.11 cpe:/a:mariadb:mariadb:10.1.12 cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0668

2016-04-21T06:59:32.413-04:00

2019-04-22T13:48:00.643-04:00

1.7

NETWORK

HIGH

MULTIPLE_INSTANCES

NONE

PARTIAL

http://nvd.nist.gov

2019-02-19T13:49:12.467-05:00

SUSE openSUSE-SU-2016:1332 SUSE SUSE-SU-2016:1619 SUSE SUSE-SU-2016:1620 SUSE openSUSE-SU-2016:1664 SUSE openSUSE-SU-2016:1686 REDHAT RHSA-2016:0705 DEBIAN DSA-3595 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86467 SECTRACK 1035606 UBUNTU USN-2953-1 REDHAT RHSA-2016:1132 CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10024-release-notes/ CONFIRM https://mariadb.com/kb/en/mariadb/mariadb-10112-release-notes/ Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to InnoDB.

cpe:/o:oracle:solaris:11.3

CVE-2016-0669

2016-04-21T06:59:33.227-04:00

2016-12-02T22:17:05.293-05:00

5.2

LOCAL

LOW

SINGLE_INSTANCE

NONE

PARTIAL

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035629 Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect integrity and availability via vectors related to Fwflash.

CVE-2016-0670

2017-05-11T10:29:57.170-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:oracle:http_server:12.1.2.0

CVE-2016-0671

2016-04-21T06:59:34.243-04:00

2016-12-02T22:17:06.373-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035617 Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL Module.

cpe:/a:oracle:flexcube_direct_banking:12.0.2 cpe:/a:oracle:flexcube_direct_banking:12.0.3

CVE-2016-0672

2016-04-21T06:59:35.087-04:00

2016-12-02T22:17:07.403-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035604 Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to Pre-Login.

cpe:/a:oracle:siebel_ui_framework:8.1.1 cpe:/a:oracle:siebel_ui_framework:8.2.2

CVE-2016-0673

2016-04-21T06:59:35.930-04:00

2016-12-02T22:17:08.560-05:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035598 Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to UIF Open UI.

cpe:/a:oracle:siebel_core-common_components:8.1.1 cpe:/a:oracle:siebel_core-common_components:8.2.2

CVE-2016-0674

2016-04-21T06:59:36.757-04:00

2016-12-02T22:17:09.640-05:00

3.2

LOCAL

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035598 Unspecified vulnerability in the Siebel Core - Common Components component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows local users to affect confidentiality and integrity via vectors related to Email.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0

CVE-2016-0675

2016-04-21T06:59:37.603-04:00

2018-10-30T12:27:31.153-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86450 SECTRACK 1035615 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0700.

cpe:/o:oracle:solaris:10

CVE-2016-0676

2016-04-21T06:59:38.417-04:00

2016-12-02T22:17:11.717-05:00

4.0

LOCAL

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035629 Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to the kernel.

cpe:/a:oracle:database:12.1.0.1 cpe:/a:oracle:database:12.1.0.2

CVE-2016-0677

2016-04-21T06:59:39.430-04:00

2016-12-02T22:17:12.780-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035590 Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote attackers to affect availability via unknown vectors.

cpe:/a:oracle:vm_virtualbox:5.0.18

CVE-2016-0678

2016-04-21T06:59:40.290-04:00

2016-12-02T22:17:13.873-05:00

4.1

LOCAL

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:1451 SUSE openSUSE-SU-2016:1462 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035607 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.18 allows local users to affect confidentiality, integrity, and availability via vectors related to Core.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55 cpe:/a:oracle:peoplesoft_enterprise_peopletools:54

CVE-2016-0679

2016-04-21T06:59:41.133-04:00

2016-12-02T22:17:14.873-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect integrity and availability via vectors related to PIA Grids.

cpe:/a:oracle:peoplesoft_supply_chain_management_eprocurement:9.1 cpe:/a:oracle:peoplesoft_supply_chain_management_eprocurement:9.2

CVE-2016-0680

2016-04-21T06:59:41.963-04:00

2016-12-02T22:17:15.843-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Services Procurement.

cpe:/a:oracle:olap:11.2.0.4 cpe:/a:oracle:olap:12.1.0.1 cpe:/a:oracle:olap:12.1.0.2

CVE-2016-0681

2016-04-21T06:59:42.773-04:00

2016-12-02T22:17:17.000-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035590 Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unspecified vectors.

cpe:/a:oracle:oracle_berkeley_db:11.2.5.0.32 cpe:/a:oracle:oracle_berkeley_db:11.2.5.1.29 cpe:/a:oracle:oracle_berkeley_db:11.2.5.2.42 cpe:/a:oracle:oracle_berkeley_db:11.2.5.3.28 cpe:/a:oracle:oracle_berkeley_db:12.1.6.0.35 cpe:/a:oracle:oracle_berkeley_db:12.1.6.1.26

CVE-2016-0682

2016-04-21T06:59:43.727-04:00

2016-04-27T11:55:17.340-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-04-22T12:40:58.577-04:00

CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0689, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0683

2016-04-21T06:59:44.650-04:00

2016-12-02T22:17:18.140-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Search Framework.

cpe:/a:oracle:micros_arspos:1.5

CVE-2016-0684

2016-04-21T06:59:45.463-04:00

2016-12-02T22:17:19.297-05:00

6.8

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035600 Unspecified vulnerability in the Oracle Retail MICROS ARS POS component in Oracle Retail Applications 1.5 allows remote authenticated users to affect confidentiality via vectors related to POS.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0685

2016-04-21T06:59:46.273-04:00

2016-12-02T22:17:20.343-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to File Processing.

CVE-2016-0686

2016-04-21T06:59:47.103-04:00

2018-01-04T21:30:28.697-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2016:1222 SUSE openSUSE-SU-2016:1230 SUSE openSUSE-SU-2016:1235 SUSE SUSE-SU-2016:1248 SUSE SUSE-SU-2016:1250 SUSE openSUSE-SU-2016:1262 SUSE openSUSE-SU-2016:1265 SUSE SUSE-SU-2016:1299 SUSE SUSE-SU-2016:1300 SUSE SUSE-SU-2016:1303 SUSE SUSE-SU-2016:1378 SUSE SUSE-SU-2016:1379 SUSE SUSE-SU-2016:1388 SUSE SUSE-SU-2016:1458 SUSE SUSE-SU-2016:1475 REDHAT RHSA-2016:0650 REDHAT RHSA-2016:0651 REDHAT RHSA-2016:0675 REDHAT RHSA-2016:0676 REDHAT RHSA-2016:0677 REDHAT RHSA-2016:0678 REDHAT RHSA-2016:0679 REDHAT RHSA-2016:0701 REDHAT RHSA-2016:0702 REDHAT RHSA-2016:0708 REDHAT RHSA-2016:0716 REDHAT RHSA-2016:0723 REDHAT RHSA-2016:1039 DEBIAN DSA-3558 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 86473 SECTRACK 1035596 UBUNTU USN-2963-1 UBUNTU USN-2964-1 UBUNTU USN-2972-1 REDHAT RHSA-2016:1430 REDHAT RHSA-2017:1216 GENTOO GLSA-201606-18 CONFIRM https://security.netapp.com/advisory/ntap-20160420-0001/ Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

CVE-2016-0687

2016-04-21T06:59:47.917-04:00

2018-01-04T21:30:28.807-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2016:1222 SUSE openSUSE-SU-2016:1230 SUSE openSUSE-SU-2016:1235 SUSE SUSE-SU-2016:1248 SUSE SUSE-SU-2016:1250 SUSE openSUSE-SU-2016:1262 SUSE openSUSE-SU-2016:1265 SUSE SUSE-SU-2016:1299 SUSE SUSE-SU-2016:1300 SUSE SUSE-SU-2016:1303 SUSE SUSE-SU-2016:1378 SUSE SUSE-SU-2016:1379 SUSE SUSE-SU-2016:1388 SUSE SUSE-SU-2016:1458 SUSE SUSE-SU-2016:1475 REDHAT RHSA-2016:0650 REDHAT RHSA-2016:0651 REDHAT RHSA-2016:0675 REDHAT RHSA-2016:0676 REDHAT RHSA-2016:0677 REDHAT RHSA-2016:0678 REDHAT RHSA-2016:0679 REDHAT RHSA-2016:0701 REDHAT RHSA-2016:0702 REDHAT RHSA-2016:0708 REDHAT RHSA-2016:0716 REDHAT RHSA-2016:0723 REDHAT RHSA-2016:1039 DEBIAN DSA-3558 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 86459 SECTRACK 1035596 UBUNTU USN-2963-1 UBUNTU USN-2964-1 UBUNTU USN-2972-1 REDHAT RHSA-2016:1430 REDHAT RHSA-2017:1216 GENTOO GLSA-201606-18 CONFIRM https://security.netapp.com/advisory/ntap-20160420-0001/ Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0

CVE-2016-0688

2016-04-21T06:59:48.917-04:00

2018-10-30T12:27:31.153-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86469 SECTRACK 1035615 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components.

CVE-2016-0689

2016-04-21T06:59:49.837-04:00

2016-04-27T14:01:47.380-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-04-22T13:14:38.977-04:00

CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0692, CVE-2016-0694, and CVE-2016-3418.

cpe:/a:oracle:database:11.2.0.4 cpe:/a:oracle:database:12.1.0.1 cpe:/a:oracle:database:12.1.0.2

CVE-2016-0690

2016-04-21T06:59:50.743-04:00

2016-12-02T22:17:24.610-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035590 Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0691.

cpe:/a:oracle:database:11.2.0.4 cpe:/a:oracle:database:12.1.0.1 cpe:/a:oracle:database:12.1.0.2

CVE-2016-0691

2016-04-21T06:59:51.603-04:00

2016-12-02T22:17:25.737-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035590 Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0690.

CVE-2016-0692

2016-04-21T06:59:52.430-04:00

2016-04-27T12:44:58.400-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-04-22T13:25:42.927-04:00

CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0694, and CVE-2016-3418.

cpe:/o:oracle:solaris:10 cpe:/o:oracle:solaris:11.3

CVE-2016-0693

2016-04-21T06:59:53.260-04:00

2016-12-02T22:17:26.877-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035629 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the PAM LDAP module.

CVE-2016-0694

2016-04-21T06:59:54.277-04:00

2016-04-27T13:54:56.273-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-04-22T13:32:02.453-04:00

CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0682, CVE-2016-0689, CVE-2016-0692, and CVE-2016-3418.

cpe:/a:oracle:jdk:1.6.0:update_113 cpe:/a:oracle:jdk:1.7.0:update_99 cpe:/a:oracle:jdk:1.8.0:update_77 cpe:/a:oracle:jre:1.6.0:update_113 cpe:/a:oracle:jre:1.7.0:update_99 cpe:/a:oracle:jre:1.8.0:update_77 cpe:/a:oracle:jrockit:r28.3.9 cpe:/a:redhat:icedtea7:2.6.6:rc1 cpe:/o:oracle:linux:5.0 cpe:/o:oracle:linux:6.0 cpe:/o:oracle:linux:7.0 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:6.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:5.0 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:6.7.z cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0695

2016-04-21T06:59:55.117-04:00

2017-11-09T21:29:07.260-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov SUSE openSUSE-SU-2016:1222 SUSE openSUSE-SU-2016:1230 SUSE openSUSE-SU-2016:1235 SUSE SUSE-SU-2016:1248 SUSE SUSE-SU-2016:1250 SUSE openSUSE-SU-2016:1262 SUSE openSUSE-SU-2016:1265 REDHAT RHSA-2016:0650 REDHAT RHSA-2016:0651 REDHAT RHSA-2016:0675 REDHAT RHSA-2016:0676 REDHAT RHSA-2016:0677 REDHAT RHSA-2016:0678 REDHAT RHSA-2016:0679 REDHAT RHSA-2016:0723 DEBIAN DSA-3558 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 86438 SECTRACK 1035596 UBUNTU USN-2963-1 UBUNTU USN-2964-1 UBUNTU USN-2972-1 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10159 GENTOO GLSA-201606-18 CONFIRM https://security.netapp.com/advisory/ntap-20160420-0001/ Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security.

cpe:/a:oracle:weblogic_server:10.3.6.0.0

CVE-2016-0696

2016-04-21T06:59:55.963-04:00

2018-10-30T12:27:30.733-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86443 SECTRACK 1035615 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6 allows remote attackers to affect confidentiality and integrity via vectors related to Console.

cpe:/a:oracle:application_object_library:12.1.3 cpe:/a:oracle:application_object_library:12.2.3 cpe:/a:oracle:application_object_library:12.2.4 cpe:/a:oracle:application_object_library:12.2.5

CVE-2016-0697

2016-04-21T06:59:56.777-04:00

2016-12-02T22:17:30.220-05:00

3.6

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035603 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows local users to affect confidentiality and integrity via unknown vectors.

cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.53 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.54 cpe:/a:oracle:peoplesoft_enterprise_peopletools:8.55

CVE-2016-0698

2016-04-21T06:59:57.667-04:00

2016-12-02T22:17:31.330-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html SECTRACK 1035610 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality and integrity via vectors related to Rich Text Editor, a different vulnerability than CVE-2016-3423.

cpe:/a:oracle:flexcube_direct_banking:12.0.2 cpe:/a:oracle:flexcube_direct_banking:12.0.3

CVE-2016-0699

2016-04-21T06:59:58.633-04:00

2016-12-02T22:17:32.470-05:00

9.4

NETWORK

LOW

NONE

COMPLETE

NONE

cpe:/a:oracle:weblogic_server:10.3.6.0.0 cpe:/a:oracle:weblogic_server:12.1.2.0.0 cpe:/a:oracle:weblogic_server:12.1.3.0.0

CVE-2016-0700

2016-04-21T06:59:59.540-04:00

2018-10-30T12:27:31.153-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html BID 86453 SECTRACK 1035615 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Console, a different vulnerability than CVE-2016-0675.

cpe:/a:openssl:openssl:1.0.2 cpe:/a:openssl:openssl:1.0.2:beta1 cpe:/a:openssl:openssl:1.0.2:beta2 cpe:/a:openssl:openssl:1.0.2:beta3 cpe:/a:openssl:openssl:1.0.2a cpe:/a:openssl:openssl:1.0.2b cpe:/a:openssl:openssl:1.0.2c cpe:/a:openssl:openssl:1.0.2d cpe:/a:openssl:openssl:1.0.2e

CVE-2016-0701

2016-02-14T21:59:18.013-05:00

2017-12-12T21:29:09.233-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://intothesymmetry.blogspot.com/2016/01/openssl-key-recovery-attack-on-dh-small.html CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 FEDORA FEDORA-2016-527018d2ff SUSE openSUSE-SU-2016:0637 CONFIRM http://www.openssl.org/news/secadv/20160128.txt CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html BID 82233 BID 91787 SECTRACK 1034849 UBUNTU USN-2883-1 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=878e2c5b13010329c203f309ed0c8f2113f85648 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=c5b831f21d0d29d1e517d139d9d101763f60c9a2 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03724en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164821 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390893 GENTOO GLSA-201601-05 CERT-VN VU#257823 MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

CVE-2016-0702

2016-03-03T15:59:00.080-05:00

2018-01-04T21:30:28.963-05:00

1.9

LOCAL

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://cachebleed.info CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 FEDORA FEDORA-2016-2802690366 FEDORA FEDORA-2016-e6807b3394 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0627 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE SUSE-SU-2016:0641 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 SUSE openSUSE-SU-2016:1239 SUSE openSUSE-SU-2016:1241 SUSE openSUSE-SU-2016:1242 SUSE SUSE-SU-2016:1267 SUSE openSUSE-SU-2016:1273 SUSE SUSE-SU-2016:1290 SUSE SUSE-SU-2016:1360 SUSE openSUSE-SU-2016:1566 HP HPSBGN03563 CONFIRM http://openssl.org/news/secadv/20160301.txt REDHAT RHSA-2016:2957 CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 DEBIAN DSA-3500 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html SECTRACK 1035133 UBUNTU USN-2914-1 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=708dc2f1291e104fe4eef810bb8ffc1fae5b19c1 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.

cpe:/a:openssl:openssl:0.9.8ze cpe:/a:openssl:openssl:1.0.0 cpe:/a:openssl:openssl:1.0.0:beta1 cpe:/a:openssl:openssl:1.0.0:beta2 cpe:/a:openssl:openssl:1.0.0:beta3 cpe:/a:openssl:openssl:1.0.0:beta4 cpe:/a:openssl:openssl:1.0.0:beta5 cpe:/a:openssl:openssl:1.0.0a cpe:/a:openssl:openssl:1.0.0b cpe:/a:openssl:openssl:1.0.0c cpe:/a:openssl:openssl:1.0.0d cpe:/a:openssl:openssl:1.0.0e cpe:/a:openssl:openssl:1.0.0f cpe:/a:openssl:openssl:1.0.0g cpe:/a:openssl:openssl:1.0.0h cpe:/a:openssl:openssl:1.0.0i cpe:/a:openssl:openssl:1.0.0j cpe:/a:openssl:openssl:1.0.0k cpe:/a:openssl:openssl:1.0.0l cpe:/a:openssl:openssl:1.0.0m cpe:/a:openssl:openssl:1.0.0n cpe:/a:openssl:openssl:1.0.0o cpe:/a:openssl:openssl:1.0.0p cpe:/a:openssl:openssl:1.0.0q cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.1g cpe:/a:openssl:openssl:1.0.1h cpe:/a:openssl:openssl:1.0.1i cpe:/a:openssl:openssl:1.0.1j cpe:/a:openssl:openssl:1.0.1k cpe:/a:openssl:openssl:1.0.1l cpe:/a:openssl:openssl:1.0.2 cpe:/a:openssl:openssl:1.0.2:beta1 cpe:/a:openssl:openssl:1.0.2:beta2 cpe:/a:openssl:openssl:1.0.2:beta3

CVE-2016-0703

2016-03-02T06:59:00.113-05:00

2018-01-18T13:18:03.087-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE SUSE-SU-2016:0641 SUSE SUSE-SU-2016:0678 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 CONFIRM http://openssl.org/news/secadv/20160301.txt CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 83743 SECTRACK 1035133 MISC https://drownattack.com CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=ae50d8270026edf5b3c7f8aaa0c6677462b33d97 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher, which allows man-in-the-middle attackers to determine the MASTER-KEY value and decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

CVE-2016-0704

2016-03-02T06:59:01.363-05:00

2018-01-18T13:18:03.213-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE SUSE-SU-2016:0641 SUSE SUSE-SU-2016:0678 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 CONFIRM http://openssl.org/news/secadv/20160301.txt CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 83764 SECTRACK 1035133 MISC https://drownattack.com CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=ae50d8270026edf5b3c7f8aaa0c6677462b33d97 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

cpe:/a:openssl:openssl:1.0.1 cpe:/a:openssl:openssl:1.0.1:beta1 cpe:/a:openssl:openssl:1.0.1:beta2 cpe:/a:openssl:openssl:1.0.1:beta3 cpe:/a:openssl:openssl:1.0.1a cpe:/a:openssl:openssl:1.0.1b cpe:/a:openssl:openssl:1.0.1c cpe:/a:openssl:openssl:1.0.1d cpe:/a:openssl:openssl:1.0.1e cpe:/a:openssl:openssl:1.0.1f cpe:/a:openssl:openssl:1.0.1g cpe:/a:openssl:openssl:1.0.1h cpe:/a:openssl:openssl:1.0.1i cpe:/a:openssl:openssl:1.0.1j cpe:/a:openssl:openssl:1.0.1k cpe:/a:openssl:openssl:1.0.1l cpe:/a:openssl:openssl:1.0.1m cpe:/a:openssl:openssl:1.0.1n cpe:/a:openssl:openssl:1.0.1o cpe:/a:openssl:openssl:1.0.1p cpe:/a:openssl:openssl:1.0.1q cpe:/a:openssl:openssl:1.0.1r cpe:/a:openssl:openssl:1.0.2 cpe:/a:openssl:openssl:1.0.2:beta1 cpe:/a:openssl:openssl:1.0.2:beta2 cpe:/a:openssl:openssl:1.0.2:beta3 cpe:/a:openssl:openssl:1.0.2a cpe:/a:openssl:openssl:1.0.2b cpe:/a:openssl:openssl:1.0.2c cpe:/a:openssl:openssl:1.0.2d cpe:/a:openssl:openssl:1.0.2e cpe:/a:openssl:openssl:1.0.2f cpe:/a:oracle:mysql:5.6.0 cpe:/a:oracle:mysql:5.6.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.6.1 cpe:/a:oracle:mysql:5.6.2 cpe:/a:oracle:mysql:5.6.3 cpe:/a:oracle:mysql:5.6.4 cpe:/a:oracle:mysql:5.6.5 cpe:/a:oracle:mysql:5.6.6 cpe:/a:oracle:mysql:5.6.7 cpe:/a:oracle:mysql:5.6.8 cpe:/a:oracle:mysql:5.6.9 cpe:/a:oracle:mysql:5.6.10 cpe:/a:oracle:mysql:5.6.11 cpe:/a:oracle:mysql:5.6.12 cpe:/a:oracle:mysql:5.6.13 cpe:/a:oracle:mysql:5.6.14 cpe:/a:oracle:mysql:5.6.15 cpe:/a:oracle:mysql:5.6.16 cpe:/a:oracle:mysql:5.6.17 cpe:/a:oracle:mysql:5.6.18 cpe:/a:oracle:mysql:5.6.19 cpe:/a:oracle:mysql:5.6.20 cpe:/a:oracle:mysql:5.6.21 cpe:/a:oracle:mysql:5.6.22 cpe:/a:oracle:mysql:5.6.23 cpe:/a:oracle:mysql:5.6.24 cpe:/a:oracle:mysql:5.6.25 cpe:/a:oracle:mysql:5.6.26 cpe:/a:oracle:mysql:5.6.27 cpe:/a:oracle:mysql:5.6.28 cpe:/a:oracle:mysql:5.6.29 cpe:/a:oracle:mysql:5.7.0 cpe:/a:oracle:mysql:5.7.0::~~community~~~ cpe:/a:oracle:mysql:5.7.0::~~enterprise~~~ cpe:/a:oracle:mysql:5.7.1 cpe:/a:oracle:mysql:5.7.2 cpe:/a:oracle:mysql:5.7.3 cpe:/a:oracle:mysql:5.7.4 cpe:/a:oracle:mysql:5.7.5 cpe:/a:oracle:mysql:5.7.6 cpe:/a:oracle:mysql:5.7.7 cpe:/a:oracle:mysql:5.7.8 cpe:/a:oracle:mysql:5.7.9 cpe:/a:oracle:mysql:5.7.10 cpe:/a:oracle:mysql:5.7.11 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0705

2016-03-03T15:59:00.953-05:00

2019-02-20T11:59:43.587-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-02-20T11:00:42.157-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 FEDORA FEDORA-2016-2802690366 FEDORA FEDORA-2016-e6807b3394 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0627 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE SUSE-SU-2016:1057 SUSE openSUSE-SU-2016:1332 SUSE openSUSE-SU-2016:1566 HP HPSBGN03563 HP HPSBGN03569 HP HPSBMU03575 CONFIRM http://openssl.org/news/secadv/20160301.txt REDHAT RHSA-2016:2957 CONFIRM http://source.android.com/security/bulletin/2016-05-01.html CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 DEBIAN DSA-3500 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 83754 BID 91787 SECTRACK 1035133 UBUNTU USN-2914-1 REDHAT RHSA-2018:2568 REDHAT RHSA-2018:2575 REDHAT RHSA-2018:2713 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=6c88c71b4e4825c7bc0489306d062d017634eb88 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05301946 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.0:alpha cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.1:alpha cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.2:alpha cpe:/a:apache:tomcat:6.0.2:beta cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.4:alpha cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:6.0.41 cpe:/a:apache:tomcat:6.0.43 cpe:/a:apache:tomcat:6.0.44 cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5:beta cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:7.0.55 cpe:/a:apache:tomcat:7.0.56 cpe:/a:apache:tomcat:7.0.57 cpe:/a:apache:tomcat:7.0.59 cpe:/a:apache:tomcat:7.0.61 cpe:/a:apache:tomcat:7.0.62 cpe:/a:apache:tomcat:7.0.63 cpe:/a:apache:tomcat:7.0.64 cpe:/a:apache:tomcat:7.0.65 cpe:/a:apache:tomcat:7.0.67 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc3 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.11 cpe:/a:apache:tomcat:8.0.12 cpe:/a:apache:tomcat:8.0.14 cpe:/a:apache:tomcat:8.0.15 cpe:/a:apache:tomcat:8.0.17 cpe:/a:apache:tomcat:8.0.18 cpe:/a:apache:tomcat:8.0.20 cpe:/a:apache:tomcat:8.0.21 cpe:/a:apache:tomcat:8.0.22 cpe:/a:apache:tomcat:8.0.23 cpe:/a:apache:tomcat:8.0.24 cpe:/a:apache:tomcat:8.0.26 cpe:/a:apache:tomcat:8.0.27 cpe:/a:apache:tomcat:8.0.28 cpe:/a:apache:tomcat:8.0.29 cpe:/a:apache:tomcat:8.0.30 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2016-0706

2016-02-24T20:59:04.340-05:00

2019-04-15T12:30:19.230-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov SUSE SUSE-SU-2016:0769 SUSE SUSE-SU-2016:0822 SUSE SUSE-SU-2016:0839 SUSE openSUSE-SU-2016:0865 HP HPSBUX03561 REDHAT RHSA-2016:1089 REDHAT RHSA-2016:2045 REDHAT RHSA-2016:2599 REDHAT RHSA-2016:2807 REDHAT RHSA-2016:2808 BUGTRAQ 20160222 [SECURITY] CVE-2016-0706 Apache Tomcat Security Manager bypass CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1722799 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1722800 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1722801 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1722802 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html CONFIRM http://tomcat.apache.org/security-9.html DEBIAN DSA-3530 DEBIAN DSA-3552 DEBIAN DSA-3609 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html BID 83324 SECTRACK 1035069 UBUNTU USN-3024-1 REDHAT RHSA-2016:1087 REDHAT RHSA-2016:1088 CONFIRM https://bto.bluecoat.com/security-advisory/sa118 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ GENTOO GLSA-201705-09 CONFIRM https://security.netapp.com/advisory/ntap-20180531-0001/ Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

cpe:/a:apache:ambari:2.1.1

CVE-2016-0707

2016-05-18T10:59:01.770-04:00

2016-05-18T17:46:32.260-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-18T12:21:21.403-04:00

CONFIRM https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.1.2 The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories.

cpe:/a:cloudfoundry:cf-release:166 cpe:/a:cloudfoundry:cf-release:167 cpe:/a:cloudfoundry:cf-release:168 cpe:/a:cloudfoundry:cf-release:169 cpe:/a:cloudfoundry:cf-release:170 cpe:/a:cloudfoundry:cf-release:171 cpe:/a:cloudfoundry:cf-release:172 cpe:/a:cloudfoundry:cf-release:173 cpe:/a:cloudfoundry:cf-release:174 cpe:/a:cloudfoundry:cf-release:175 cpe:/a:cloudfoundry:cf-release:176 cpe:/a:cloudfoundry:cf-release:177 cpe:/a:cloudfoundry:cf-release:178 cpe:/a:cloudfoundry:cf-release:179 cpe:/a:cloudfoundry:cf-release:180 cpe:/a:cloudfoundry:cf-release:181 cpe:/a:cloudfoundry:cf-release:182 cpe:/a:cloudfoundry:cf-release:183 cpe:/a:cloudfoundry:cf-release:184 cpe:/a:cloudfoundry:cf-release:185 cpe:/a:cloudfoundry:cf-release:186 cpe:/a:cloudfoundry:cf-release:187 cpe:/a:cloudfoundry:cf-release:188 cpe:/a:cloudfoundry:cf-release:189 cpe:/a:cloudfoundry:cf-release:190 cpe:/a:cloudfoundry:cf-release:191 cpe:/a:cloudfoundry:cf-release:192 cpe:/a:cloudfoundry:cf-release:193 cpe:/a:cloudfoundry:cf-release:194 cpe:/a:cloudfoundry:cf-release:195 cpe:/a:cloudfoundry:cf-release:196 cpe:/a:cloudfoundry:cf-release:197 cpe:/a:cloudfoundry:cf-release:198 cpe:/a:cloudfoundry:cf-release:199 cpe:/a:cloudfoundry:cf-release:200 cpe:/a:cloudfoundry:cf-release:201 cpe:/a:cloudfoundry:cf-release:202 cpe:/a:cloudfoundry:cf-release:203 cpe:/a:cloudfoundry:cf-release:204 cpe:/a:cloudfoundry:cf-release:205 cpe:/a:cloudfoundry:cf-release:206 cpe:/a:cloudfoundry:cf-release:207 cpe:/a:cloudfoundry:cf-release:208 cpe:/a:cloudfoundry:cf-release:209 cpe:/a:cloudfoundry:cf-release:210 cpe:/a:cloudfoundry:cf-release:211 cpe:/a:cloudfoundry:cf-release:212 cpe:/a:cloudfoundry:cf-release:213 cpe:/a:cloudfoundry:cf-release:214 cpe:/a:cloudfoundry:cf-release:215 cpe:/a:cloudfoundry:cf-release:216 cpe:/a:cloudfoundry:cf-release:217 cpe:/a:cloudfoundry:cf-release:218 cpe:/a:cloudfoundry:cf-release:219 cpe:/a:cloudfoundry:cf-release:220 cpe:/a:cloudfoundry:cf-release:221 cpe:/a:cloudfoundry:cf-release:222 cpe:/a:cloudfoundry:cf-release:223 cpe:/a:cloudfoundry:cf-release:224 cpe:/a:cloudfoundry:cf-release:225 cpe:/a:cloudfoundry:cf-release:226 cpe:/a:cloudfoundry:cf-release:227 cpe:/a:cloudfoundry:java_buildpack:2.0 cpe:/a:cloudfoundry:java_buildpack:2.0.2 cpe:/a:cloudfoundry:java_buildpack:2.1 cpe:/a:cloudfoundry:java_buildpack:2.1.1 cpe:/a:cloudfoundry:java_buildpack:2.1.2 cpe:/a:cloudfoundry:java_buildpack:2.2 cpe:/a:cloudfoundry:java_buildpack:2.3 cpe:/a:cloudfoundry:java_buildpack:2.4 cpe:/a:cloudfoundry:java_buildpack:2.5 cpe:/a:cloudfoundry:java_buildpack:2.6 cpe:/a:cloudfoundry:java_buildpack:2.6.1 cpe:/a:cloudfoundry:java_buildpack:2.7 cpe:/a:cloudfoundry:java_buildpack:2.7.1 cpe:/a:cloudfoundry:java_buildpack:3.0 cpe:/a:cloudfoundry:java_buildpack:3.1 cpe:/a:cloudfoundry:java_buildpack:3.1.1 cpe:/a:cloudfoundry:java_buildpack:3.2 cpe:/a:cloudfoundry:java_buildpack:3.3 cpe:/a:cloudfoundry:java_buildpack:3.3.1 cpe:/a:cloudfoundry:java_buildpack:3.4

CVE-2016-0708

2018-07-11T16:29:00.227-04:00

2018-09-11T14:49:33.573-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-09-10T13:49:28.793-04:00

CONFIRM https://www.cloudfoundry.org/blog/cve-2016-0708/ Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack detection, passed through the Java Buildpack detection script, and allow the serving of static content from within the deployed artifact. The default Apache Tomcat configuration in the affected java buildpack versions for some basic web application archive (WAR) packaged applications are vulnerable to this issue.

cpe:/a:apache:jetspeed:2.3.0

CVE-2016-0709

2016-04-11T10:59:01.677-04:00

2016-04-20T14:14:29.950-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2016-04-12T13:46:00.047-04:00

MISC http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and MISC http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload MLIST [portals-jetspeed-user] 20160303 [CVE-2016-0709] Apache Jetspeed information disclosure vulnerability CONFIRM https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709 EXPLOIT-DB 39643 Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."

cpe:/a:apache:jetspeed:2.3.0

CVE-2016-0710

2016-04-11T10:59:03.160-04:00

2016-04-20T14:24:05.147-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-04-12T13:48:44.083-04:00

MISC http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and MISC http://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.html MISC http://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_upload MLIST [portals-jetspeed-user] 20160303 [CVE-2016-0710] Apache Jetspeed information disclosure vulnerability CONFIRM https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710 EXPLOIT-DB 39643 Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.

cpe:/a:apache:jetspeed:2.3.0

CVE-2016-0711

2016-04-11T10:59:04.253-04:00

2016-04-20T14:41:00.480-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-04-12T13:51:43.870-04:00

MLIST [portals-jetspeed-user] 20160303 [CVE-2016-0711] Apache Jetspeed information disclosure vulnerability CONFIRM https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0711 Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource.

cpe:/a:apache:jetspeed:2.3.0

CVE-2016-0712

2016-04-11T10:59:05.363-04:00

2016-04-20T14:42:30.247-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-04-12T13:53:20.843-04:00

MLIST [portals-jetspeed-user] 20160303 [CVE-2016-0712] Apache Jetspeed information disclosure vulnerability CONFIRM https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0712 Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.

cpe:/a:cloudfoundry:cf-release:141 cpe:/a:cloudfoundry:cf-release:142 cpe:/a:cloudfoundry:cf-release:143 cpe:/a:cloudfoundry:cf-release:144 cpe:/a:cloudfoundry:cf-release:145 cpe:/a:cloudfoundry:cf-release:146 cpe:/a:cloudfoundry:cf-release:147 cpe:/a:cloudfoundry:cf-release:148 cpe:/a:cloudfoundry:cf-release:149 cpe:/a:cloudfoundry:cf-release:150 cpe:/a:cloudfoundry:cf-release:151 cpe:/a:cloudfoundry:cf-release:152 cpe:/a:cloudfoundry:cf-release:153 cpe:/a:cloudfoundry:cf-release:154 cpe:/a:cloudfoundry:cf-release:155 cpe:/a:cloudfoundry:cf-release:156 cpe:/a:cloudfoundry:cf-release:157 cpe:/a:cloudfoundry:cf-release:158 cpe:/a:cloudfoundry:cf-release:159 cpe:/a:cloudfoundry:cf-release:160 cpe:/a:cloudfoundry:cf-release:161 cpe:/a:cloudfoundry:cf-release:162 cpe:/a:cloudfoundry:cf-release:163 cpe:/a:cloudfoundry:cf-release:164 cpe:/a:cloudfoundry:cf-release:165 cpe:/a:cloudfoundry:cf-release:166 cpe:/a:cloudfoundry:cf-release:167 cpe:/a:cloudfoundry:cf-release:168 cpe:/a:cloudfoundry:cf-release:169 cpe:/a:cloudfoundry:cf-release:170 cpe:/a:cloudfoundry:cf-release:171 cpe:/a:cloudfoundry:cf-release:172 cpe:/a:cloudfoundry:cf-release:173 cpe:/a:cloudfoundry:cf-release:174 cpe:/a:cloudfoundry:cf-release:175 cpe:/a:cloudfoundry:cf-release:176 cpe:/a:cloudfoundry:cf-release:177 cpe:/a:cloudfoundry:cf-release:178 cpe:/a:cloudfoundry:cf-release:179 cpe:/a:cloudfoundry:cf-release:180 cpe:/a:cloudfoundry:cf-release:181 cpe:/a:cloudfoundry:cf-release:182 cpe:/a:cloudfoundry:cf-release:183 cpe:/a:cloudfoundry:cf-release:184 cpe:/a:cloudfoundry:cf-release:185 cpe:/a:cloudfoundry:cf-release:186 cpe:/a:cloudfoundry:cf-release:187 cpe:/a:cloudfoundry:cf-release:188 cpe:/a:cloudfoundry:cf-release:189 cpe:/a:cloudfoundry:cf-release:190 cpe:/a:cloudfoundry:cf-release:191 cpe:/a:cloudfoundry:cf-release:192 cpe:/a:cloudfoundry:cf-release:193 cpe:/a:cloudfoundry:cf-release:194 cpe:/a:cloudfoundry:cf-release:195 cpe:/a:cloudfoundry:cf-release:196 cpe:/a:cloudfoundry:cf-release:197 cpe:/a:cloudfoundry:cf-release:198 cpe:/a:cloudfoundry:cf-release:199 cpe:/a:cloudfoundry:cf-release:200 cpe:/a:cloudfoundry:cf-release:201 cpe:/a:cloudfoundry:cf-release:202 cpe:/a:cloudfoundry:cf-release:203 cpe:/a:cloudfoundry:cf-release:204 cpe:/a:cloudfoundry:cf-release:205 cpe:/a:cloudfoundry:cf-release:206 cpe:/a:cloudfoundry:cf-release:207 cpe:/a:cloudfoundry:cf-release:208 cpe:/a:cloudfoundry:cf-release:209 cpe:/a:cloudfoundry:cf-release:210 cpe:/a:cloudfoundry:cf-release:211 cpe:/a:cloudfoundry:cf-release:212 cpe:/a:cloudfoundry:cf-release:213 cpe:/a:cloudfoundry:cf-release:214 cpe:/a:cloudfoundry:cf-release:215 cpe:/a:cloudfoundry:cf-release:216 cpe:/a:cloudfoundry:cf-release:217 cpe:/a:cloudfoundry:cf-release:218 cpe:/a:cloudfoundry:cf-release:219 cpe:/a:cloudfoundry:cf-release:220 cpe:/a:cloudfoundry:cf-release:221 cpe:/a:cloudfoundry:cf-release:222 cpe:/a:cloudfoundry:cf-release:223 cpe:/a:cloudfoundry:cf-release:224 cpe:/a:cloudfoundry:cf-release:225 cpe:/a:cloudfoundry:cf-release:226 cpe:/a:cloudfoundry:cf-release:227 cpe:/a:cloudfoundry:cf-release:228

CVE-2016-0713

2017-08-31T10:29:00.197-04:00

2017-09-05T14:48:55.657-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-09-05T14:40:46.360-04:00

CONFIRM https://bosh.io/releases/github.com/cloudfoundry/cf-release?version=229 MLIST [cf-dev] 20160201 CVE-2016-0713 Gorouter XSS Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests.

CVE-2016-0714

2016-02-24T20:59:05.263-05:00

2019-04-15T12:30:24.230-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov SUSE SUSE-SU-2016:0769 SUSE SUSE-SU-2016:0822 SUSE SUSE-SU-2016:0839 SUSE openSUSE-SU-2016:0865 HP HPSBUX03561 REDHAT RHSA-2016:1089 REDHAT RHSA-2016:2045 REDHAT RHSA-2016:2599 REDHAT RHSA-2016:2807 REDHAT RHSA-2016:2808 BUGTRAQ 20160222 [SECURITY] CVE-2016-0714 Apache Tomcat Security Manager Bypass CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1725263 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1725914 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1726196 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1726203 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1726923 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1727034 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1727166 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1727182 CONFIRM http://tomcat.apache.org/security-6.html CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html CONFIRM http://tomcat.apache.org/security-9.html DEBIAN DSA-3530 DEBIAN DSA-3552 DEBIAN DSA-3609 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html BID 83327 SECTRACK 1035069 SECTRACK 1037640 UBUNTU USN-3024-1 REDHAT RHSA-2016:1087 REDHAT RHSA-2016:1088 CONFIRM https://bto.bluecoat.com/security-advisory/sa118 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ GENTOO GLSA-201705-09 CONFIRM https://security.netapp.com/advisory/ntap-20180531-0001/ The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

CVE-2016-0715

2018-09-11T13:29:00.223-04:00

2019-10-09T19:16:19.697-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM https://pivotal.io/security/cve-2016-0715 Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure. It was found that original mitigation configuration instructions provided as part of CVE-2016-0708 were incomplete and could leave PHP Buildpack, Staticfile Buildpack and potentially other custom Buildpack applications vulnerable to remote information disclosure. Affected applications use automated buildpack detection, serve files directly from the root of the application and have a buildpack that matched after the Java Buildpack in the system buildpack priority when Java Buildpack versions 2.0 through 3.4 were present.

CVE-2016-0716

2016-02-18T10:59:00.113-05:00

2016-02-18T10:59:00.377-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0729. Reason: This candidate is a reservation duplicate of CVE-2016-0729. Notes: All CVE users should reference CVE-2016-0729 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-0717

2016-02-18T10:59:00.410-05:00

cpe:/a:libexpat:expat:- cpe:/a:libexpat:expat:1.95.0 cpe:/a:libexpat:expat:1.95.1 cpe:/a:libexpat:expat:1.95.2 cpe:/a:libexpat:expat:1.95.3 cpe:/a:libexpat:expat:1.95.4 cpe:/a:libexpat:expat:1.95.5 cpe:/a:libexpat:expat:1.95.6 cpe:/a:libexpat:expat:1.95.7 cpe:/a:libexpat:expat:1.95.8 cpe:/a:libexpat:expat:2.0.0 cpe:/a:libexpat:expat:2.0.1 cpe:/a:libexpat:expat:2.1.0 cpe:/a:libexpat:expat:2.1.1 cpe:/a:mozilla:firefox:- cpe:/a:mozilla:firefox:0.1 cpe:/a:mozilla:firefox:0.2 cpe:/a:mozilla:firefox:0.3 cpe:/a:mozilla:firefox:0.4 cpe:/a:mozilla:firefox:0.5 cpe:/a:mozilla:firefox:0.6 cpe:/a:mozilla:firefox:0.6.1 cpe:/a:mozilla:firefox:0.7 cpe:/a:mozilla:firefox:0.7.1 cpe:/a:mozilla:firefox:0.8 cpe:/a:mozilla:firefox:0.9 cpe:/a:mozilla:firefox:0.9:rc cpe:/a:mozilla:firefox:0.9.1 cpe:/a:mozilla:firefox:0.9.2 cpe:/a:mozilla:firefox:0.9.3 cpe:/a:mozilla:firefox:0.10 cpe:/a:mozilla:firefox:0.10.1 cpe:/a:mozilla:firefox:1.0 cpe:/a:mozilla:firefox:1.0:preview_release cpe:/a:mozilla:firefox:1.0.1 cpe:/a:mozilla:firefox:1.0.2 cpe:/a:mozilla:firefox:1.0.3 cpe:/a:mozilla:firefox:1.0.4 cpe:/a:mozilla:firefox:1.0.5 cpe:/a:mozilla:firefox:1.0.6 cpe:/a:mozilla:firefox:1.0.7 cpe:/a:mozilla:firefox:1.0.8 cpe:/a:mozilla:firefox:1.4.1 cpe:/a:mozilla:firefox:1.5 cpe:/a:mozilla:firefox:1.5:beta1 cpe:/a:mozilla:firefox:1.5:beta2 cpe:/a:mozilla:firefox:1.5.0.1 cpe:/a:mozilla:firefox:1.5.0.2 cpe:/a:mozilla:firefox:1.5.0.3 cpe:/a:mozilla:firefox:1.5.0.4 cpe:/a:mozilla:firefox:1.5.0.5 cpe:/a:mozilla:firefox:1.5.0.6 cpe:/a:mozilla:firefox:1.5.0.7 cpe:/a:mozilla:firefox:1.5.0.8 cpe:/a:mozilla:firefox:1.5.0.9 cpe:/a:mozilla:firefox:1.5.0.10 cpe:/a:mozilla:firefox:1.5.0.11 cpe:/a:mozilla:firefox:1.5.0.12 cpe:/a:mozilla:firefox:1.5.1 cpe:/a:mozilla:firefox:1.5.2 cpe:/a:mozilla:firefox:1.5.3 cpe:/a:mozilla:firefox:1.5.4 cpe:/a:mozilla:firefox:1.5.5 cpe:/a:mozilla:firefox:1.5.6 cpe:/a:mozilla:firefox:1.5.7 cpe:/a:mozilla:firefox:1.5.8 cpe:/a:mozilla:firefox:1.8 cpe:/a:mozilla:firefox:2.0 cpe:/a:mozilla:firefox:2.0.0.1 cpe:/a:mozilla:firefox:2.0.0.2 cpe:/a:mozilla:firefox:2.0.0.3 cpe:/a:mozilla:firefox:2.0.0.4 cpe:/a:mozilla:firefox:2.0.0.5 cpe:/a:mozilla:firefox:2.0.0.6 cpe:/a:mozilla:firefox:2.0.0.7 cpe:/a:mozilla:firefox:2.0.0.8 cpe:/a:mozilla:firefox:2.0.0.9 cpe:/a:mozilla:firefox:2.0.0.10 cpe:/a:mozilla:firefox:2.0.0.11 cpe:/a:mozilla:firefox:2.0.0.12 cpe:/a:mozilla:firefox:2.0.0.13 cpe:/a:mozilla:firefox:2.0.0.14 cpe:/a:mozilla:firefox:2.0.0.15 cpe:/a:mozilla:firefox:2.0.0.16 cpe:/a:mozilla:firefox:2.0.0.17 cpe:/a:mozilla:firefox:2.0.0.18 cpe:/a:mozilla:firefox:2.0.0.19 cpe:/a:mozilla:firefox:2.0.0.20 cpe:/a:mozilla:firefox:3.0 cpe:/a:mozilla:firefox:3.0:beta2 cpe:/a:mozilla:firefox:3.0.1 cpe:/a:mozilla:firefox:3.0.2 cpe:/a:mozilla:firefox:3.0.3 cpe:/a:mozilla:firefox:3.0.4 cpe:/a:mozilla:firefox:3.0.5 cpe:/a:mozilla:firefox:3.0.6 cpe:/a:mozilla:firefox:3.0.7 cpe:/a:mozilla:firefox:3.0.8 cpe:/a:mozilla:firefox:3.0.9 cpe:/a:mozilla:firefox:3.0.10 cpe:/a:mozilla:firefox:3.0.11 cpe:/a:mozilla:firefox:3.0.12 cpe:/a:mozilla:firefox:3.0.13 cpe:/a:mozilla:firefox:3.0.14 cpe:/a:mozilla:firefox:3.0.15 cpe:/a:mozilla:firefox:3.0.16 cpe:/a:mozilla:firefox:3.0.17 cpe:/a:mozilla:firefox:3.0.18 cpe:/a:mozilla:firefox:3.0.19 cpe:/a:mozilla:firefox:3.5 cpe:/a:mozilla:firefox:3.5.1 cpe:/a:mozilla:firefox:3.5.2 cpe:/a:mozilla:firefox:3.5.3 cpe:/a:mozilla:firefox:3.5.4 cpe:/a:mozilla:firefox:3.5.5 cpe:/a:mozilla:firefox:3.5.6 cpe:/a:mozilla:firefox:3.5.7 cpe:/a:mozilla:firefox:3.5.8 cpe:/a:mozilla:firefox:3.5.9 cpe:/a:mozilla:firefox:3.5.10 cpe:/a:mozilla:firefox:3.5.11 cpe:/a:mozilla:firefox:3.5.12 cpe:/a:mozilla:firefox:3.5.13 cpe:/a:mozilla:firefox:3.5.14 cpe:/a:mozilla:firefox:3.5.15 cpe:/a:mozilla:firefox:3.5.16 cpe:/a:mozilla:firefox:3.5.17 cpe:/a:mozilla:firefox:3.5.18 cpe:/a:mozilla:firefox:3.5.19 cpe:/a:mozilla:firefox:3.6 cpe:/a:mozilla:firefox:3.6.2 cpe:/a:mozilla:firefox:3.6.3 cpe:/a:mozilla:firefox:3.6.4 cpe:/a:mozilla:firefox:3.6.6 cpe:/a:mozilla:firefox:3.6.7 cpe:/a:mozilla:firefox:3.6.8 cpe:/a:mozilla:firefox:3.6.9 cpe:/a:mozilla:firefox:3.6.10 cpe:/a:mozilla:firefox:3.6.11 cpe:/a:mozilla:firefox:3.6.12 cpe:/a:mozilla:firefox:3.6.13 cpe:/a:mozilla:firefox:3.6.14 cpe:/a:mozilla:firefox:3.6.15 cpe:/a:mozilla:firefox:3.6.16 cpe:/a:mozilla:firefox:3.6.17 cpe:/a:mozilla:firefox:3.6.18 cpe:/a:mozilla:firefox:3.6.19 cpe:/a:mozilla:firefox:3.6.20 cpe:/a:mozilla:firefox:3.6.21 cpe:/a:mozilla:firefox:3.6.22 cpe:/a:mozilla:firefox:3.6.23 cpe:/a:mozilla:firefox:3.6.24 cpe:/a:mozilla:firefox:3.6.25 cpe:/a:mozilla:firefox:3.6.26 cpe:/a:mozilla:firefox:3.6.27 cpe:/a:mozilla:firefox:3.6.28 cpe:/a:mozilla:firefox:4.0 cpe:/a:mozilla:firefox:4.0:beta1 cpe:/a:mozilla:firefox:4.0:beta10 cpe:/a:mozilla:firefox:4.0:beta11 cpe:/a:mozilla:firefox:4.0:beta12 cpe:/a:mozilla:firefox:4.0:beta2 cpe:/a:mozilla:firefox:4.0:beta3 cpe:/a:mozilla:firefox:4.0:beta4 cpe:/a:mozilla:firefox:4.0:beta5 cpe:/a:mozilla:firefox:4.0:beta6 cpe:/a:mozilla:firefox:4.0:beta7 cpe:/a:mozilla:firefox:4.0:beta8 cpe:/a:mozilla:firefox:4.0:beta9 cpe:/a:mozilla:firefox:4.0.1 cpe:/a:mozilla:firefox:5.0 cpe:/a:mozilla:firefox:5.0.1 cpe:/a:mozilla:firefox:6.0 cpe:/a:mozilla:firefox:6.0.1 cpe:/a:mozilla:firefox:6.0.2 cpe:/a:mozilla:firefox:7.0 cpe:/a:mozilla:firefox:7.0.1 cpe:/a:mozilla:firefox:8.0 cpe:/a:mozilla:firefox:8.0.1 cpe:/a:mozilla:firefox:9.0 cpe:/a:mozilla:firefox:9.0.1 cpe:/a:mozilla:firefox:10.0 cpe:/a:mozilla:firefox:10.0.1 cpe:/a:mozilla:firefox:10.0.2 cpe:/a:mozilla:firefox:10.0.3 cpe:/a:mozilla:firefox:10.0.4 cpe:/a:mozilla:firefox:10.0.5 cpe:/a:mozilla:firefox:10.0.6 cpe:/a:mozilla:firefox:10.0.7 cpe:/a:mozilla:firefox:10.0.8 cpe:/a:mozilla:firefox:10.0.9 cpe:/a:mozilla:firefox:10.0.10 cpe:/a:mozilla:firefox:10.0.11 cpe:/a:mozilla:firefox:10.0.12 cpe:/a:mozilla:firefox:11.0 cpe:/a:mozilla:firefox:12.0 cpe:/a:mozilla:firefox:12.0:beta6 cpe:/a:mozilla:firefox:13.0 cpe:/a:mozilla:firefox:13.0.1 cpe:/a:mozilla:firefox:14.0 cpe:/a:mozilla:firefox:14.0.1 cpe:/a:mozilla:firefox:15.0 cpe:/a:mozilla:firefox:15.0.1 cpe:/a:mozilla:firefox:16.0 cpe:/a:mozilla:firefox:16.0.1 cpe:/a:mozilla:firefox:16.0.2 cpe:/a:mozilla:firefox:17.0 cpe:/a:mozilla:firefox:17.0.1 cpe:/a:mozilla:firefox:17.0.2 cpe:/a:mozilla:firefox:17.0.3 cpe:/a:mozilla:firefox:17.0.4 cpe:/a:mozilla:firefox:17.0.5 cpe:/a:mozilla:firefox:17.0.6 cpe:/a:mozilla:firefox:17.0.7 cpe:/a:mozilla:firefox:17.0.8 cpe:/a:mozilla:firefox:17.0.9 cpe:/a:mozilla:firefox:17.0.10 cpe:/a:mozilla:firefox:17.0.11 cpe:/a:mozilla:firefox:18.0 cpe:/a:mozilla:firefox:18.0.1 cpe:/a:mozilla:firefox:18.0.2 cpe:/a:mozilla:firefox:19.0 cpe:/a:mozilla:firefox:19.0.1 cpe:/a:mozilla:firefox:19.0.2 cpe:/a:mozilla:firefox:20.0 cpe:/a:mozilla:firefox:20.0.1 cpe:/a:mozilla:firefox:21.0 cpe:/a:mozilla:firefox:22.0 cpe:/a:mozilla:firefox:23.0 cpe:/a:mozilla:firefox:23.0.1 cpe:/a:mozilla:firefox:24.0 cpe:/a:mozilla:firefox:24.1 cpe:/a:mozilla:firefox:24.1.0 cpe:/a:mozilla:firefox:24.1.1 cpe:/a:mozilla:firefox:24.2.0 cpe:/a:mozilla:firefox:24.3.0 cpe:/a:mozilla:firefox:24.4.0 cpe:/a:mozilla:firefox:24.5.0 cpe:/a:mozilla:firefox:24.6.0 cpe:/a:mozilla:firefox:24.7.0 cpe:/a:mozilla:firefox:24.8.0 cpe:/a:mozilla:firefox:24.8.1 cpe:/a:mozilla:firefox:25.0 cpe:/a:mozilla:firefox:25.0.1 cpe:/a:mozilla:firefox:26.0 cpe:/a:mozilla:firefox:27.0 cpe:/a:mozilla:firefox:27.0.1 cpe:/a:mozilla:firefox:28.0 cpe:/a:mozilla:firefox:29.0 cpe:/a:mozilla:firefox:29.0.1 cpe:/a:mozilla:firefox:30.0 cpe:/a:mozilla:firefox:31.0 cpe:/a:mozilla:firefox:31.1.0 cpe:/a:mozilla:firefox:31.1.1 cpe:/a:mozilla:firefox:31.2.0 cpe:/a:mozilla:firefox:31.3.0 cpe:/a:mozilla:firefox:31.4.0 cpe:/a:mozilla:firefox:31.5.0 cpe:/a:mozilla:firefox:31.5.2 cpe:/a:mozilla:firefox:31.5.3 cpe:/a:mozilla:firefox:31.6.0 cpe:/a:mozilla:firefox:31.7.0 cpe:/a:mozilla:firefox:31.8.0 cpe:/a:mozilla:firefox:32.0 cpe:/a:mozilla:firefox:32.0.1 cpe:/a:mozilla:firefox:32.0.2 cpe:/a:mozilla:firefox:32.0.3 cpe:/a:mozilla:firefox:33.0 cpe:/a:mozilla:firefox:33.0.1 cpe:/a:mozilla:firefox:33.0.2 cpe:/a:mozilla:firefox:33.0.3 cpe:/a:mozilla:firefox:33.1 cpe:/a:mozilla:firefox:33.1.1 cpe:/a:mozilla:firefox:34.0 cpe:/a:mozilla:firefox:34.0.5 cpe:/a:mozilla:firefox:35.0 cpe:/a:mozilla:firefox:35.0.1 cpe:/a:mozilla:firefox:36.0 cpe:/a:mozilla:firefox:36.0.1 cpe:/a:mozilla:firefox:36.0.3 cpe:/a:mozilla:firefox:36.0.4 cpe:/a:mozilla:firefox:37.0 cpe:/a:mozilla:firefox:37.0.1 cpe:/a:mozilla:firefox:37.0.2 cpe:/a:mozilla:firefox:38.0 cpe:/a:mozilla:firefox:38.0.1 cpe:/a:mozilla:firefox:38.0.5 cpe:/a:mozilla:firefox:38.1.0 cpe:/a:mozilla:firefox:38.1.1 cpe:/a:mozilla:firefox:38.2.0 cpe:/a:mozilla:firefox:38.2.1 cpe:/a:mozilla:firefox:38.3.0 cpe:/a:mozilla:firefox:38.4.0 cpe:/a:mozilla:firefox:38.5.0 cpe:/a:mozilla:firefox:38.5.1 cpe:/a:mozilla:firefox:38.5.2 cpe:/a:mozilla:firefox:38.6.0 cpe:/a:mozilla:firefox:38.6.1 cpe:/a:mozilla:firefox:38.7.0 cpe:/a:mozilla:firefox:38.7.1 cpe:/a:mozilla:firefox:38.8.0 cpe:/a:mozilla:firefox:39.0 cpe:/a:mozilla:firefox:39.0.3 cpe:/a:mozilla:firefox:40.0 cpe:/a:mozilla:firefox:40.0.2 cpe:/a:mozilla:firefox:40.0.3 cpe:/a:mozilla:firefox:41.0 cpe:/a:mozilla:firefox:41.0.1 cpe:/a:mozilla:firefox:41.0.2 cpe:/a:mozilla:firefox:42.0 cpe:/a:mozilla:firefox:42.0::~~~~x64~ cpe:/a:mozilla:firefox:43.0 cpe:/a:mozilla:firefox:43.0.1 cpe:/a:mozilla:firefox:43.0.2 cpe:/a:mozilla:firefox:43.0.3 cpe:/a:mozilla:firefox:43.0.4 cpe:/a:mozilla:firefox:44.0 cpe:/a:mozilla:firefox:44.0.1 cpe:/a:mozilla:firefox:44.0.2 cpe:/a:mozilla:firefox:45.0 cpe:/a:mozilla:firefox:45.0.1 cpe:/a:mozilla:firefox:45.0.2 cpe:/a:mozilla:firefox:45.1.1 cpe:/a:mozilla:firefox:45.2.0 cpe:/a:mozilla:firefox:45.3.0 cpe:/a:mozilla:firefox:45.4.0 cpe:/a:mozilla:firefox:45.5.0 cpe:/a:mozilla:firefox:45.5.1 cpe:/a:mozilla:firefox:45.6.0 cpe:/a:mozilla:firefox:45.7.0 cpe:/a:mozilla:firefox:45.8.0 cpe:/a:mozilla:firefox:45.9.0 cpe:/a:mozilla:firefox:46.0 cpe:/a:mozilla:firefox:46.0.1 cpe:/a:mozilla:firefox:47.0 cpe:/a:mozilla:firefox:47.0.1 cpe:/a:mozilla:firefox:47.0.2 cpe:/a:suse:linux_enterprise_debuginfo:11:sp4 cpe:/a:suse:studio_onsite:1.3 cpe:/o:apple:mac_os_x:10.11.0 cpe:/o:apple:mac_os_x:10.11.1 cpe:/o:apple:mac_os_x:10.11.2 cpe:/o:apple:mac_os_x:10.11.3 cpe:/o:apple:mac_os_x:10.11.4 cpe:/o:apple:mac_os_x:10.11.5 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:suse:linux_enterprise_desktop:12 cpe:/o:suse:linux_enterprise_desktop:12.0:sp1 cpe:/o:suse:linux_enterprise_server:11:sp4 cpe:/o:suse:linux_enterprise_server:12 cpe:/o:suse:linux_enterprise_server:12.0:sp1 cpe:/o:suse:linux_enterprise_software_development_kit:11:sp4 cpe:/o:suse:linux_enterprise_software_development_kit:12 cpe:/o:suse:linux_enterprise_software_development_kit:12.0:sp1

CVE-2016-0718

2016-05-26T12:59:00.133-04:00

2018-11-16T11:44:10.497-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-11-15T12:18:18.190-05:00

APPLE APPLE-SA-2016-07-18-1 SUSE openSUSE-SU-2016:1441 SUSE SUSE-SU-2016:1508 SUSE SUSE-SU-2016:1512 SUSE openSUSE-SU-2016:1523 SUSE openSUSE-SU-2016:1964 SUSE openSUSE-SU-2016:2026 MISC http://packetstormsecurity.com/files/141350/ESET-Endpoint-Antivirus-6-Remote-Code-Execution.html REDHAT RHSA-2016:2824 FULLDISC 20170227 CVE-2016-9892 - Remote Code Execution as Root via ESET Endpoint Antivirus 6 CONFIRM http://support.eset.com/ca6333/ DEBIAN DSA-3582 CONFIRM http://www.mozilla.org/security/announce/2016/mfsa2016-68.html MLIST [oss-security] 20160517 CVE-2016-0718: Expat XML Parser Crashes on Malformed Input CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html BID 90729 SECTRACK 1036348 SECTRACK 1036415 SECTRACK 1037705 UBUNTU USN-2983-1 UBUNTU USN-3044-1 REDHAT RHSA-2018:2486 CONFIRM https://bugzilla.mozilla.org/show_bug.cgi?id=1236923 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1296102 GENTOO GLSA-201701-21 CONFIRM https://source.android.com/security/bulletin/2016-11-01.html CONFIRM https://support.apple.com/HT206903 CONFIRM https://www.tenable.com/security/tns-2016-20 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

CVE-2016-0719

2016-05-18T11:59:00.153-04:00

2016-05-18T11:59:00.230-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0718. Reason: This candidate is a reservation duplicate of CVE-2016-0718. Notes: All CVE users should reference CVE-2016-0718 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:clusterlabs:pcs:0.9.148 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0720

2017-04-21T11:59:00.160-04:00

2017-04-27T09:26:29.843-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-04-25T16:18:19.277-04:00

FEDORA FEDORA-2016-3b20c4ec9d FEDORA FEDORA-2016-cdd4228cc7 REDHAT RHSA-2016:2596 BID 97984 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1299614 CONFIRM https://github.com/ClusterLabs/pcs/commit/b9e7f061788c3b86a0c67d2d4158f067ec5eb625 Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.

cpe:/a:clusterlabs:pcs:0.9.156 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0721

2017-04-21T11:59:00.223-04:00

2017-04-27T12:15:24.080-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-04-25T16:16:54.923-04:00

FEDORA FEDORA-2016-3b20c4ec9d FEDORA FEDORA-2016-cdd4228cc7 REDHAT RHSA-2016:2596 BID 97977 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1299615 CONFIRM https://github.com/ClusterLabs/pcs/commit/acdbbe8307e6f4a36b2c7754765e732e43fe8d17 CONFIRM https://github.com/ClusterLabs/pcs/commit/bc6ad9086857559db57f4e3e6de66762291c0774 CONFIRM https://github.com/ClusterLabs/pcs/commit/e9b28833d54a47ec441f6dbad0db96e1fc662a5b Session fixation vulnerability in pcsd in pcs before 0.9.157.

CVE-2016-0722

2016-02-18T10:59:00.440-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/o:linux:linux_kernel:4.4.1

CVE-2016-0723

2016-02-07T22:59:09.840-05:00

2016-12-05T22:05:32.453-05:00

5.6

LOCAL

LOW

NONE

PARTIAL

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5c17c861a357e9458001f021a7afa7aab9937439 FEDORA FEDORA-2016-2f25d12c51 FEDORA FEDORA-2016-5d43766e33 SUSE SUSE-SU-2016:0911 SUSE openSUSE-SU-2016:1008 SUSE SUSE-SU-2016:1102 SUSE SUSE-SU-2016:1764 SUSE SUSE-SU-2016:2074 CONFIRM http://source.android.com/security/bulletin/2016-07-01.html DEBIAN DSA-3448 DEBIAN DSA-3503 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html BID 82950 SECTRACK 1035695 UBUNTU USN-2929-1 UBUNTU USN-2929-2 UBUNTU USN-2930-1 UBUNTU USN-2930-2 UBUNTU USN-2930-3 UBUNTU USN-2932-1 UBUNTU USN-2948-1 UBUNTU USN-2948-2 UBUNTU USN-2967-1 UBUNTU USN-2967-2 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1296253 CONFIRM https://github.com/torvalds/linux/commit/5c17c861a357e9458001f021a7afa7aab9937439 CONFIRM https://security-tracker.debian.org/tracker/CVE-2016-0723 CONFIRM https://support.f5.com/csp/article/K43650115 Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.

cpe:/a:moodle:moodle:2.6.11 cpe:/a:moodle:moodle:2.7 cpe:/a:moodle:moodle:2.7.1 cpe:/a:moodle:moodle:2.7.2 cpe:/a:moodle:moodle:2.7.3 cpe:/a:moodle:moodle:2.7.4 cpe:/a:moodle:moodle:2.7.5 cpe:/a:moodle:moodle:2.7.6 cpe:/a:moodle:moodle:2.7.7 cpe:/a:moodle:moodle:2.7.8 cpe:/a:moodle:moodle:2.7.9 cpe:/a:moodle:moodle:2.7.10 cpe:/a:moodle:moodle:2.7.11 cpe:/a:moodle:moodle:2.8 cpe:/a:moodle:moodle:2.8.1 cpe:/a:moodle:moodle:2.8.2 cpe:/a:moodle:moodle:2.8.3 cpe:/a:moodle:moodle:2.8.4 cpe:/a:moodle:moodle:2.8.5 cpe:/a:moodle:moodle:2.8.6 cpe:/a:moodle:moodle:2.8.7 cpe:/a:moodle:moodle:2.8.8 cpe:/a:moodle:moodle:2.8.9 cpe:/a:moodle:moodle:2.9 cpe:/a:moodle:moodle:2.9.1 cpe:/a:moodle:moodle:2.9.2 cpe:/a:moodle:moodle:2.9.3 cpe:/a:moodle:moodle:3.0 cpe:/a:moodle:moodle:3.0.1 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23

CVE-2016-0724

2016-02-22T00:59:21.543-05:00

2017-09-09T21:29:10.277-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52072 FEDORA FEDORA-2016-fb2597f4eb FEDORA FEDORA-2016-1c10ab3c35 MLIST [oss-security] 20160118 [vs] moodle security release SECTRACK 1034694 CONFIRM https://moodle.org/mod/forum/discuss.php?d=326205 The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.

cpe:/a:moodle:moodle:2.8 cpe:/a:moodle:moodle:2.8.1 cpe:/a:moodle:moodle:2.8.2 cpe:/a:moodle:moodle:2.8.3 cpe:/a:moodle:moodle:2.8.4 cpe:/a:moodle:moodle:2.8.5 cpe:/a:moodle:moodle:2.8.6 cpe:/a:moodle:moodle:2.8.7 cpe:/a:moodle:moodle:2.8.8 cpe:/a:moodle:moodle:2.8.9 cpe:/a:moodle:moodle:2.9 cpe:/a:moodle:moodle:2.9.1 cpe:/a:moodle:moodle:2.9.2 cpe:/a:moodle:moodle:2.9.3 cpe:/a:moodle:moodle:3.0 cpe:/a:moodle:moodle:3.0.1 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23

CVE-2016-0725

2016-02-22T00:59:22.527-05:00

2017-09-09T21:29:10.340-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52552 FEDORA FEDORA-2016-fb2597f4eb FEDORA FEDORA-2016-1c10ab3c35 MLIST [oss-security] 20160118 [vs] moodle security release SECTRACK 1034694 CONFIRM https://moodle.org/mod/forum/discuss.php?d=326206 Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.

cpe:/a:nagios:nagios:-

CVE-2016-0726

2017-06-06T14:29:00.277-04:00

2017-06-22T14:32:55.527-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-06-19T09:26:04.563-04:00

CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1295446 The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.

cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~

CVE-2016-0727

2017-04-14T14:59:00.173-04:00

2017-04-20T12:34:09.743-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2017-04-20T12:23:44.957-04:00

ALLOWS_ADMIN_ACCESS

MISC http://packetstormsecurity.com/files/141913/NTP-Privilege-Escalation.html BID 81552 SECTRACK 1034808 UBUNTU USN-3096-1 CONFIRM https://bugs.launchpad.net/ubuntu/+source/ntp/+bug/1528050 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1382369 The crontab script in the ntp package before 1:4.2.6.p3+dfsg-1ubuntu3.11 on Ubuntu 12.04 LTS, before 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 on Ubuntu 14.04 LTS, on Ubuntu Wily, and before 1:4.2.8p4+dfsg-3ubuntu5.3 on Ubuntu 16.04 LTS allows local users with access to the ntp account to write to arbitrary files and consequently gain privileges via vectors involving statistics directory cleanup.

cpe:/a:hp:server_migration_pack:7.5 cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1 cpe:/o:linux:linux_kernel:4.4

CVE-2016-0728

2016-02-07T22:59:10.887-05:00

2017-11-09T21:29:07.357-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 FEDORA FEDORA-2016-5d43766e33 FEDORA FEDORA-2016-b59fd603be SUSE SUSE-SU-2016:0205 SUSE SUSE-SU-2016:0341 SUSE SUSE-SU-2016:0745 SUSE SUSE-SU-2016:0746 SUSE SUSE-SU-2016:0747 SUSE SUSE-SU-2016:0750 SUSE SUSE-SU-2016:0751 SUSE SUSE-SU-2016:0752 SUSE SUSE-SU-2016:0753 SUSE SUSE-SU-2016:0755 SUSE SUSE-SU-2016:0756 SUSE SUSE-SU-2016:0757 MISC http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/ REDHAT RHSA-2016:0064 REDHAT RHSA-2016:0065 REDHAT RHSA-2016:0068 CONFIRM http://source.android.com/security/bulletin/2016-03-01.html DEBIAN DSA-3448 CONFIRM http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1 MLIST [oss-security] 20160119 Linux kernel: use after free in keyring facility. CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 81054 SECTRACK 1034701 UBUNTU USN-2870-1 UBUNTU USN-2870-2 UBUNTU USN-2871-1 UBUNTU USN-2871-2 UBUNTU USN-2872-1 UBUNTU USN-2872-2 UBUNTU USN-2872-3 UBUNTU USN-2873-1 CONFIRM https://bto.bluecoat.com/security-advisory/sa112 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1297475 CONFIRM https://github.com/torvalds/linux/commit/23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 HP HPSBHF03436 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 CONFIRM https://security.netapp.com/advisory/ntap-20160211-0001/ EXPLOIT-DB 39277 The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

cpe:/a:apache:xerces-c%5c%2b%5c%2b:3.1.2 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23 cpe:/o:fedoraproject:fedora:24

CVE-2016-0729

2016-04-07T17:59:01.027-04:00

2018-10-16T21:29:37.210-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2016-9ff972ca42 FEDORA FEDORA-2016-ae9ac16cf3 FEDORA FEDORA-2016-880b91c090 SUSE openSUSE-SU-2016:0966 SUSE openSUSE-SU-2016:1121 SUSE openSUSE-SU-2016:1808 MISC http://packetstormsecurity.com/files/135949/Apache-Xerces-C-XML-Parser-Buffer-Overflow.html CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1727978 DEBIAN DSA-3493 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BUGTRAQ 20160225 CVE-2016-0729: Apache Xerces-C XML Parser Crashes on Malformed Input BID 83423 SECTRACK 1035113 CONFIRM http://xerces.apache.org/xerces-c/secadv/CVE-2016-0729.txt CONFIRM https://issues.apache.org/jira/browse/XERCESC-2061 GENTOO GLSA-201612-46 Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute arbitrary code via a crafted document.

CVE-2016-0730

2017-02-04T13:59:00.167-05:00

2017-02-04T13:59:00.183-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:apache:ambari:2.2.0

CVE-2016-0731

2016-05-18T10:59:03.007-04:00

2016-05-18T17:34:16.500-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-18T11:23:08.413-04:00

CONFIRM https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.2.1 CONFIRM https://docs.hortonworks.com/HDPDocuments/Ambari-2.2.1.0/bk_releasenotes_ambari_2.2.1.0/content/ambari_relnotes-2.2.1.0-cves.html CONFIRM https://issues.apache.org/jira/browse/AMBARI-14780 The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration.

cpe:/a:pivotal:cloud_foundry:208 cpe:/a:pivotal:cloud_foundry:229 cpe:/a:pivotal:elastic_runtime:1.6.0 cpe:/a:pivotal:elastic_runtime:1.6.1 cpe:/a:pivotal:elastic_runtime:1.6.2 cpe:/a:pivotal:elastic_runtime:1.6.3 cpe:/a:pivotal:elastic_runtime:1.6.4 cpe:/a:pivotal:elastic_runtime:1.6.5 cpe:/a:pivotal:elastic_runtime:1.6.6 cpe:/a:pivotal:elastic_runtime:1.6.7 cpe:/a:pivotal:elastic_runtime:1.6.8 cpe:/a:pivotal:elastic_runtime:1.6.9 cpe:/a:pivotal:elastic_runtime:1.6.10 cpe:/a:pivotal:elastic_runtime:1.6.11 cpe:/a:pivotal:elastic_runtime:1.6.12 cpe:/a:pivotal:elastic_runtime:1.6.13 cpe:/a:pivotal:uaa:2.0.0 cpe:/a:pivotal:uaa:2.0.1 cpe:/a:pivotal:uaa:2.0.2 cpe:/a:pivotal:uaa:2.0.3 cpe:/a:pivotal:uaa:2.1.0 cpe:/a:pivotal:uaa:2.2.0 cpe:/a:pivotal:uaa:2.2.1 cpe:/a:pivotal:uaa:2.2.2 cpe:/a:pivotal:uaa:2.2.3 cpe:/a:pivotal:uaa:2.2.4 cpe:/a:pivotal:uaa:2.2.4.1 cpe:/a:pivotal:uaa:2.2.5 cpe:/a:pivotal:uaa:2.2.5.2 cpe:/a:pivotal:uaa:2.2.5.3 cpe:/a:pivotal:uaa:2.2.6 cpe:/a:pivotal:uaa:2.3.0 cpe:/a:pivotal:uaa:2.3.1 cpe:/a:pivotal:uaa:2.3.1.1 cpe:/a:pivotal:uaa:2.4.0 cpe:/a:pivotal:uaa:2.4.1 cpe:/a:pivotal:uaa:2.5.0 cpe:/a:pivotal:uaa:2.5.1 cpe:/a:pivotal:uaa:2.5.2 cpe:/a:pivotal:uaa:2.6.0 cpe:/a:pivotal:uaa:2.6.1 cpe:/a:pivotal:uaa:2.6.2 cpe:/a:pivotal:uaa:2.7.0 cpe:/a:pivotal:uaa:2.7.0.1 cpe:/a:pivotal:uaa:2.7.0.2 cpe:/a:pivotal:uaa:2.7.0.3 cpe:/a:pivotal:uaa:2.7.1 cpe:/a:pivotal:uaa:2.7.2 cpe:/a:pivotal:uaa:2.7.3 cpe:/a:pivotal:uaa-release:2 cpe:/a:pivotal:uaa-release:3 cpe:/a:pivotal:uaa-release:4

CVE-2016-0732

2017-09-07T09:29:00.293-04:00

2017-09-18T14:01:27.270-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2017-09-13T10:56:00.957-04:00

CONFIRM https://pivotal.io/security/cve-2016-0732 The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors.

cpe:/a:apache:ranger:0.5.0

CVE-2016-0733

2016-04-12T10:59:08.087-04:00

2016-04-18T23:44:19.590-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-04-13T12:17:30.790-04:00

BID 82871 CONFIRM https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger CONFIRM https://issues.apache.org/jira/browse/RANGER-835 MLIST [ranger-dev] 20160205 CVE update (CVE-2015-5167 & CVE-2016-0733) - Fixed in Ranger 0.5.1 The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

cpe:/a:apache:activemq:5.0.0 cpe:/a:apache:activemq:5.1.0 cpe:/a:apache:activemq:5.2.0 cpe:/a:apache:activemq:5.3.0 cpe:/a:apache:activemq:5.3.1 cpe:/a:apache:activemq:5.3.2 cpe:/a:apache:activemq:5.4.0 cpe:/a:apache:activemq:5.4.1 cpe:/a:apache:activemq:5.4.2 cpe:/a:apache:activemq:5.4.3 cpe:/a:apache:activemq:5.5.0 cpe:/a:apache:activemq:5.5.1 cpe:/a:apache:activemq:5.6.0 cpe:/a:apache:activemq:5.7.0 cpe:/a:apache:activemq:5.8.0 cpe:/a:apache:activemq:5.9.0 cpe:/a:apache:activemq:5.9.1 cpe:/a:apache:activemq:5.10.0 cpe:/a:apache:activemq:5.10.1 cpe:/a:apache:activemq:5.10.2 cpe:/a:apache:activemq:5.11.0 cpe:/a:apache:activemq:5.11.1 cpe:/a:apache:activemq:5.11.2 cpe:/a:apache:activemq:5.12.0 cpe:/a:apache:activemq:5.12.1 cpe:/a:apache:activemq:5.12.2 cpe:/a:apache:activemq:5.13.0

CVE-2016-0734

2016-04-07T15:59:01.367-04:00

2019-03-27T16:29:02.147-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt MLIST [oss-security] 20160310 [ANNOUNCE] CVE-2016-0734: ActiveMQ Web Console - Clickjacking BID 84321 SECTRACK 1035327 REDHAT RHSA-2016:1424 MLIST [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

cpe:/a:apache:ranger:0.5.0 cpe:/a:apache:ranger:0.5.1

CVE-2016-0735

2016-04-11T15:59:02.227-04:00

2016-04-19T10:01:29.277-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-04-12T14:06:24.180-04:00

MLIST [ranger-dev] 20160328 CVE update (CVE-2016-0735) - Fixed in Ranger 0.5.2 Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.

cpe:/a:apache:http_server:2.4.0 cpe:/a:apache:http_server:2.4.1 cpe:/a:apache:http_server:2.4.2 cpe:/a:apache:http_server:2.4.3 cpe:/a:apache:http_server:2.4.6 cpe:/a:apache:http_server:2.4.7 cpe:/a:apache:http_server:2.4.8 cpe:/a:apache:http_server:2.4.9 cpe:/a:apache:http_server:2.4.10 cpe:/a:apache:http_server:2.4.12 cpe:/a:apache:http_server:2.4.14 cpe:/a:apache:http_server:2.4.16 cpe:/a:apache:http_server:2.4.19 cpe:/a:apache:http_server:2.4.20 cpe:/a:apache:http_server:2.4.21 cpe:/a:apache:http_server:2.4.22 cpe:/a:apache:http_server:2.4.23

CVE-2016-0736

2017-07-27T17:29:00.177-04:00

2018-04-24T21:29:00.413-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2017:1415 DEBIAN DSA-3796 BID 95078 SECTRACK 1037508 REDHAT RHSA-2017:0906 REDHAT RHSA-2017:1161 REDHAT RHSA-2017:1413 REDHAT RHSA-2017:1414 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us CONFIRM https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-0736 MLIST [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html MLIST [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html GENTOO GLSA-201701-36 CONFIRM https://security.netapp.com/advisory/ntap-20180423-0001/ CONFIRM https://support.apple.com/HT208221 EXPLOIT-DB 40961 CONFIRM https://www.tenable.com/security/tns-2017-04 In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.

cpe:/a:openstack:swift:2.3.0

CVE-2016-0737

2016-01-29T15:59:02.920-05:00

2016-12-02T22:17:47.503-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2016:0128 REDHAT RHSA-2016:0155 REDHAT RHSA-2016:0329 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html BID 81432 CONFIRM https://bugs.launchpad.net/swift/+bug/1466549 CONFIRM https://launchpad.net/swift/+milestone/2.4.0 CONFIRM https://review.openstack.org/#/c/217750/ CONFIRM https://security.openstack.org/ossa/OSSA-2016-004.html OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

cpe:/a:openstack:swift:2.3.0 cpe:/a:openstack:swift:2.4.0 cpe:/a:openstack:swift:2.5.0

CVE-2016-0738

2016-01-29T15:59:03.810-05:00

2016-12-05T22:05:34.797-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2016-2256c80a94 REDHAT RHSA-2016:0128 REDHAT RHSA-2016:0155 REDHAT RHSA-2016:0329 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html BID 81432 CONFIRM https://bugs.launchpad.net/cloud-archive/+bug/1493303 CONFIRM https://github.com/openstack/swift/blob/master/CHANGELOG CONFIRM https://security.openstack.org/ossa/OSSA-2016-004.html OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.

cpe:/a:libssh:libssh:0.7.2 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-0739

2016-04-13T13:59:08.413-04:00

2017-12-08T21:29:04.920-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2016-d9f950c779 FEDORA FEDORA-2016-dc9e8da03c SUSE openSUSE-SU-2016:0880 REDHAT RHSA-2016:0566 DEBIAN DSA-3488 UBUNTU USN-2912-1 CONFIRM https://puppet.com/security/cve/CVE-2016-0739 GENTOO GLSA-201606-12 CONFIRM https://www.libssh.org/2016/02/23/libssh-0-7-3-security-and-bugfix-release/ CONFIRM https://www.libssh.org/security/advisories/CVE-2016-0739.txt libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

cpe:/a:python:pillow:3.1.0 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2016-0740

2016-04-13T12:59:01.377-04:00

2017-06-30T21:29:30.860-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov DEBIAN DSA-3499 CONFIRM https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst CONFIRM https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e GENTOO GLSA-201612-52 Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.

cpe:/a:fedoraproject:389_directory_server:1.3.4.0 cpe:/a:fedoraproject:389_directory_server:1.3.4.1 cpe:/a:fedoraproject:389_directory_server:1.3.4.4 cpe:/a:fedoraproject:389_directory_server:1.3.4.5 cpe:/o:redhat:enterprise_linux:7.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0741

2016-04-19T17:59:06.973-04:00

2016-10-11T22:01:50.980-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-4-7.html REDHAT RHSA-2016:0204 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 82343 CONFIRM https://fedorahosted.org/389/changeset/cd45d032421b0ecf76d8cbb9b1c3aeef7680d9a2/ CONFIRM https://fedorahosted.org/389/ticket/48412 slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.

cpe:/a:nginx:nginx:1.8.0 cpe:/a:nginx:nginx:1.9.0 cpe:/a:nginx:nginx:1.9.1 cpe:/a:nginx:nginx:1.9.2 cpe:/a:nginx:nginx:1.9.3 cpe:/a:nginx:nginx:1.9.4 cpe:/a:nginx:nginx:1.9.5 cpe:/a:nginx:nginx:1.9.6 cpe:/a:nginx:nginx:1.9.7 cpe:/a:nginx:nginx:1.9.8 cpe:/a:nginx:nginx:1.9.9 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:1.2 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1

CVE-2016-0742

2016-02-15T14:59:00.107-05:00

2018-10-30T12:27:32.030-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0371 MLIST [nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747) DEBIAN DSA-3473 SECTRACK 1034869 UBUNTU USN-2892-1 REDHAT RHSA-2016:1425 CONFIRM https://bto.bluecoat.com/security-advisory/sa115 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1302587 GENTOO GLSA-201606-06 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

cpe:/a:nginx:nginx:0.6.18 cpe:/a:nginx:nginx:0.6.19 cpe:/a:nginx:nginx:0.6.20 cpe:/a:nginx:nginx:0.6.21 cpe:/a:nginx:nginx:0.6.22 cpe:/a:nginx:nginx:0.6.23 cpe:/a:nginx:nginx:0.6.24 cpe:/a:nginx:nginx:0.6.25 cpe:/a:nginx:nginx:0.6.26 cpe:/a:nginx:nginx:0.6.27 cpe:/a:nginx:nginx:0.6.28 cpe:/a:nginx:nginx:0.6.29 cpe:/a:nginx:nginx:0.6.30 cpe:/a:nginx:nginx:0.6.31 cpe:/a:nginx:nginx:0.6.32 cpe:/a:nginx:nginx:0.6.33 cpe:/a:nginx:nginx:0.6.34 cpe:/a:nginx:nginx:0.6.35 cpe:/a:nginx:nginx:0.6.36 cpe:/a:nginx:nginx:0.6.37 cpe:/a:nginx:nginx:0.6.38 cpe:/a:nginx:nginx:0.6.39 cpe:/a:nginx:nginx:0.7.0 cpe:/a:nginx:nginx:0.7.1 cpe:/a:nginx:nginx:0.7.2 cpe:/a:nginx:nginx:0.7.3 cpe:/a:nginx:nginx:0.7.4 cpe:/a:nginx:nginx:0.7.5 cpe:/a:nginx:nginx:0.7.6 cpe:/a:nginx:nginx:0.7.7 cpe:/a:nginx:nginx:0.7.8 cpe:/a:nginx:nginx:0.7.9 cpe:/a:nginx:nginx:0.7.10 cpe:/a:nginx:nginx:0.7.11 cpe:/a:nginx:nginx:0.7.12 cpe:/a:nginx:nginx:0.7.13 cpe:/a:nginx:nginx:0.7.14 cpe:/a:nginx:nginx:0.7.15 cpe:/a:nginx:nginx:0.7.16 cpe:/a:nginx:nginx:0.7.17 cpe:/a:nginx:nginx:0.7.18 cpe:/a:nginx:nginx:0.7.19 cpe:/a:nginx:nginx:0.7.20 cpe:/a:nginx:nginx:0.7.21 cpe:/a:nginx:nginx:0.7.22 cpe:/a:nginx:nginx:0.7.23 cpe:/a:nginx:nginx:0.7.24 cpe:/a:nginx:nginx:0.7.25 cpe:/a:nginx:nginx:0.7.26 cpe:/a:nginx:nginx:0.7.27 cpe:/a:nginx:nginx:0.7.28 cpe:/a:nginx:nginx:0.7.29 cpe:/a:nginx:nginx:0.7.30 cpe:/a:nginx:nginx:0.7.31 cpe:/a:nginx:nginx:0.7.32 cpe:/a:nginx:nginx:0.7.33 cpe:/a:nginx:nginx:0.7.34 cpe:/a:nginx:nginx:0.7.35 cpe:/a:nginx:nginx:0.7.36 cpe:/a:nginx:nginx:0.7.37 cpe:/a:nginx:nginx:0.7.38 cpe:/a:nginx:nginx:0.7.39 cpe:/a:nginx:nginx:0.7.40 cpe:/a:nginx:nginx:0.7.41 cpe:/a:nginx:nginx:0.7.42 cpe:/a:nginx:nginx:0.7.43 cpe:/a:nginx:nginx:0.7.44 cpe:/a:nginx:nginx:0.7.45 cpe:/a:nginx:nginx:0.7.46 cpe:/a:nginx:nginx:0.7.47 cpe:/a:nginx:nginx:0.7.48 cpe:/a:nginx:nginx:0.7.49 cpe:/a:nginx:nginx:0.7.50 cpe:/a:nginx:nginx:0.7.51 cpe:/a:nginx:nginx:0.7.52 cpe:/a:nginx:nginx:0.7.53 cpe:/a:nginx:nginx:0.7.54 cpe:/a:nginx:nginx:0.7.55 cpe:/a:nginx:nginx:0.7.56 cpe:/a:nginx:nginx:0.7.57 cpe:/a:nginx:nginx:0.7.58 cpe:/a:nginx:nginx:0.7.59 cpe:/a:nginx:nginx:0.7.60 cpe:/a:nginx:nginx:0.7.61 cpe:/a:nginx:nginx:0.7.62 cpe:/a:nginx:nginx:0.7.63 cpe:/a:nginx:nginx:0.7.64 cpe:/a:nginx:nginx:0.7.65 cpe:/a:nginx:nginx:0.7.66 cpe:/a:nginx:nginx:0.7.67 cpe:/a:nginx:nginx:0.7.68 cpe:/a:nginx:nginx:0.7.69 cpe:/a:nginx:nginx:0.8.0 cpe:/a:nginx:nginx:0.8.1 cpe:/a:nginx:nginx:0.8.2 cpe:/a:nginx:nginx:0.8.3 cpe:/a:nginx:nginx:0.8.4 cpe:/a:nginx:nginx:0.8.5 cpe:/a:nginx:nginx:0.8.6 cpe:/a:nginx:nginx:0.8.7 cpe:/a:nginx:nginx:0.8.8 cpe:/a:nginx:nginx:0.8.9 cpe:/a:nginx:nginx:0.8.10 cpe:/a:nginx:nginx:0.8.11 cpe:/a:nginx:nginx:0.8.12 cpe:/a:nginx:nginx:0.8.13 cpe:/a:nginx:nginx:0.8.14 cpe:/a:nginx:nginx:0.8.15 cpe:/a:nginx:nginx:0.8.16 cpe:/a:nginx:nginx:0.8.17 cpe:/a:nginx:nginx:0.8.18 cpe:/a:nginx:nginx:0.8.19 cpe:/a:nginx:nginx:0.8.20 cpe:/a:nginx:nginx:0.8.21 cpe:/a:nginx:nginx:0.8.22 cpe:/a:nginx:nginx:0.8.23 cpe:/a:nginx:nginx:0.8.24 cpe:/a:nginx:nginx:0.8.25 cpe:/a:nginx:nginx:0.8.26 cpe:/a:nginx:nginx:0.8.27 cpe:/a:nginx:nginx:0.8.28 cpe:/a:nginx:nginx:0.8.29 cpe:/a:nginx:nginx:0.8.30 cpe:/a:nginx:nginx:0.8.31 cpe:/a:nginx:nginx:0.8.32 cpe:/a:nginx:nginx:0.8.33 cpe:/a:nginx:nginx:0.8.34 cpe:/a:nginx:nginx:0.8.35 cpe:/a:nginx:nginx:0.8.36 cpe:/a:nginx:nginx:0.8.37 cpe:/a:nginx:nginx:0.8.38 cpe:/a:nginx:nginx:0.8.39 cpe:/a:nginx:nginx:0.8.40 cpe:/a:nginx:nginx:0.8.41 cpe:/a:nginx:nginx:0.8.42 cpe:/a:nginx:nginx:0.8.43 cpe:/a:nginx:nginx:0.8.44 cpe:/a:nginx:nginx:0.8.45 cpe:/a:nginx:nginx:0.8.46 cpe:/a:nginx:nginx:0.8.47 cpe:/a:nginx:nginx:0.8.48 cpe:/a:nginx:nginx:0.8.49 cpe:/a:nginx:nginx:0.8.50 cpe:/a:nginx:nginx:0.8.51 cpe:/a:nginx:nginx:0.8.52 cpe:/a:nginx:nginx:0.8.53 cpe:/a:nginx:nginx:0.8.54 cpe:/a:nginx:nginx:0.8.55 cpe:/a:nginx:nginx:0.9.0 cpe:/a:nginx:nginx:0.9.1 cpe:/a:nginx:nginx:0.9.2 cpe:/a:nginx:nginx:0.9.3 cpe:/a:nginx:nginx:0.9.4 cpe:/a:nginx:nginx:0.9.5 cpe:/a:nginx:nginx:0.9.6 cpe:/a:nginx:nginx:0.9.7 cpe:/a:nginx:nginx:1.0.0 cpe:/a:nginx:nginx:1.0.1 cpe:/a:nginx:nginx:1.0.2 cpe:/a:nginx:nginx:1.0.3 cpe:/a:nginx:nginx:1.0.4 cpe:/a:nginx:nginx:1.0.5 cpe:/a:nginx:nginx:1.0.6 cpe:/a:nginx:nginx:1.0.7 cpe:/a:nginx:nginx:1.0.8 cpe:/a:nginx:nginx:1.0.9 cpe:/a:nginx:nginx:1.0.10 cpe:/a:nginx:nginx:1.0.11 cpe:/a:nginx:nginx:1.0.12 cpe:/a:nginx:nginx:1.0.13 cpe:/a:nginx:nginx:1.0.14 cpe:/a:nginx:nginx:1.0.15 cpe:/a:nginx:nginx:1.1.0 cpe:/a:nginx:nginx:1.1.1 cpe:/a:nginx:nginx:1.1.2 cpe:/a:nginx:nginx:1.1.3 cpe:/a:nginx:nginx:1.1.4 cpe:/a:nginx:nginx:1.1.5 cpe:/a:nginx:nginx:1.1.6 cpe:/a:nginx:nginx:1.1.7 cpe:/a:nginx:nginx:1.1.8 cpe:/a:nginx:nginx:1.1.9 cpe:/a:nginx:nginx:1.1.10 cpe:/a:nginx:nginx:1.1.11 cpe:/a:nginx:nginx:1.1.12 cpe:/a:nginx:nginx:1.1.13 cpe:/a:nginx:nginx:1.1.14 cpe:/a:nginx:nginx:1.1.15 cpe:/a:nginx:nginx:1.1.16 cpe:/a:nginx:nginx:1.1.17 cpe:/a:nginx:nginx:1.1.18 cpe:/a:nginx:nginx:1.1.19 cpe:/a:nginx:nginx:1.2.0 cpe:/a:nginx:nginx:1.2.1 cpe:/a:nginx:nginx:1.2.2 cpe:/a:nginx:nginx:1.2.3 cpe:/a:nginx:nginx:1.2.4 cpe:/a:nginx:nginx:1.2.5 cpe:/a:nginx:nginx:1.2.6 cpe:/a:nginx:nginx:1.2.7 cpe:/a:nginx:nginx:1.2.8 cpe:/a:nginx:nginx:1.2.9 cpe:/a:nginx:nginx:1.3.0 cpe:/a:nginx:nginx:1.3.1 cpe:/a:nginx:nginx:1.3.2 cpe:/a:nginx:nginx:1.3.3 cpe:/a:nginx:nginx:1.3.4 cpe:/a:nginx:nginx:1.3.5 cpe:/a:nginx:nginx:1.3.6 cpe:/a:nginx:nginx:1.3.7 cpe:/a:nginx:nginx:1.3.8 cpe:/a:nginx:nginx:1.3.9 cpe:/a:nginx:nginx:1.3.10 cpe:/a:nginx:nginx:1.3.11 cpe:/a:nginx:nginx:1.3.12 cpe:/a:nginx:nginx:1.3.13 cpe:/a:nginx:nginx:1.3.14 cpe:/a:nginx:nginx:1.3.15 cpe:/a:nginx:nginx:1.3.16 cpe:/a:nginx:nginx:1.4.0 cpe:/a:nginx:nginx:1.4.1 cpe:/a:nginx:nginx:1.4.2 cpe:/a:nginx:nginx:1.4.3 cpe:/a:nginx:nginx:1.4.4 cpe:/a:nginx:nginx:1.4.5 cpe:/a:nginx:nginx:1.4.6 cpe:/a:nginx:nginx:1.4.7 cpe:/a:nginx:nginx:1.5.0 cpe:/a:nginx:nginx:1.5.1 cpe:/a:nginx:nginx:1.5.2 cpe:/a:nginx:nginx:1.5.3 cpe:/a:nginx:nginx:1.5.4 cpe:/a:nginx:nginx:1.5.5 cpe:/a:nginx:nginx:1.5.6 cpe:/a:nginx:nginx:1.5.7 cpe:/a:nginx:nginx:1.5.8 cpe:/a:nginx:nginx:1.5.9 cpe:/a:nginx:nginx:1.5.10 cpe:/a:nginx:nginx:1.5.11 cpe:/a:nginx:nginx:1.5.12 cpe:/a:nginx:nginx:1.5.13 cpe:/a:nginx:nginx:1.6.0 cpe:/a:nginx:nginx:1.6.1 cpe:/a:nginx:nginx:1.6.2 cpe:/a:nginx:nginx:1.6.3 cpe:/a:nginx:nginx:1.7.5 cpe:/a:nginx:nginx:1.7.6 cpe:/a:nginx:nginx:1.7.7 cpe:/a:nginx:nginx:1.7.8 cpe:/a:nginx:nginx:1.7.9 cpe:/a:nginx:nginx:1.7.10 cpe:/a:nginx:nginx:1.7.11 cpe:/a:nginx:nginx:1.7.12 cpe:/a:nginx:nginx:1.8.0 cpe:/a:nginx:nginx:1.9.0 cpe:/a:nginx:nginx:1.9.1 cpe:/a:nginx:nginx:1.9.2 cpe:/a:nginx:nginx:1.9.3 cpe:/a:nginx:nginx:1.9.4 cpe:/a:nginx:nginx:1.9.5 cpe:/a:nginx:nginx:1.9.6 cpe:/a:nginx:nginx:1.9.7 cpe:/a:nginx:nginx:1.9.8 cpe:/a:nginx:nginx:1.9.9 cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1

CVE-2016-0746

2016-02-15T14:59:01.157-05:00

2018-10-30T12:27:32.030-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0371 MLIST [nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747) DEBIAN DSA-3473 SECTRACK 1034869 UBUNTU USN-2892-1 REDHAT RHSA-2016:1425 CONFIRM https://bto.bluecoat.com/security-advisory/sa115 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1302588 GENTOO GLSA-201606-06 Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

CVE-2016-0747

2016-02-15T14:59:02.123-05:00

2018-10-30T12:27:32.030-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0371 MLIST [nginx] 20160126 nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747) DEBIAN DSA-3473 SECTRACK 1034869 UBUNTU USN-2892-1 REDHAT RHSA-2016:1425 CONFIRM https://bto.bluecoat.com/security-advisory/sa115 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1302589 GENTOO GLSA-201606-06 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

cpe:/a:spice_project:spice:- cpe:/o:debian:debian_linux:8.0 cpe:/o:opensuse:leap:42.1 cpe:/o:opensuse:opensuse:13.2 cpe:/o:redhat:enterprise_linux:6.0 cpe:/o:redhat:enterprise_linux:6.0::~~scientific_computing~~~ cpe:/o:redhat:enterprise_linux:7.0 cpe:/o:redhat:enterprise_linux:7.0::~~scientific_computing~~~ cpe:/o:redhat:enterprise_linux_desktop:6.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:6.0 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:6.0 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0749

2016-06-09T12:59:00.127-04:00

2019-04-22T13:48:00.643-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2016:1725 SUSE openSUSE-SU-2016:1726 DEBIAN DSA-3596 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html UBUNTU USN-3014-1 REDHAT RHSA-2016:1204 REDHAT RHSA-2016:1205 GENTOO GLSA-201606-05 The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

cpe:/a:infinispan:infinispan:4.0.0 cpe:/a:infinispan:infinispan:4.1.0 cpe:/a:infinispan:infinispan:4.2.0 cpe:/a:infinispan:infinispan:4.2.1 cpe:/a:infinispan:infinispan:5.0.0 cpe:/a:infinispan:infinispan:5.0.1 cpe:/a:infinispan:infinispan:5.1.0 cpe:/a:infinispan:infinispan:5.1.1 cpe:/a:infinispan:infinispan:5.1.2 cpe:/a:infinispan:infinispan:5.1.3 cpe:/a:infinispan:infinispan:5.1.4 cpe:/a:infinispan:infinispan:5.1.5 cpe:/a:infinispan:infinispan:5.1.6 cpe:/a:infinispan:infinispan:5.1.7 cpe:/a:infinispan:infinispan:5.1.8 cpe:/a:infinispan:infinispan:5.2.0 cpe:/a:infinispan:infinispan:5.2.1 cpe:/a:infinispan:infinispan:5.2.2 cpe:/a:infinispan:infinispan:5.2.3 cpe:/a:infinispan:infinispan:5.2.4 cpe:/a:infinispan:infinispan:5.2.5 cpe:/a:infinispan:infinispan:5.2.6 cpe:/a:infinispan:infinispan:5.2.7 cpe:/a:infinispan:infinispan:5.2.8 cpe:/a:infinispan:infinispan:5.2.9 cpe:/a:infinispan:infinispan:5.2.10 cpe:/a:infinispan:infinispan:5.2.11 cpe:/a:infinispan:infinispan:5.2.12 cpe:/a:infinispan:infinispan:5.2.13 cpe:/a:infinispan:infinispan:5.2.14 cpe:/a:infinispan:infinispan:5.2.15 cpe:/a:infinispan:infinispan:5.2.16 cpe:/a:infinispan:infinispan:5.2.17 cpe:/a:infinispan:infinispan:5.2.18 cpe:/a:infinispan:infinispan:5.2.19 cpe:/a:infinispan:infinispan:5.2.20 cpe:/a:infinispan:infinispan:5.2.21 cpe:/a:infinispan:infinispan:5.2.22 cpe:/a:infinispan:infinispan:5.2.23 cpe:/a:infinispan:infinispan:5.3.0 cpe:/a:infinispan:infinispan:6.0.0 cpe:/a:infinispan:infinispan:6.0.0:alpha1 cpe:/a:infinispan:infinispan:6.0.0:alpha2 cpe:/a:infinispan:infinispan:6.0.0:alpha3 cpe:/a:infinispan:infinispan:6.0.0:alpha4 cpe:/a:infinispan:infinispan:6.0.0:beta1 cpe:/a:infinispan:infinispan:6.0.0:beta2 cpe:/a:infinispan:infinispan:6.0.0:cr1 cpe:/a:infinispan:infinispan:6.0.1 cpe:/a:infinispan:infinispan:6.0.2 cpe:/a:infinispan:infinispan:7.0.0 cpe:/a:infinispan:infinispan:7.0.0:alpha1 cpe:/a:infinispan:infinispan:7.0.0:alpha2 cpe:/a:infinispan:infinispan:7.0.0:alpha3 cpe:/a:infinispan:infinispan:7.0.0:alpha4 cpe:/a:infinispan:infinispan:7.0.0:alpha5 cpe:/a:infinispan:infinispan:7.0.0:beta1 cpe:/a:infinispan:infinispan:7.0.0:beta2 cpe:/a:infinispan:infinispan:7.0.0:cr1 cpe:/a:infinispan:infinispan:7.0.0:cr2 cpe:/a:infinispan:infinispan:7.0.1 cpe:/a:infinispan:infinispan:7.0.2 cpe:/a:infinispan:infinispan:7.0.3 cpe:/a:infinispan:infinispan:7.1.0 cpe:/a:infinispan:infinispan:7.1.0:alpha1 cpe:/a:infinispan:infinispan:7.1.0:beta1 cpe:/a:infinispan:infinispan:7.1.0:cr1 cpe:/a:infinispan:infinispan:7.1.0:cr2 cpe:/a:infinispan:infinispan:7.1.1 cpe:/a:infinispan:infinispan:7.2.0 cpe:/a:infinispan:infinispan:7.2.0:alpha1 cpe:/a:infinispan:infinispan:7.2.0:beta1 cpe:/a:infinispan:infinispan:7.2.0:beta2 cpe:/a:infinispan:infinispan:7.2.0:cr1 cpe:/a:infinispan:infinispan:7.2.1 cpe:/a:infinispan:infinispan:7.2.2 cpe:/a:infinispan:infinispan:7.2.3 cpe:/a:infinispan:infinispan:7.2.4 cpe:/a:infinispan:infinispan:7.2.5 cpe:/a:infinispan:infinispan:8.0.0 cpe:/a:infinispan:infinispan:8.0.0:alpha1 cpe:/a:infinispan:infinispan:8.0.0:alpha2 cpe:/a:infinispan:infinispan:8.0.0:beta1 cpe:/a:infinispan:infinispan:8.0.0:beta2 cpe:/a:infinispan:infinispan:8.0.0:beta3 cpe:/a:infinispan:infinispan:8.0.0:cr1 cpe:/a:infinispan:infinispan:8.0.1 cpe:/a:infinispan:infinispan:8.0.2 cpe:/a:infinispan:infinispan:8.1.0 cpe:/a:infinispan:infinispan:8.1.0:alpha1 cpe:/a:infinispan:infinispan:8.1.0:alpha2 cpe:/a:infinispan:infinispan:8.1.0:beta1 cpe:/a:infinispan:infinispan:8.1.0:cr1 cpe:/a:infinispan:infinispan:8.1.1 cpe:/a:infinispan:infinispan:8.1.2 cpe:/a:infinispan:infinispan:8.1.3 cpe:/a:infinispan:infinispan:8.1.4 cpe:/a:infinispan:infinispan:8.1.5 cpe:/a:infinispan:infinispan:8.1.6 cpe:/a:infinispan:infinispan:8.1.7 cpe:/a:infinispan:infinispan:8.1.8 cpe:/a:infinispan:infinispan:8.1.9 cpe:/a:infinispan:infinispan:8.2.0 cpe:/a:infinispan:infinispan:8.2.0:beta1 cpe:/a:infinispan:infinispan:8.2.0:beta2 cpe:/a:infinispan:infinispan:8.2.0:cr1 cpe:/a:infinispan:infinispan:8.2.1 cpe:/a:infinispan:infinispan:8.2.2 cpe:/a:infinispan:infinispan:8.2.3 cpe:/a:infinispan:infinispan:8.2.4 cpe:/a:infinispan:infinispan:8.2.5 cpe:/a:infinispan:infinispan:8.2.6 cpe:/a:infinispan:infinispan:8.2.7 cpe:/a:infinispan:infinispan:8.2.8 cpe:/a:infinispan:infinispan:8.2.9 cpe:/a:infinispan:infinispan:8.2.10 cpe:/a:infinispan:infinispan:8.2.11 cpe:/a:infinispan:infinispan:9.0.0 cpe:/a:infinispan:infinispan:9.0.0:alpha1 cpe:/a:infinispan:infinispan:9.0.0:alpha2 cpe:/a:infinispan:infinispan:9.0.0:alpha3 cpe:/a:infinispan:infinispan:9.0.0:alpha4 cpe:/a:infinispan:infinispan:9.0.0:beta1 cpe:/a:infinispan:infinispan:9.0.0:beta2 cpe:/a:infinispan:infinispan:9.0.0:cr1 cpe:/a:infinispan:infinispan:9.0.0:cr2 cpe:/a:infinispan:infinispan:9.0.0:cr3 cpe:/a:infinispan:infinispan:9.0.0:cr4 cpe:/a:infinispan:infinispan:9.0.1 cpe:/a:infinispan:infinispan:9.0.2 cpe:/a:infinispan:infinispan:9.0.3

CVE-2016-0750

2018-09-11T09:29:00.433-04:00

2019-10-09T19:16:20.590-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 101910 REDHAT RHSA-2017:3244 REDHAT RHSA-2018:0501 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750 CONFIRM https://github.com/infinispan/infinispan/pull/5116 CONFIRM https://issues.jboss.org/browse/ISPN-7781 The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

cpe:/a:rubyonrails:rails:4.0.0:- cpe:/a:rubyonrails:rails:4.0.0:beta cpe:/a:rubyonrails:rails:4.0.0:rc1 cpe:/a:rubyonrails:rails:4.0.0:rc2 cpe:/a:rubyonrails:rails:4.0.1:- cpe:/a:rubyonrails:rails:4.0.1:rc1 cpe:/a:rubyonrails:rails:4.0.1:rc2 cpe:/a:rubyonrails:rails:4.0.1:rc3 cpe:/a:rubyonrails:rails:4.0.1:rc4 cpe:/a:rubyonrails:rails:4.0.2 cpe:/a:rubyonrails:rails:4.0.3 cpe:/a:rubyonrails:rails:4.0.4 cpe:/a:rubyonrails:rails:4.0.5 cpe:/a:rubyonrails:rails:4.0.6 cpe:/a:rubyonrails:rails:4.0.6:rc1 cpe:/a:rubyonrails:rails:4.0.6:rc2 cpe:/a:rubyonrails:rails:4.0.6:rc3 cpe:/a:rubyonrails:rails:4.0.7 cpe:/a:rubyonrails:rails:4.0.8 cpe:/a:rubyonrails:rails:4.0.9 cpe:/a:rubyonrails:rails:4.0.10 cpe:/a:rubyonrails:rails:4.0.10:rc1 cpe:/a:rubyonrails:rails:4.1.0:- cpe:/a:rubyonrails:rails:4.1.0:beta1 cpe:/a:rubyonrails:rails:4.1.1 cpe:/a:rubyonrails:rails:4.1.2 cpe:/a:rubyonrails:rails:4.1.2:rc1 cpe:/a:rubyonrails:rails:4.1.2:rc2 cpe:/a:rubyonrails:rails:4.1.2:rc3 cpe:/a:rubyonrails:rails:4.1.3 cpe:/a:rubyonrails:rails:4.1.4 cpe:/a:rubyonrails:rails:4.1.5 cpe:/a:rubyonrails:rails:4.1.6:rc1 cpe:/a:rubyonrails:rails:4.1.7 cpe:/a:rubyonrails:rails:4.1.8 cpe:/a:rubyonrails:rails:4.1.9 cpe:/a:rubyonrails:rails:4.1.10 cpe:/a:rubyonrails:rails:4.1.12 cpe:/a:rubyonrails:rails:4.1.13 cpe:/a:rubyonrails:rails:4.2.0:beta1 cpe:/a:rubyonrails:rails:4.2.0:beta2 cpe:/a:rubyonrails:rails:4.2.0:beta3 cpe:/a:rubyonrails:rails:4.2.0:beta4 cpe:/a:rubyonrails:rails:4.2.0:rc1 cpe:/a:rubyonrails:rails:4.2.0:rc2 cpe:/a:rubyonrails:rails:4.2.0:rc3 cpe:/a:rubyonrails:rails:4.2.1 cpe:/a:rubyonrails:rails:4.2.1:rc1 cpe:/a:rubyonrails:rails:4.2.1:rc2 cpe:/a:rubyonrails:rails:4.2.1:rc3 cpe:/a:rubyonrails:rails:4.2.1:rc4 cpe:/a:rubyonrails:rails:4.2.2 cpe:/a:rubyonrails:rails:4.2.3 cpe:/a:rubyonrails:rails:4.2.3:rc1 cpe:/a:rubyonrails:rails:4.2.4 cpe:/a:rubyonrails:rails:4.2.4:rc1 cpe:/a:rubyonrails:rails:4.2.5 cpe:/a:rubyonrails:rails:4.2.5:rc1 cpe:/a:rubyonrails:rails:4.2.5:rc2 cpe:/a:rubyonrails:rails:5.0.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:3.2.22 cpe:/a:rubyonrails:ruby_on_rails:4.0.10:rc2 cpe:/a:rubyonrails:ruby_on_rails:4.0.11 cpe:/a:rubyonrails:ruby_on_rails:4.0.11.1 cpe:/a:rubyonrails:ruby_on_rails:4.0.12 cpe:/a:rubyonrails:ruby_on_rails:4.0.13 cpe:/a:rubyonrails:ruby_on_rails:4.0.13:rc1 cpe:/a:rubyonrails:ruby_on_rails:4.1.11

CVE-2016-0751

2016-02-15T21:59:05.877-05:00

2019-08-08T11:43:52.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2016-94e71ee673 FEDORA FEDORA-2016-f486068393 SUSE SUSE-SU-2016:1146 SUSE openSUSE-SU-2016:0363 SUSE openSUSE-SU-2016:0372 REDHAT RHSA-2016:0296 DEBIAN DSA-3464 MLIST [oss-security] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack BID 81800 SECTRACK 1034816 MLIST [ruby-security-ann] 20160125 [CVE-2016-0751] Possible Object Leak and Denial of Service attack in Action Pack actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

cpe:/a:rubyonrails:rails:4.0.0:- cpe:/a:rubyonrails:rails:4.0.0:beta cpe:/a:rubyonrails:rails:4.0.0:rc1 cpe:/a:rubyonrails:rails:4.0.0:rc2 cpe:/a:rubyonrails:rails:4.0.1:- cpe:/a:rubyonrails:rails:4.0.1:rc1 cpe:/a:rubyonrails:rails:4.0.1:rc2 cpe:/a:rubyonrails:rails:4.0.1:rc3 cpe:/a:rubyonrails:rails:4.0.1:rc4 cpe:/a:rubyonrails:rails:4.0.2 cpe:/a:rubyonrails:rails:4.0.3 cpe:/a:rubyonrails:rails:4.0.4 cpe:/a:rubyonrails:rails:4.0.5 cpe:/a:rubyonrails:rails:4.0.6 cpe:/a:rubyonrails:rails:4.0.6:rc1 cpe:/a:rubyonrails:rails:4.0.6:rc2 cpe:/a:rubyonrails:rails:4.0.6:rc3 cpe:/a:rubyonrails:rails:4.0.7 cpe:/a:rubyonrails:rails:4.0.8 cpe:/a:rubyonrails:rails:4.0.9 cpe:/a:rubyonrails:rails:4.0.10:rc1 cpe:/a:rubyonrails:rails:4.1.0:- cpe:/a:rubyonrails:rails:4.1.0:beta1 cpe:/a:rubyonrails:rails:4.1.1 cpe:/a:rubyonrails:rails:4.1.2 cpe:/a:rubyonrails:rails:4.1.2:rc1 cpe:/a:rubyonrails:rails:4.1.2:rc2 cpe:/a:rubyonrails:rails:4.1.2:rc3 cpe:/a:rubyonrails:rails:4.1.3 cpe:/a:rubyonrails:rails:4.1.4 cpe:/a:rubyonrails:rails:4.1.5 cpe:/a:rubyonrails:rails:4.1.6:rc1 cpe:/a:rubyonrails:rails:4.1.7 cpe:/a:rubyonrails:rails:4.1.8 cpe:/a:rubyonrails:rails:4.1.9 cpe:/a:rubyonrails:rails:4.1.10 cpe:/a:rubyonrails:rails:4.1.12 cpe:/a:rubyonrails:rails:4.1.13 cpe:/a:rubyonrails:rails:4.1.14 cpe:/a:rubyonrails:rails:4.2.0:beta1 cpe:/a:rubyonrails:rails:4.2.1 cpe:/a:rubyonrails:rails:4.2.2 cpe:/a:rubyonrails:rails:4.2.3 cpe:/a:rubyonrails:rails:4.2.3:rc1 cpe:/a:rubyonrails:rails:4.2.4 cpe:/a:rubyonrails:rails:4.2.4:rc1 cpe:/a:rubyonrails:rails:4.2.5 cpe:/a:rubyonrails:rails:4.2.5:rc1 cpe:/a:rubyonrails:rails:4.2.5:rc2 cpe:/a:rubyonrails:rails:5.0.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:3.2.22 cpe:/a:rubyonrails:ruby_on_rails:4.1.11

CVE-2016-0752

2016-02-15T21:59:06.783-05:00

2019-08-08T11:43:52.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2016-fa0dec2360 FEDORA FEDORA-2016-97002ad37b SUSE SUSE-SU-2016:1146 SUSE openSUSE-SU-2016:0363 SUSE openSUSE-SU-2016:0372 REDHAT RHSA-2016:0296 DEBIAN DSA-3464 MLIST [oss-security] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View BID 81801 SECTRACK 1034816 MLIST [ruby-security-ann] 20160125 [CVE-2016-0752] Possible Information Leak Vulnerability in Action View EXPLOIT-DB 40561 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

cpe:/a:rubyonrails:rails:4.1.0:- cpe:/a:rubyonrails:rails:4.1.0:beta1 cpe:/a:rubyonrails:rails:4.1.1 cpe:/a:rubyonrails:rails:4.1.2 cpe:/a:rubyonrails:rails:4.1.2:rc1 cpe:/a:rubyonrails:rails:4.1.2:rc2 cpe:/a:rubyonrails:rails:4.1.2:rc3 cpe:/a:rubyonrails:rails:4.1.3 cpe:/a:rubyonrails:rails:4.1.4 cpe:/a:rubyonrails:rails:4.1.5 cpe:/a:rubyonrails:rails:4.1.6:rc1 cpe:/a:rubyonrails:rails:4.1.7 cpe:/a:rubyonrails:rails:4.1.8 cpe:/a:rubyonrails:rails:4.1.9 cpe:/a:rubyonrails:rails:4.1.10 cpe:/a:rubyonrails:rails:4.1.12 cpe:/a:rubyonrails:rails:4.1.13 cpe:/a:rubyonrails:rails:4.1.14 cpe:/a:rubyonrails:rails:4.2.0:beta1 cpe:/a:rubyonrails:rails:4.2.0:beta2 cpe:/a:rubyonrails:rails:4.2.0:beta3 cpe:/a:rubyonrails:rails:4.2.0:beta4 cpe:/a:rubyonrails:rails:4.2.0:rc1 cpe:/a:rubyonrails:rails:4.2.0:rc2 cpe:/a:rubyonrails:rails:4.2.0:rc3 cpe:/a:rubyonrails:rails:4.2.1 cpe:/a:rubyonrails:rails:4.2.1:rc1 cpe:/a:rubyonrails:rails:4.2.1:rc2 cpe:/a:rubyonrails:rails:4.2.1:rc3 cpe:/a:rubyonrails:rails:4.2.1:rc4 cpe:/a:rubyonrails:rails:4.2.2 cpe:/a:rubyonrails:rails:4.2.3 cpe:/a:rubyonrails:rails:4.2.3:rc1 cpe:/a:rubyonrails:rails:4.2.4 cpe:/a:rubyonrails:rails:4.2.4:rc1 cpe:/a:rubyonrails:rails:4.2.5 cpe:/a:rubyonrails:rails:4.2.5:rc1 cpe:/a:rubyonrails:rails:4.2.5:rc2 cpe:/a:rubyonrails:rails:5.0.0:beta1 cpe:/a:rubyonrails:ruby_on_rails:4.1.11

CVE-2016-0753

2016-02-15T21:59:07.690-05:00

2019-08-08T11:43:52.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2016-73fe05d878 FEDORA FEDORA-2016-94e71ee673 FEDORA FEDORA-2016-cb30088b06 FEDORA FEDORA-2016-cc465a34df FEDORA FEDORA-2016-eb4d6e8aab SUSE SUSE-SU-2016:1146 SUSE openSUSE-SU-2016:0372 REDHAT RHSA-2016:0296 DEBIAN DSA-3464 MLIST [oss-security] 20160125 [CVE-2016-0753] Possible Input Validation Circumvention in Active Model BID 82247 SECTRACK 1034816 MLIST [ruby-security-ann] 20160125 [CVE-2016-0753] Possible Input Validation Circumvention in Active Model Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

cpe:/a:haxx:curl:7.46.0

CVE-2016-0754

2016-01-29T15:59:04.780-05:00

2016-02-17T10:56:50.863-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-02-16T12:51:19.100-05:00

CONFIRM http://curl.haxx.se/docs/adv_20160127B.html cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

cpe:/a:haxx:curl:7.46.0 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.04 cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:7.0

CVE-2016-0755

2016-01-29T15:59:05.653-05:00

2018-10-16T21:29:38.337-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://curl.haxx.se/docs/adv_20160127A.html APPLE APPLE-SA-2016-09-20 FEDORA FEDORA-2016-3fa315a5dd FEDORA FEDORA-2016-55137a3adb FEDORA FEDORA-2016-5a141de5d9 FEDORA FEDORA-2016-57bebab3b6 SUSE openSUSE-SU-2016:0360 SUSE openSUSE-SU-2016:0373 SUSE openSUSE-SU-2016:0376 MISC http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html DEBIAN DSA-3455 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html BID 82307 SECTRACK 1034882 SLACKWARE SSA:2016-039-01 UBUNTU USN-2882-1 GENTOO GLSA-201701-47 CONFIRM https://support.apple.com/HT207170 The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

cpe:/a:prosody:prosody:0.9.9

CVE-2016-0756

2016-01-29T15:59:06.560-05:00

2016-12-05T22:05:43.847-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://blog.prosody.im/prosody-0-9-10-released/ FEDORA FEDORA-2016-e2c5111eda FEDORA FEDORA-2016-5a5c85c5a8 DEBIAN DSA-3463 MLIST [oss-security] 20160127 CVE-2016-0756: Prosody XMPP server: insecure dialback key generation/validation algorithm BID 82241 CONFIRM https://prosody.im/issues/issue/596 CONFIRM https://prosody.im/security/advisory_20160127/ The generate_dialback function in the mod_dialback module in Prosody before 0.9.10 does not properly separate fields when generating dialback keys, which allows remote attackers to spoof XMPP network domains via a crafted stream id and domain name that is included in the target domain as a suffix.

cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:11.0.0 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:11.0.1 cpe:/a:openstack:image_registry_and_delivery_service_%28glance%29:2015.1.2

CVE-2016-0757

2016-04-13T13:59:09.867-04:00

2016-11-28T14:55:13.323-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2016:0309 BID 82696 CONFIRM https://security.openstack.org/ossa/OSSA-2016-006.html OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.

cpe:/o:linux:linux_kernel:4.5.0 cpe:/o:redhat:enterprise_linux_desktop:7.0 cpe:/o:redhat:enterprise_linux_hpc_node:7.0 cpe:/o:redhat:enterprise_linux_hpc_node_eus:7.2 cpe:/o:redhat:enterprise_linux_server:7.0 cpe:/o:redhat:enterprise_linux_server_aus:7.2 cpe:/o:redhat:enterprise_linux_server_eus:7.2 cpe:/o:redhat:enterprise_linux_workstation:7.0

CVE-2016-0758

2016-06-27T06:59:02.313-04:00

2016-11-28T14:55:14.510-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa SUSE openSUSE-SU-2016:1641 SUSE SUSE-SU-2016:1672 SUSE SUSE-SU-2016:1690 SUSE SUSE-SU-2016:1937 SUSE SUSE-SU-2016:1961 SUSE SUSE-SU-2016:1985 SUSE SUSE-SU-2016:1994 SUSE SUSE-SU-2016:1995 SUSE SUSE-SU-2016:2000 SUSE SUSE-SU-2016:2001 SUSE SUSE-SU-2016:2002 SUSE SUSE-SU-2016:2003 SUSE SUSE-SU-2016:2005 SUSE SUSE-SU-2016:2006 SUSE SUSE-SU-2016:2007 SUSE SUSE-SU-2016:2009 SUSE SUSE-SU-2016:2010 SUSE SUSE-SU-2016:2011 SUSE SUSE-SU-2016:2014 SUSE SUSE-SU-2016:2105 SUSE openSUSE-SU-2016:2184 REDHAT RHSA-2016:1033 REDHAT RHSA-2016:1051 REDHAT RHSA-2016:1055 CONFIRM http://source.android.com/security/bulletin/2016-10-01.html MLIST [oss-security] 20160513 CVE-2016-0758 - Linux kernel - Flaw in ASN.1 DER decoder for x509 certificate DER files. CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 90626 UBUNTU USN-2979-4 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1300257 CONFIRM https://github.com/torvalds/linux/commit/23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa HP HPSBHF3548 Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.

CVE-2016-0759

2017-10-31T10:29:00.243-04:00

2017-10-31T10:29:00.260-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-4003. Reason: This candidate is a reservation duplicate of CVE-2016-4003. Notes: All CVE users should reference CVE-2016-4003 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:apache:sentry:1.5.1 cpe:/a:apache:sentry:1.6.0

CVE-2016-0760

2016-08-19T17:59:03.417-04:00

2016-08-22T13:43:14.843-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-08-22T13:27:41.747-04:00

MLIST [sentry-dev] 20160804 CVE-2016-0760: Hive builtin functions "reflect", "reflect2", and "java_method" are not blocked in Apache Sentry BID 92328 Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2) reflect2, or (3) java_method Hive builtin functions.

CVE-2016-0761

2017-05-25T13:29:00.490-04:00

2017-06-08T09:42:46.417-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2017-06-07T23:09:07.430-04:00

CONFIRM https://pivotal.io/security/cve-2016-0761 Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container files during Docker image preparation that could be used to delete, corrupt or overwrite host files and directories, including other container filesystems on the host.

cpe:/a:apache:tomcat:6.0.0 cpe:/a:apache:tomcat:6.0.1 cpe:/a:apache:tomcat:6.0.2 cpe:/a:apache:tomcat:6.0.3 cpe:/a:apache:tomcat:6.0.4 cpe:/a:apache:tomcat:6.0.5 cpe:/a:apache:tomcat:6.0.6 cpe:/a:apache:tomcat:6.0.7 cpe:/a:apache:tomcat:6.0.8 cpe:/a:apache:tomcat:6.0.9 cpe:/a:apache:tomcat:6.0.10 cpe:/a:apache:tomcat:6.0.11 cpe:/a:apache:tomcat:6.0.12 cpe:/a:apache:tomcat:6.0.13 cpe:/a:apache:tomcat:6.0.14 cpe:/a:apache:tomcat:6.0.15 cpe:/a:apache:tomcat:6.0.16 cpe:/a:apache:tomcat:6.0.17 cpe:/a:apache:tomcat:6.0.18 cpe:/a:apache:tomcat:6.0.19 cpe:/a:apache:tomcat:6.0.20 cpe:/a:apache:tomcat:6.0.21 cpe:/a:apache:tomcat:6.0.22 cpe:/a:apache:tomcat:6.0.23 cpe:/a:apache:tomcat:6.0.24 cpe:/a:apache:tomcat:6.0.25 cpe:/a:apache:tomcat:6.0.26 cpe:/a:apache:tomcat:6.0.27 cpe:/a:apache:tomcat:6.0.28 cpe:/a:apache:tomcat:6.0.29 cpe:/a:apache:tomcat:6.0.30 cpe:/a:apache:tomcat:6.0.31 cpe:/a:apache:tomcat:6.0.32 cpe:/a:apache:tomcat:6.0.33 cpe:/a:apache:tomcat:6.0.34 cpe:/a:apache:tomcat:6.0.35 cpe:/a:apache:tomcat:6.0.36 cpe:/a:apache:tomcat:6.0.37 cpe:/a:apache:tomcat:6.0.38 cpe:/a:apache:tomcat:6.0.39 cpe:/a:apache:tomcat:6.0.40 cpe:/a:apache:tomcat:6.0.41 cpe:/a:apache:tomcat:6.0.42 cpe:/a:apache:tomcat:6.0.43 cpe:/a:apache:tomcat:6.0.44 cpe:/a:apache:tomcat:6.0.45 cpe:/a:apache:tomcat:7.0.0 cpe:/a:apache:tomcat:7.0.1 cpe:/a:apache:tomcat:7.0.2 cpe:/a:apache:tomcat:7.0.3 cpe:/a:apache:tomcat:7.0.4 cpe:/a:apache:tomcat:7.0.5 cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.7 cpe:/a:apache:tomcat:7.0.8 cpe:/a:apache:tomcat:7.0.9 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.13 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.15 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.17 cpe:/a:apache:tomcat:7.0.18 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.24 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.31 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.36 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.38 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.43 cpe:/a:apache:tomcat:7.0.44 cpe:/a:apache:tomcat:7.0.45 cpe:/a:apache:tomcat:7.0.46 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.48 cpe:/a:apache:tomcat:7.0.49 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:7.0.55 cpe:/a:apache:tomcat:7.0.56 cpe:/a:apache:tomcat:7.0.57 cpe:/a:apache:tomcat:7.0.58 cpe:/a:apache:tomcat:7.0.59 cpe:/a:apache:tomcat:7.0.60 cpe:/a:apache:tomcat:7.0.61 cpe:/a:apache:tomcat:7.0.62 cpe:/a:apache:tomcat:7.0.63 cpe:/a:apache:tomcat:7.0.64 cpe:/a:apache:tomcat:7.0.65 cpe:/a:apache:tomcat:7.0.66 cpe:/a:apache:tomcat:7.0.67 cpe:/a:apache:tomcat:7.0.68 cpe:/a:apache:tomcat:7.0.69 cpe:/a:apache:tomcat:7.0.70 cpe:/a:apache:tomcat:8.0 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc3 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.2 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.4 cpe:/a:apache:tomcat:8.0.5 cpe:/a:apache:tomcat:8.0.6 cpe:/a:apache:tomcat:8.0.7 cpe:/a:apache:tomcat:8.0.8 cpe:/a:apache:tomcat:8.0.9 cpe:/a:apache:tomcat:8.0.10 cpe:/a:apache:tomcat:8.0.11 cpe:/a:apache:tomcat:8.0.12 cpe:/a:apache:tomcat:8.0.13 cpe:/a:apache:tomcat:8.0.14 cpe:/a:apache:tomcat:8.0.15 cpe:/a:apache:tomcat:8.0.16 cpe:/a:apache:tomcat:8.0.17 cpe:/a:apache:tomcat:8.0.18 cpe:/a:apache:tomcat:8.0.19 cpe:/a:apache:tomcat:8.0.20 cpe:/a:apache:tomcat:8.0.21 cpe:/a:apache:tomcat:8.0.22 cpe:/a:apache:tomcat:8.0.23 cpe:/a:apache:tomcat:8.0.24 cpe:/a:apache:tomcat:8.0.25 cpe:/a:apache:tomcat:8.0.26 cpe:/a:apache:tomcat:8.0.27 cpe:/a:apache:tomcat:8.0.28 cpe:/a:apache:tomcat:8.0.29 cpe:/a:apache:tomcat:8.0.30 cpe:/a:apache:tomcat:8.0.31 cpe:/a:apache:tomcat:8.0.32 cpe:/a:apache:tomcat:8.0.33 cpe:/a:apache:tomcat:8.0.34 cpe:/a:apache:tomcat:8.0.35 cpe:/a:apache:tomcat:8.0.36 cpe:/a:apache:tomcat:8.5.0 cpe:/a:apache:tomcat:8.5.1 cpe:/a:apache:tomcat:8.5.2 cpe:/a:apache:tomcat:8.5.3 cpe:/a:apache:tomcat:8.5.4 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/a:apache:tomcat:9.0.0:m2 cpe:/a:apache:tomcat:9.0.0:m3 cpe:/a:apache:tomcat:9.0.0:m4 cpe:/a:apache:tomcat:9.0.0:m5 cpe:/a:apache:tomcat:9.0.0:m6 cpe:/a:apache:tomcat:9.0.0:m7 cpe:/a:apache:tomcat:9.0.0:m8 cpe:/a:apache:tomcat:9.0.0:m9

CVE-2016-0762

2017-08-10T12:29:00.313-04:00

2019-04-15T12:30:29.887-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2017:0457 DEBIAN DSA-3720 BID 93939 SECTRACK 1037144 REDHAT RHSA-2017:0455 REDHAT RHSA-2017:0456 REDHAT RHSA-2017:2247 MLIST [announce] 20161027 [SECURITY] CVE-2016-0762 Apache Tomcat Realm Timing Attack MLIST [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ MLIST [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ MLIST [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ CONFIRM https://security.netapp.com/advisory/ntap-20180605-0001/ The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

cpe:/a:apache:tomcat:7.0.0:beta cpe:/a:apache:tomcat:7.0.2:beta cpe:/a:apache:tomcat:7.0.4:beta cpe:/a:apache:tomcat:7.0.5:beta cpe:/a:apache:tomcat:7.0.6 cpe:/a:apache:tomcat:7.0.10 cpe:/a:apache:tomcat:7.0.11 cpe:/a:apache:tomcat:7.0.12 cpe:/a:apache:tomcat:7.0.14 cpe:/a:apache:tomcat:7.0.16 cpe:/a:apache:tomcat:7.0.19 cpe:/a:apache:tomcat:7.0.20 cpe:/a:apache:tomcat:7.0.21 cpe:/a:apache:tomcat:7.0.22 cpe:/a:apache:tomcat:7.0.23 cpe:/a:apache:tomcat:7.0.25 cpe:/a:apache:tomcat:7.0.26 cpe:/a:apache:tomcat:7.0.27 cpe:/a:apache:tomcat:7.0.28 cpe:/a:apache:tomcat:7.0.29 cpe:/a:apache:tomcat:7.0.30 cpe:/a:apache:tomcat:7.0.32 cpe:/a:apache:tomcat:7.0.33 cpe:/a:apache:tomcat:7.0.34 cpe:/a:apache:tomcat:7.0.35 cpe:/a:apache:tomcat:7.0.37 cpe:/a:apache:tomcat:7.0.39 cpe:/a:apache:tomcat:7.0.40 cpe:/a:apache:tomcat:7.0.41 cpe:/a:apache:tomcat:7.0.42 cpe:/a:apache:tomcat:7.0.47 cpe:/a:apache:tomcat:7.0.50 cpe:/a:apache:tomcat:7.0.52 cpe:/a:apache:tomcat:7.0.53 cpe:/a:apache:tomcat:7.0.54 cpe:/a:apache:tomcat:7.0.55 cpe:/a:apache:tomcat:7.0.56 cpe:/a:apache:tomcat:7.0.57 cpe:/a:apache:tomcat:7.0.59 cpe:/a:apache:tomcat:7.0.61 cpe:/a:apache:tomcat:7.0.62 cpe:/a:apache:tomcat:7.0.63 cpe:/a:apache:tomcat:7.0.64 cpe:/a:apache:tomcat:7.0.65 cpe:/a:apache:tomcat:7.0.67 cpe:/a:apache:tomcat:8.0.0:rc1 cpe:/a:apache:tomcat:8.0.0:rc10 cpe:/a:apache:tomcat:8.0.0:rc3 cpe:/a:apache:tomcat:8.0.0:rc5 cpe:/a:apache:tomcat:8.0.1 cpe:/a:apache:tomcat:8.0.3 cpe:/a:apache:tomcat:8.0.11 cpe:/a:apache:tomcat:8.0.12 cpe:/a:apache:tomcat:8.0.14 cpe:/a:apache:tomcat:8.0.15 cpe:/a:apache:tomcat:8.0.17 cpe:/a:apache:tomcat:8.0.18 cpe:/a:apache:tomcat:8.0.20 cpe:/a:apache:tomcat:8.0.21 cpe:/a:apache:tomcat:8.0.22 cpe:/a:apache:tomcat:8.0.23 cpe:/a:apache:tomcat:8.0.24 cpe:/a:apache:tomcat:8.0.26 cpe:/a:apache:tomcat:8.0.27 cpe:/a:apache:tomcat:8.0.28 cpe:/a:apache:tomcat:8.0.29 cpe:/a:apache:tomcat:8.0.30 cpe:/a:apache:tomcat:9.0.0:m1 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2016-0763

2016-02-24T20:59:06.280-05:00

2019-03-21T11:59:28.280-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2016-e6651efbaf SUSE SUSE-SU-2016:0769 SUSE SUSE-SU-2016:0822 SUSE openSUSE-SU-2016:0865 REDHAT RHSA-2016:1089 REDHAT RHSA-2016:2599 REDHAT RHSA-2016:2807 REDHAT RHSA-2016:2808 BUGTRAQ 20160222 [SECURITY] CVE-2016-0763 Apache Tomcat Security Manager Bypass CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1725926 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1725929 CONFIRM http://svn.apache.org/viewvc?view=revision&revision=1725931 CONFIRM http://tomcat.apache.org/security-7.html CONFIRM http://tomcat.apache.org/security-8.html CONFIRM http://tomcat.apache.org/security-9.html DEBIAN DSA-3530 DEBIAN DSA-3552 DEBIAN DSA-3609 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html BID 83326 SECTRACK 1035069 UBUNTU USN-3024-1 REDHAT RHSA-2016:1087 REDHAT RHSA-2016:1088 CONFIRM https://bto.bluecoat.com/security-advisory/sa118 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150442 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158626 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 MLIST [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ GENTOO GLSA-201705-09 CONFIRM https://security.netapp.com/advisory/ntap-20180531-0001/ The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.

cpe:/a:redhat:network_manager:1.0.8

CVE-2016-0764

2017-07-17T09:18:05.373-04:00

2017-07-21T13:58:02.437-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-07-21T12:49:33.583-04:00

REDHAT RHSA-2016:2581 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1324025 Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.

cpe:/a:elfden:eshop_plugin:6.3.14::~~~wordpress~~

CVE-2016-0765

2017-01-23T16:59:00.893-05:00

2017-01-26T15:00:11.270-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-01-26T12:07:04.113-05:00

MLIST [oss-security] 20160202 Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14 BID 82347 MISC http://www.vapid.dhs.org/advisory.php?v=160 Multiple cross-site scripting (XSS) vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) action parameter.

cpe:/a:postgresql:postgresql:9.1.19 cpe:/a:postgresql:postgresql:9.2 cpe:/a:postgresql:postgresql:9.2.1 cpe:/a:postgresql:postgresql:9.2.2 cpe:/a:postgresql:postgresql:9.2.3 cpe:/a:postgresql:postgresql:9.2.4 cpe:/a:postgresql:postgresql:9.2.5 cpe:/a:postgresql:postgresql:9.2.6 cpe:/a:postgresql:postgresql:9.2.7 cpe:/a:postgresql:postgresql:9.2.8 cpe:/a:postgresql:postgresql:9.2.9 cpe:/a:postgresql:postgresql:9.2.10 cpe:/a:postgresql:postgresql:9.2.11 cpe:/a:postgresql:postgresql:9.2.12 cpe:/a:postgresql:postgresql:9.2.13 cpe:/a:postgresql:postgresql:9.2.14 cpe:/a:postgresql:postgresql:9.4 cpe:/a:postgresql:postgresql:9.4.1 cpe:/a:postgresql:postgresql:9.4.2 cpe:/a:postgresql:postgresql:9.4.3 cpe:/a:postgresql:postgresql:9.4.4 cpe:/a:postgresql:postgresql:9.4.5 cpe:/a:postgresql:postgresql:9.5 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2016-0766

2016-02-17T10:59:01.237-05:00

2017-06-30T21:29:31.267-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov SUSE openSUSE-SU-2016:0531 SUSE SUSE-SU-2016:0539 SUSE SUSE-SU-2016:0555 SUSE openSUSE-SU-2016:0578 SUSE SUSE-SU-2016:0677 DEBIAN DSA-3475 DEBIAN DSA-3476 CONFIRM http://www.postgresql.org/about/news/1644/ CONFIRM http://www.postgresql.org/docs/current/static/release-9-1-20.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-2-15.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-3-11.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-4-6.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-5-1.html BID 83184 SECTRACK 1035005 UBUNTU USN-2894-1 GENTOO GLSA-201701-33 PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

cpe:/a:tada_ab:postgre_sql_pl%2fjava:1.4.3

CVE-2016-0767

2017-06-06T14:29:00.307-04:00

2017-06-13T14:16:51.277-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-13T14:03:09.377-04:00

CONFIRM https://tada.github.io/pljava/releasenotes.html PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.

cpe:/a:postgresql:postgresql:9.0

CVE-2016-0768

2017-06-06T14:29:00.340-04:00

2017-06-13T14:17:29.200-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-13T14:14:18.710-04:00

CONFIRM https://tada.github.io/pljava/releasenotes.html PostgreSQL PL/Java after 9.0 does not honor access controls on large objects.

cpe:/a:elfden:eshop_plugin:6.3.14::~~~wordpress~~

CVE-2016-0769

2017-01-23T16:59:00.940-05:00

2017-01-26T15:00:28.943-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2017-01-26T12:20:04.517-05:00

MLIST [oss-security] 20160202 Reflected XSS & Blind SQLi in wordpress plugin eshop v6.3.14 BID 82347 MISC http://www.vapid.dhs.org/advisory.php?v=160 Multiple SQL injection vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow (1) remote administrators to execute arbitrary SQL commands via the delid parameter or remote authenticated users to execute arbitrary SQL commands via the (2) view, (3) mark, or (4) change parameter.

cpe:/a:zahmit_design:connections_business_directory_plugin:8.5.8::~~~wordpress~~

CVE-2016-0770

2017-03-16T11:59:00.773-04:00

2017-03-17T08:26:28.733-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-03-16T20:24:26.180-04:00

MLIST [oss-security] 20160201 Wordpress plugin Reflected XSS in connections v8.5.8 BID 82355 MISC http://www.vapidlabs.com/advisory.php?v=161 CONFIRM https://wordpress.org/plugins/connections/changelog/ Cross-site scripting (XSS) vulnerability in includes/admin/pages/manage.php in the Connections Business Directory plugin before 8.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s variable.

cpe:/a:samba:samba:4.0.0 cpe:/a:samba:samba:4.0.1 cpe:/a:samba:samba:4.0.2 cpe:/a:samba:samba:4.0.3 cpe:/a:samba:samba:4.0.4 cpe:/a:samba:samba:4.0.5 cpe:/a:samba:samba:4.0.6 cpe:/a:samba:samba:4.0.7 cpe:/a:samba:samba:4.0.8 cpe:/a:samba:samba:4.0.9 cpe:/a:samba:samba:4.0.10 cpe:/a:samba:samba:4.0.11 cpe:/a:samba:samba:4.0.12 cpe:/a:samba:samba:4.0.13 cpe:/a:samba:samba:4.0.14 cpe:/a:samba:samba:4.0.15 cpe:/a:samba:samba:4.0.16 cpe:/a:samba:samba:4.0.17 cpe:/a:samba:samba:4.0.18 cpe:/a:samba:samba:4.0.19 cpe:/a:samba:samba:4.0.20 cpe:/a:samba:samba:4.0.21 cpe:/a:samba:samba:4.0.22 cpe:/a:samba:samba:4.0.23 cpe:/a:samba:samba:4.0.24 cpe:/a:samba:samba:4.1.0 cpe:/a:samba:samba:4.1.1 cpe:/a:samba:samba:4.1.2 cpe:/a:samba:samba:4.1.3 cpe:/a:samba:samba:4.1.4 cpe:/a:samba:samba:4.1.5 cpe:/a:samba:samba:4.1.6 cpe:/a:samba:samba:4.1.7 cpe:/a:samba:samba:4.1.8 cpe:/a:samba:samba:4.1.9 cpe:/a:samba:samba:4.1.10 cpe:/a:samba:samba:4.1.11 cpe:/a:samba:samba:4.1.12 cpe:/a:samba:samba:4.1.13 cpe:/a:samba:samba:4.1.14 cpe:/a:samba:samba:4.1.15 cpe:/a:samba:samba:4.1.16 cpe:/a:samba:samba:4.1.17 cpe:/a:samba:samba:4.1.18 cpe:/a:samba:samba:4.1.19 cpe:/a:samba:samba:4.1.20 cpe:/a:samba:samba:4.1.21 cpe:/a:samba:samba:4.1.22 cpe:/a:samba:samba:4.2.0:rc1 cpe:/a:samba:samba:4.2.0:rc2 cpe:/a:samba:samba:4.2.0:rc3 cpe:/a:samba:samba:4.2.0:rc4 cpe:/a:samba:samba:4.2.1 cpe:/a:samba:samba:4.2.2 cpe:/a:samba:samba:4.2.3 cpe:/a:samba:samba:4.2.4 cpe:/a:samba:samba:4.2.5 cpe:/a:samba:samba:4.2.6 cpe:/a:samba:samba:4.2.7 cpe:/a:samba:samba:4.2.8 cpe:/a:samba:samba:4.3.0 cpe:/a:samba:samba:4.3.1 cpe:/a:samba:samba:4.3.2 cpe:/a:samba:samba:4.3.3 cpe:/a:samba:samba:4.3.4 cpe:/a:samba:samba:4.3.5 cpe:/a:samba:samba:4.4.0:rc1 cpe:/a:samba:samba:4.4.0:rc2 cpe:/a:samba:samba:4.4.0:rc3

CVE-2016-0771

2016-03-13T18:59:01.797-04:00

2016-12-02T22:18:00.053-05:00

4.9

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2016:0813 DEBIAN DSA-3514 BID 84273 SECTRACK 1035219 UBUNTU USN-2922-1 CONFIRM https://bugzilla.samba.org/show_bug.cgi?id=11128 CONFIRM https://bugzilla.samba.org/show_bug.cgi?id=11686 CONFIRM https://www.samba.org/samba/security/CVE-2016-0771.html The internal DNS server in Samba 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4, when an AD DC is configured, allows remote authenticated users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory by uploading a crafted DNS TXT record.

cpe:/a:python:python:2.7.11 cpe:/a:python:python:3.0 cpe:/a:python:python:3.0.1 cpe:/a:python:python:3.1.0 cpe:/a:python:python:3.1.1 cpe:/a:python:python:3.1.2 cpe:/a:python:python:3.1.3 cpe:/a:python:python:3.1.4 cpe:/a:python:python:3.1.5 cpe:/a:python:python:3.2.0 cpe:/a:python:python:3.2.1 cpe:/a:python:python:3.2.2 cpe:/a:python:python:3.2.3 cpe:/a:python:python:3.2.4 cpe:/a:python:python:3.2.5 cpe:/a:python:python:3.2.6 cpe:/a:python:python:3.3.0 cpe:/a:python:python:3.3.1 cpe:/a:python:python:3.3.2 cpe:/a:python:python:3.3.3 cpe:/a:python:python:3.3.4 cpe:/a:python:python:3.3.5 cpe:/a:python:python:3.3.6 cpe:/a:python:python:3.4.0 cpe:/a:python:python:3.4.1 cpe:/a:python:python:3.4.2 cpe:/a:python:python:3.4.3 cpe:/a:python:python:3.4.4 cpe:/a:python:python:3.5.0 cpe:/a:python:python:3.5.1

CVE-2016-0772

2016-09-02T10:59:00.127-04:00

2019-02-09T06:29:00.307-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2016:1626 REDHAT RHSA-2016:1627 REDHAT RHSA-2016:1628 REDHAT RHSA-2016:1629 REDHAT RHSA-2016:1630 MLIST [oss-security] 20160614 Python CVE-2016-0772: smtplib StartTLS stripping attack BID 91225 CONFIRM http://www.splunk.com/view/SP-CAAAPSV CONFIRM http://www.splunk.com/view/SP-CAAAPUE CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1303647 CONFIRM https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5 CONFIRM https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2 CONFIRM https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS CONFIRM https://hg.python.org/cpython/rev/b3ce713fb9be CONFIRM https://hg.python.org/cpython/rev/d590114c2394 MLIST [debian-lts-announce] 20190207 [SECURITY] [DLA 1663-1] python3.4 security update GENTOO GLSA-201701-18 The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

CVE-2016-0773

2016-02-17T10:59:02.687-05:00

2017-12-08T21:29:04.997-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov FEDORA FEDORA-2016-e0a6c9ebc4 FEDORA FEDORA-2016-b0c2412ab2 SUSE openSUSE-SU-2016:0531 SUSE SUSE-SU-2016:0539 SUSE SUSE-SU-2016:0555 SUSE openSUSE-SU-2016:0578 SUSE SUSE-SU-2016:0677 REDHAT RHSA-2016:1060 DEBIAN DSA-3475 DEBIAN DSA-3476 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html CONFIRM http://www.postgresql.org/about/news/1644/ CONFIRM http://www.postgresql.org/docs/current/static/release-9-1-20.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-2-15.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-3-11.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-4-6.html CONFIRM http://www.postgresql.org/docs/current/static/release-9-5-1.html BID 83184 SECTRACK 1035005 UBUNTU USN-2894-1 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10152 CONFIRM https://puppet.com/security/cve/CVE-2016-0773 GENTOO GLSA-201701-33 PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop or buffer overflow and crash) via a large Unicode character range in a regular expression.

cpe:/o:google:android:6.0.1 cpe:/o:linux:linux_kernel:-

CVE-2016-0774

2016-04-27T13:59:06.117-04:00

2016-12-02T22:18:02.083-05:00

5.6

LOCAL

LOW

NONE

PARTIAL

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:1031 SUSE SUSE-SU-2016:1032 SUSE SUSE-SU-2016:1033 SUSE SUSE-SU-2016:1034 SUSE SUSE-SU-2016:1035 SUSE SUSE-SU-2016:1037 SUSE SUSE-SU-2016:1038 SUSE SUSE-SU-2016:1039 SUSE SUSE-SU-2016:1040 SUSE SUSE-SU-2016:1041 SUSE SUSE-SU-2016:1045 SUSE SUSE-SU-2016:1046 REDHAT RHSA-2016:0494 REDHAT RHSA-2016:0617 CONFIRM http://source.android.com/security/bulletin/2016-05-01.html DEBIAN DSA-3503 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html BID 84126 UBUNTU USN-2967-1 UBUNTU USN-2967-2 UBUNTU USN-2968-1 UBUNTU USN-2968-2 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1303961 CONFIRM https://security-tracker.debian.org/tracker/CVE-2016-0774 The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.

cpe:/a:python:pillow:3.1.0 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0

CVE-2016-0775

2016-04-13T12:59:02.643-04:00

2017-06-30T21:29:31.483-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-3499 CONFIRM https://github.com/python-pillow/Pillow/blob/c3cb690fed5d4bf0c45576759de55d054916c165/CHANGES.rst CONFIRM https://github.com/python-pillow/Pillow/commit/893a40850c2d5da41537958e40569c029a6e127b GENTOO GLSA-201612-52 Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

CVE-2016-0776

2017-05-09T11:29:00.170-04:00

2017-05-09T11:29:00.187-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

cpe:/a:hp:remote_device_access_virtual_customer_access_system:15.07 cpe:/a:openbsd:openssh:5.0 cpe:/a:openbsd:openssh:5.0:p1 cpe:/a:openbsd:openssh:5.1 cpe:/a:openbsd:openssh:5.1:p1 cpe:/a:openbsd:openssh:5.2 cpe:/a:openbsd:openssh:5.2:p1 cpe:/a:openbsd:openssh:5.3 cpe:/a:openbsd:openssh:5.3:p1 cpe:/a:openbsd:openssh:5.4 cpe:/a:openbsd:openssh:5.4:p1 cpe:/a:openbsd:openssh:5.5 cpe:/a:openbsd:openssh:5.5:p1 cpe:/a:openbsd:openssh:5.6 cpe:/a:openbsd:openssh:5.6:p1 cpe:/a:openbsd:openssh:5.7 cpe:/a:openbsd:openssh:5.7:p1 cpe:/a:openbsd:openssh:5.8 cpe:/a:openbsd:openssh:5.8:p1 cpe:/a:openbsd:openssh:5.9 cpe:/a:openbsd:openssh:5.9:p1 cpe:/a:openbsd:openssh:6.0 cpe:/a:openbsd:openssh:6.0:p1 cpe:/a:openbsd:openssh:6.1 cpe:/a:openbsd:openssh:6.1:p1 cpe:/a:openbsd:openssh:6.2 cpe:/a:openbsd:openssh:6.2:p1 cpe:/a:openbsd:openssh:6.2:p2 cpe:/a:openbsd:openssh:6.3 cpe:/a:openbsd:openssh:6.3:p1 cpe:/a:openbsd:openssh:6.4 cpe:/a:openbsd:openssh:6.4:p1 cpe:/a:openbsd:openssh:6.5 cpe:/a:openbsd:openssh:6.5:p1 cpe:/a:openbsd:openssh:6.6 cpe:/a:openbsd:openssh:6.6:p1 cpe:/a:openbsd:openssh:6.7 cpe:/a:openbsd:openssh:6.7:p1 cpe:/a:openbsd:openssh:6.8 cpe:/a:openbsd:openssh:6.8:p1 cpe:/a:openbsd:openssh:6.9 cpe:/a:openbsd:openssh:6.9:p1 cpe:/a:openbsd:openssh:7.0 cpe:/a:openbsd:openssh:7.0:p1 cpe:/a:openbsd:openssh:7.1 cpe:/a:openbsd:openssh:7.1:p1 cpe:/a:sophos:unified_threat_management_software:9.318 cpe:/a:sophos:unified_threat_management_software:9.353 cpe:/o:apple:mac_os_x:10.11.3 cpe:/o:oracle:linux:7.0 cpe:/o:oracle:solaris:11.3

CVE-2016-0777

2016-01-14T17:59:01.140-05:00

2019-02-20T11:58:05.507-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-20T11:31:30.830-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734 APPLE APPLE-SA-2016-03-21-5 FEDORA FEDORA-2016-2e89eba0c1 FEDORA FEDORA-2016-67c6ef0d4f FEDORA FEDORA-2016-c330264861 FEDORA FEDORA-2016-4556904561 SUSE SUSE-SU-2016:0117 SUSE SUSE-SU-2016:0118 SUSE SUSE-SU-2016:0119 SUSE SUSE-SU-2016:0120 SUSE openSUSE-SU-2016:0127 SUSE openSUSE-SU-2016:0128 MISC http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html FULLDISC 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 DEBIAN DSA-3446 CONFIRM http://www.openssh.com/txt/release-7.1p2 MLIST [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BUGTRAQ 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 BID 80695 SECTRACK 1034671 UBUNTU USN-2869-1 CONFIRM https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/ CONFIRM https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/ CONFIRM https://bto.bluecoat.com/security-advisory/sa109 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 FREEBSD FreeBSD-SA-16:07 GENTOO GLSA-201601-01 CONFIRM https://support.apple.com/HT206167 The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key.

cpe:/a:openbsd:openssh:5.4 cpe:/a:openbsd:openssh:5.4:p1 cpe:/a:openbsd:openssh:5.5 cpe:/a:openbsd:openssh:5.5:p1 cpe:/a:openbsd:openssh:5.6 cpe:/a:openbsd:openssh:5.6:p1 cpe:/a:openbsd:openssh:5.7 cpe:/a:openbsd:openssh:5.7:p1 cpe:/a:openbsd:openssh:5.8 cpe:/a:openbsd:openssh:5.8:p1 cpe:/a:openbsd:openssh:5.9 cpe:/a:openbsd:openssh:5.9:p1 cpe:/a:openbsd:openssh:6.0 cpe:/a:openbsd:openssh:6.0:p1 cpe:/a:openbsd:openssh:6.1 cpe:/a:openbsd:openssh:6.1:p1 cpe:/a:openbsd:openssh:6.2 cpe:/a:openbsd:openssh:6.2:p1 cpe:/a:openbsd:openssh:6.2:p2 cpe:/a:openbsd:openssh:6.3 cpe:/a:openbsd:openssh:6.3:p1 cpe:/a:openbsd:openssh:6.4 cpe:/a:openbsd:openssh:6.4:p1 cpe:/a:openbsd:openssh:6.5 cpe:/a:openbsd:openssh:6.5:p1 cpe:/a:openbsd:openssh:6.6 cpe:/a:openbsd:openssh:6.6:p1 cpe:/a:openbsd:openssh:6.7 cpe:/a:openbsd:openssh:6.7:p1 cpe:/a:openbsd:openssh:6.8 cpe:/a:openbsd:openssh:6.8:p1 cpe:/a:openbsd:openssh:6.9 cpe:/a:openbsd:openssh:6.9:p1 cpe:/a:openbsd:openssh:7.0 cpe:/a:openbsd:openssh:7.0:p1 cpe:/a:openbsd:openssh:7.1 cpe:/a:openbsd:openssh:7.1:p1 cpe:/a:sophos:unified_threat_management_software:9.353 cpe:/o:apple:mac_os_x:10.9.1 cpe:/o:apple:mac_os_x:10.9.2 cpe:/o:apple:mac_os_x:10.9.3 cpe:/o:apple:mac_os_x:10.9.4 cpe:/o:apple:mac_os_x:10.9.5 cpe:/o:apple:mac_os_x:10.10.0 cpe:/o:apple:mac_os_x:10.10.1 cpe:/o:apple:mac_os_x:10.10.2 cpe:/o:apple:mac_os_x:10.10.3 cpe:/o:apple:mac_os_x:10.10.4 cpe:/o:apple:mac_os_x:10.10.5 cpe:/o:apple:mac_os_x:10.11.0 cpe:/o:apple:mac_os_x:10.11.1 cpe:/o:apple:mac_os_x:10.11.2 cpe:/o:apple:mac_os_x:10.11.3 cpe:/o:hp:virtual_customer_access_system:15.07 cpe:/o:oracle:linux:7.0 cpe:/o:oracle:solaris:11.3

CVE-2016-0778

2016-01-14T17:59:02.280-05:00

2019-02-20T11:58:55.617-05:00

4.6

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2019-02-20T11:34:15.440-05:00

CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10734 APPLE APPLE-SA-2016-03-21-5 FEDORA FEDORA-2016-2e89eba0c1 FEDORA FEDORA-2016-4556904561 SUSE SUSE-SU-2016:0117 SUSE SUSE-SU-2016:0118 SUSE SUSE-SU-2016:0119 SUSE SUSE-SU-2016:0120 SUSE openSUSE-SU-2016:0127 SUSE openSUSE-SU-2016:0128 MISC http://packetstormsecurity.com/files/135273/Qualys-Security-Advisory-OpenSSH-Overflow-Leak.html FULLDISC 20160115 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 DEBIAN DSA-3446 CONFIRM http://www.openssh.com/txt/release-7.1p2 MLIST [oss-security] 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BUGTRAQ 20160114 Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778 BID 80698 SECTRACK 1034671 UBUNTU USN-2869-1 CONFIRM https://blogs.sophos.com/2016/02/17/utm-up2date-9-354-released/ CONFIRM https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/ CONFIRM https://bto.bluecoat.com/security-advisory/sa109 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05247375 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 GENTOO GLSA-201601-01 CONFIRM https://support.apple.com/HT206167 The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings.

cpe:/a:apache:tomee:1.7.3 cpe:/a:apache:tomee:7.0.0:m1

CVE-2016-0779

2017-04-11T12:59:00.173-04:00

2018-10-09T15:58:54.677-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136256/Apache-TomEE-Patched.html CONFIRM http://tomee.apache.org/security/tomee.html MLIST [tomee-dev] 20160404 Document resolved vulnerability CVE-2015-8581 BUGTRAQ 20160315 [ANNOUNCE][CVE-2016-0779] Apache TomEE 1.7.4 and 7.0.0-M3 releases BID 79204 MISC http://www.zerodayinitiative.com/advisories/ZDI-15-638 The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.

cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.7 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.8 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.9 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.10 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.11 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.12 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.13 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.14 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.15 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.5.16 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.16 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime_cf_release:231

CVE-2016-0780

2017-05-25T13:29:00.520-04:00

2017-06-07T13:38:40.440-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-06-07T13:05:07.700-04:00

CONFIRM https://pivotal.io/security/cve-2016-0780 It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions prior to 1.6.18 do not properly enforce disk quotas in certain cases. An attacker could use an improper disk quota value to bypass enforcement and consume all the disk on DEAs/CELLs causing a potential denial of service for other applications.

cpe:/a:pivotal_software:cloud_foundry:208 cpe:/a:pivotal_software:cloud_foundry:209 cpe:/a:pivotal_software:cloud_foundry:210 cpe:/a:pivotal_software:cloud_foundry:211 cpe:/a:pivotal_software:cloud_foundry:212 cpe:/a:pivotal_software:cloud_foundry:213 cpe:/a:pivotal_software:cloud_foundry:214 cpe:/a:pivotal_software:cloud_foundry:215 cpe:/a:pivotal_software:cloud_foundry:216 cpe:/a:pivotal_software:cloud_foundry:217 cpe:/a:pivotal_software:cloud_foundry:218 cpe:/a:pivotal_software:cloud_foundry:219 cpe:/a:pivotal_software:cloud_foundry:220 cpe:/a:pivotal_software:cloud_foundry:221 cpe:/a:pivotal_software:cloud_foundry:222 cpe:/a:pivotal_software:cloud_foundry:223 cpe:/a:pivotal_software:cloud_foundry:224 cpe:/a:pivotal_software:cloud_foundry:225 cpe:/a:pivotal_software:cloud_foundry:226 cpe:/a:pivotal_software:cloud_foundry:227 cpe:/a:pivotal_software:cloud_foundry:228 cpe:/a:pivotal_software:cloud_foundry:229 cpe:/a:pivotal_software:cloud_foundry:230 cpe:/a:pivotal_software:cloud_foundry:231 cpe:/a:pivotal_software:cloud_foundry:241 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.16 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19 cpe:/a:pivotal_software:cloud_foundry_uaa:2.7.4.1 cpe:/a:pivotal_software:cloud_foundry_uaa:3.0.0 cpe:/a:pivotal_software:cloud_foundry_uaa:3.0.1 cpe:/a:pivotal_software:cloud_foundry_uaa:3.1.0 cpe:/a:pivotal_software:cloud_foundry_uaa:3.2.0 cpe:/a:pivotal_software:cloud_foundry_uaa_release:2 cpe:/a:pivotal_software:cloud_foundry_uaa_release:3 cpe:/a:pivotal_software:cloud_foundry_uaa_release:4 cpe:/a:pivotal_software:cloud_foundry_uaa_release:5 cpe:/a:pivotal_software:cloud_foundry_uaa_release:6 cpe:/a:pivotal_software:cloud_foundry_uaa_release:7 cpe:/a:pivotal_software:login-server:-

CVE-2016-0781

2017-05-25T13:29:00.553-04:00

2017-06-07T13:59:34.007-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-07T13:38:50.427-04:00

CONFIRM https://pivotal.io/security/cve-2016-0781 The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

cpe:/a:apache:activemq:5.1.0 cpe:/a:apache:activemq:5.2.0 cpe:/a:apache:activemq:5.3.0 cpe:/a:apache:activemq:5.3.1 cpe:/a:apache:activemq:5.3.2 cpe:/a:apache:activemq:5.4.0 cpe:/a:apache:activemq:5.4.1 cpe:/a:apache:activemq:5.4.2 cpe:/a:apache:activemq:5.4.3 cpe:/a:apache:activemq:5.5.0 cpe:/a:apache:activemq:5.5.1 cpe:/a:apache:activemq:5.6.0 cpe:/a:apache:activemq:5.7.0 cpe:/a:apache:activemq:5.8.0 cpe:/a:apache:activemq:5.9.0 cpe:/a:apache:activemq:5.9.1 cpe:/a:apache:activemq:5.10.0 cpe:/a:apache:activemq:5.10.1 cpe:/a:apache:activemq:5.10.2 cpe:/a:apache:activemq:5.11.0 cpe:/a:apache:activemq:5.11.1 cpe:/a:apache:activemq:5.11.2 cpe:/a:apache:activemq:5.11.3 cpe:/a:apache:activemq:5.12.0 cpe:/a:apache:activemq:5.12.1 cpe:/a:apache:activemq:5.12.2 cpe:/a:apache:activemq:5.13.0 cpe:/a:apache:activemq:5.13.1

CVE-2016-0782

2016-08-05T11:59:02.473-04:00

2019-03-27T16:29:02.347-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt MISC http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html BUGTRAQ 20160310 [ANNOUNCE] CVE-2016-0782: ActiveMQ Web Console - Cross-Site Scripting SECTRACK 1035328 REDHAT RHSA-2016:1424 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1317516 MLIST [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

cpe:/a:apache:openmeetings:3.1.0

CVE-2016-0783

2016-04-11T10:59:06.347-04:00

2018-10-09T15:58:55.737-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code CONFIRM http://openmeetings.apache.org/security.html MISC http://packetstormsecurity.com/files/136432/Apache-OpenMeetings-3.1.0-MD5-Hashing.html BUGTRAQ 20160325 [CVE-2016-0783] Predictable password reset token CONFIRM https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.

cpe:/a:apache:openmeetings:3.1.0

CVE-2016-0784

2016-04-11T10:59:07.347-04:00

2018-10-09T15:58:56.177-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code CONFIRM http://openmeetings.apache.org/security.html MISC http://packetstormsecurity.com/files/136484/Apache-OpenMeetings-3.1.0-Path-Traversal.html MLIST [oss-security] 20160325 [CVE-2016-0784] ZIP file path traversal BUGTRAQ 20160330 [CVE-2016-0784] Apache OpenMeetings ZIP file path traversal CONFIRM https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG EXPLOIT-DB 39642 Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.

cpe:/a:apache:struts:2.0.0 cpe:/a:apache:struts:2.0.1 cpe:/a:apache:struts:2.0.2 cpe:/a:apache:struts:2.0.3 cpe:/a:apache:struts:2.0.4 cpe:/a:apache:struts:2.0.5 cpe:/a:apache:struts:2.0.6 cpe:/a:apache:struts:2.0.7 cpe:/a:apache:struts:2.0.8 cpe:/a:apache:struts:2.0.9 cpe:/a:apache:struts:2.0.10 cpe:/a:apache:struts:2.0.11 cpe:/a:apache:struts:2.0.11.1 cpe:/a:apache:struts:2.0.11.2 cpe:/a:apache:struts:2.0.12 cpe:/a:apache:struts:2.0.13 cpe:/a:apache:struts:2.0.14 cpe:/a:apache:struts:2.1.0 cpe:/a:apache:struts:2.1.1 cpe:/a:apache:struts:2.1.2 cpe:/a:apache:struts:2.1.3 cpe:/a:apache:struts:2.1.4 cpe:/a:apache:struts:2.1.5 cpe:/a:apache:struts:2.1.6 cpe:/a:apache:struts:2.1.7 cpe:/a:apache:struts:2.1.8 cpe:/a:apache:struts:2.1.8.1 cpe:/a:apache:struts:2.2.1 cpe:/a:apache:struts:2.2.1.1 cpe:/a:apache:struts:2.2.3 cpe:/a:apache:struts:2.2.3.1 cpe:/a:apache:struts:2.3.0 cpe:/a:apache:struts:2.3.1 cpe:/a:apache:struts:2.3.1.1 cpe:/a:apache:struts:2.3.1.2 cpe:/a:apache:struts:2.3.3 cpe:/a:apache:struts:2.3.4 cpe:/a:apache:struts:2.3.4.1 cpe:/a:apache:struts:2.3.5 cpe:/a:apache:struts:2.3.6 cpe:/a:apache:struts:2.3.7 cpe:/a:apache:struts:2.3.8 cpe:/a:apache:struts:2.3.9 cpe:/a:apache:struts:2.3.10 cpe:/a:apache:struts:2.3.11 cpe:/a:apache:struts:2.3.12 cpe:/a:apache:struts:2.3.13 cpe:/a:apache:struts:2.3.14 cpe:/a:apache:struts:2.3.14.1 cpe:/a:apache:struts:2.3.14.2 cpe:/a:apache:struts:2.3.14.3 cpe:/a:apache:struts:2.3.15 cpe:/a:apache:struts:2.3.15.1 cpe:/a:apache:struts:2.3.15.2 cpe:/a:apache:struts:2.3.15.3 cpe:/a:apache:struts:2.3.16 cpe:/a:apache:struts:2.3.16.1 cpe:/a:apache:struts:2.3.16.2 cpe:/a:apache:struts:2.3.16.3 cpe:/a:apache:struts:2.3.17 cpe:/a:apache:struts:2.3.19 cpe:/a:apache:struts:2.3.20 cpe:/a:apache:struts:2.3.20.1 cpe:/a:apache:struts:2.3.20.2 cpe:/a:apache:struts:2.3.21 cpe:/a:apache:struts:2.3.22 cpe:/a:apache:struts:2.3.23 cpe:/a:apache:struts:2.3.24 cpe:/a:apache:struts:2.3.24.1

CVE-2016-0785

2016-04-12T12:59:00.123-04:00

2019-08-23T11:50:47.153-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2019-08-22T10:19:30.800-04:00

CONFIRM http://struts.apache.org/docs/s2-029.html BID 85066 SECTRACK 1035271 Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.

cpe:/a:libssh2:libssh2:1.6.0 cpe:/o:debian:debian_linux:7.0 cpe:/o:debian:debian_linux:8.0 cpe:/o:fedoraproject:fedora:22 cpe:/o:fedoraproject:fedora:23 cpe:/o:opensuse:opensuse:13.2

CVE-2016-0787

2016-04-13T13:59:10.930-04:00

2018-10-30T12:27:35.843-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov FEDORA FEDORA-2016-215a2219b1 FEDORA FEDORA-2016-7942ee2cc5 SUSE openSUSE-SU-2016:0639 DEBIAN DSA-3487 CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html BID 82514 CONFIRM https://bto.bluecoat.com/security-advisory/sa120 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10156 CONFIRM https://puppet.com/security/cve/CVE-2016-0787 GENTOO GLSA-201606-12 CONFIRM https://www.libssh2.org/adv_20160223.html CONFIRM https://www.libssh2.org/CVE-2016-0787.patch The diffie_hellman_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

cpe:/a:jenkins:jenkins:1.642.1::~~lts~~~ cpe:/a:jenkins:jenkins:1.649 cpe:/a:redhat:openshift:3.1::~~enterprise~~~

CVE-2016-0788

2016-04-07T19:59:00.083-04:00

2018-01-04T21:30:30.290-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2016:1773 REDHAT RHSA-2016:0711 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

cpe:/a:jenkins:jenkins:1.642.1::~~lts~~~ cpe:/a:jenkins:jenkins:1.649 cpe:/a:redhat:openshift:3.1::~~enterprise~~~

CVE-2016-0789

2016-04-07T19:59:01.050-04:00

2018-01-04T21:30:30.367-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2016:1773 REDHAT RHSA-2016:0711 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

cpe:/a:jenkins:jenkins:1.642.1::~~lts~~~ cpe:/a:jenkins:jenkins:1.649 cpe:/a:redhat:openshift:3.1::~~enterprise~~~

CVE-2016-0790

2016-04-07T19:59:01.927-04:00

2018-01-04T21:30:30.430-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2016:1773 REDHAT RHSA-2016:0711 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.

cpe:/a:jenkins:jenkins:1.642.1::~~lts~~~ cpe:/a:jenkins:jenkins:1.649 cpe:/a:redhat:openshift:3.1::~~enterprise~~~

CVE-2016-0791

2016-04-07T19:59:02.863-04:00

2018-01-04T21:30:30.493-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov REDHAT RHSA-2016:1773 REDHAT RHSA-2016:0711 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

cpe:/a:jenkins:jenkins:1.642.1::~~lts~~~ cpe:/a:jenkins:jenkins:1.649 cpe:/a:redhat:openshift:3.1::~~enterprise~~~

CVE-2016-0792

2016-04-07T19:59:03.957-04:00

2018-01-04T21:30:30.557-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2016:1773 REDHAT RHSA-2016:0711 CONFIRM https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-02-24 MISC https://www.contrastsecurity.com/security-influencers/serialization-must-die-act-2-xstream EXPLOIT-DB 42394 EXPLOIT-DB 43375 Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

cpe:/a:redhat:jboss_wildfly_application_server:10.0.0

CVE-2016-0793

2016-04-01T15:59:00.137-04:00

2018-05-09T21:29:01.157-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136323/Wildfly-Filter-Restriction-Bypass-Information-Disclosure.html CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1305937 CONFIRM https://security.netapp.com/advisory/ntap-20180215-0001/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03784en_us EXPLOIT-DB 39573 Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

cpe:/a:libreoffice:libreoffice:5.0.3 cpe:/o:canonical:ubuntu_linux:12.04:-:lts cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10

CVE-2016-0794

2016-02-18T16:59:01.230-05:00

2018-01-04T21:30:30.617-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov FEDORA FEDORA-2016-962c0d156d SUSE openSUSE-SU-2016:1415 SUSE openSUSE-SU-2016:1805 REDHAT RHSA-2016:2579 DEBIAN DSA-3482 SECTRACK 1035022 UBUNTU USN-2899-1 CONFIRM https://www.libreoffice.org/about-us/security/advisories/cve-2016-0794/ IDEFENSE 20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro 'ReadRootData' Buffer Overflow Vulnerability IDEFENSE 20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro TabRack Buffer Overflow Vulnerability IDEFENSE 20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro Bullet Buffer Overflow Vulnerability The lwp filter in LibreOffice before 5.0.4 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LotusWordPro (lwp) document.

cpe:/a:libreoffice:libreoffice:5.0.4 cpe:/o:canonical:ubuntu_linux:12.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:14.04::~~lts~~~ cpe:/o:canonical:ubuntu_linux:15.10

CVE-2016-0795

2016-02-18T16:59:02.260-05:00

2018-01-04T21:30:30.680-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov FEDORA FEDORA-2016-962c0d156d SUSE openSUSE-SU-2016:1415 SUSE openSUSE-SU-2016:1805 REDHAT RHSA-2016:2579 DEBIAN DSA-3482 SECTRACK 1035022 UBUNTU USN-2899-1 CONFIRM https://www.libreoffice.org/about-us/security/advisories/cve-2016-0795/ IDEFENSE 20160217 Multiple Vendor LibreOffice Writer Lotus Word Pro 'TocSuperLayout' Buffer Overflow Vulnerability LibreOffice before 5.0.5 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted LwpTocSuperLayout record in a LotusWordPro (lwp) document.

CVE-2016-0797

2016-03-03T15:59:01.813-05:00

2018-01-04T21:30:30.777-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0627 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE openSUSE-SU-2016:0640 SUSE SUSE-SU-2016:0641 SUSE SUSE-SU-2016:0678 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 SUSE openSUSE-SU-2016:1239 SUSE openSUSE-SU-2016:1241 SUSE openSUSE-SU-2016:1566 HP HPSBGN03563 CONFIRM http://openssl.org/news/secadv/20160301.txt REDHAT RHSA-2016:2957 CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 DEBIAN DSA-3500 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html BID 83763 BID 91787 SECTRACK 1035133 UBUNTU USN-2914-1 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=c175308407858afff3fc8c2e5e085d94d12edc7d CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05052990 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10156 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.

CVE-2016-0798

2016-03-03T15:59:02.877-05:00

2017-11-20T21:29:02.400-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

CVE-2016-0799

2016-03-03T15:59:03.797-05:00

2018-01-04T21:30:30.900-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 FEDORA FEDORA-2016-2802690366 FEDORA FEDORA-2016-e6807b3394 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE openSUSE-SU-2016:0640 SUSE SUSE-SU-2016:0641 SUSE SUSE-SU-2016:0678 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 SUSE openSUSE-SU-2016:1239 SUSE openSUSE-SU-2016:1241 HP HPSBGN03569 HP HPSBMU03575 CONFIRM http://openssl.org/news/secadv/20160301.txt REDHAT RHSA-2016:0722 REDHAT RHSA-2016:0996 REDHAT RHSA-2016:2073 REDHAT RHSA-2016:2957 CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 DEBIAN DSA-3500 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html BID 83755 BID 91787 SECTRACK 1035133 UBUNTU USN-2914-1 CONFIRM https://git.openssl.org/?p=openssl.git;a=commit;h=578b956fe741bf8e84055547b1e83c28dd902c73 CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05126404 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131085 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05135617 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150736 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://www.openssl.org/news/secadv/20160301.txt The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842.

CVE-2016-0800

2016-03-01T15:59:00.253-05:00

2018-11-30T16:31:33.353-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10722 CONFIRM http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 SUSE SUSE-SU-2016:0617 SUSE SUSE-SU-2016:0620 SUSE SUSE-SU-2016:0621 SUSE SUSE-SU-2016:0624 SUSE openSUSE-SU-2016:0627 SUSE openSUSE-SU-2016:0628 SUSE SUSE-SU-2016:0631 SUSE openSUSE-SU-2016:0637 SUSE openSUSE-SU-2016:0638 SUSE openSUSE-SU-2016:0640 SUSE SUSE-SU-2016:0641 SUSE SUSE-SU-2016:0678 SUSE openSUSE-SU-2016:0720 SUSE SUSE-SU-2016:1057 SUSE openSUSE-SU-2016:1239 SUSE openSUSE-SU-2016:1241 HP HPSBGN03569 HP HPSBMU03575 HP HPSBMU03573 REDHAT RHSA-2016:1519 CONFIRM http://support.citrix.com/article/CTX208403 CISCO 20160302 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: March 2016 CONFIRM http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-openssl-en CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html CONFIRM http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html CONFIRM http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html CONFIRM http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html CONFIRM http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html BID 83733 BID 91787 SECTRACK 1035133 CONFIRM http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-623229.pdf CONFIRM https://access.redhat.com/security/vulnerabilities/drown MISC https://drownattack.com CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03726en_us CONFIRM https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03741en_us CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068681 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073516 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05086877 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05096953 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05141441 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05143554 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150800 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176765 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05307589 CONFIRM https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804 CONFIRM https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-103-03 CONFIRM https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40168 CONFIRM https://kc.mcafee.com/corporate/index?page=content&id=SB10154 FREEBSD FreeBSD-SA-16:12 GENTOO GLSA-201603-15 CONFIRM https://security.netapp.com/advisory/ntap-20160301-0001/ CERT-VN VU#583776 CONFIRM https://www.openssl.org/news/secadv/20160301.txt The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

cpe:/o:apple:iphone_os:9.2.1 cpe:/o:apple:mac_os_x:10.11.3 cpe:/o:apple:tvos:9.1 cpe:/o:apple:watchos:2.1 cpe:/o:google:android:4.4.4 cpe:/o:google:android:5.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0801

2016-02-06T20:59:00.117-05:00

2019-03-08T11:06:36.980-05:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov APPLE APPLE-SA-2016-03-21-1 APPLE APPLE-SA-2016-03-21-2 APPLE APPLE-SA-2016-03-21-3 APPLE APPLE-SA-2016-03-21-5 CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt SECTRACK 1035353 MLIST [debian-lts-announce] 20181113 [SECURITY] [DLA 1573-1] firmware-nonfree security update CONFIRM https://support.apple.com/HT206166 CONFIRM https://support.apple.com/HT206167 CONFIRM https://support.apple.com/HT206168 CONFIRM https://support.apple.com/HT206169 EXPLOIT-DB 39801 The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

CVE-2016-0802

2016-02-06T20:59:01.100-05:00

2019-03-08T11:06:36.980-05:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov APPLE APPLE-SA-2016-03-21-1 APPLE APPLE-SA-2016-03-21-2 APPLE APPLE-SA-2016-03-21-3 APPLE APPLE-SA-2016-03-21-5 CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2016-004.txt SECTRACK 1035353 CONFIRM https://support.apple.com/HT206166 CONFIRM https://support.apple.com/HT206167 CONFIRM https://support.apple.com/HT206168 CONFIRM https://support.apple.com/HT206169 The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25306181.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:4.4.4 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0803

2016-02-06T20:59:02.067-05:00

2016-03-09T20:22:10.017-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-04T14:10:48.100-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fav/+/50270d98e26fa18b20ca88216c3526667b724ba7 libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.

cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0804

2016-02-06T20:59:03.023-05:00

2016-03-14T10:48:57.527-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T11:35:51.977-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fav/+/224858e719d045c8554856b12c4ab73d2375cf33 The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0805

2016-02-06T20:59:04.037-05:00

2016-03-11T10:10:18.527-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T11:53:55.290-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25773204.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0806

2016-02-06T20:59:05.007-05:00

2016-03-16T12:16:14.910-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-11T08:10:54.327-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25344453.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0807

2016-02-06T20:59:06.007-05:00

2016-03-11T10:06:53.690-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T12:16:14.623-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fsystem%2Fcore/+/d917514bd6b270df431ea4e781a865764d406120 The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394.

CVE-2016-0808

2016-02-06T20:59:06.977-05:00

2016-03-14T11:28:48.227-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T12:24:35.340-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform/frameworks/minikin/+/ed4c8d79153baab7f26562afb8930652dfbf853b Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0809

2016-02-06T20:59:08.037-05:00

2016-03-14T11:32:13.573-04:00

8.3

ADJACENT_NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T13:53:58.783-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform/hardware/broadcom/wlan/+/2c5a4fac8bc8198f6a2635ede776f8de40a0c3e1 Use-after-free vulnerability in the wifi_cleanup function in bcmdhd/wifi_hal/wifi_hal.cpp in Wi-Fi in Android 6.x before 2016-02-01 allows attackers to gain privileges by leveraging access to the local physical environment during execution of a crafted application, aka internal bug 25753768.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0810

2016-02-06T20:59:09.023-05:00

2016-03-14T11:33:51.773-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-03-11T08:13:27.507-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fav/+/19c47afbc402542720ddd280e1bbde3b2277b586 media/libmedia/SoundPool.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 mishandles locking requirements, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25781119.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0811

2016-02-06T20:59:10.007-05:00

2016-03-14T11:34:59.840-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2016-03-09T13:12:13.760-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fav/+/22f824feac43d5758f9a70b77f2aca840ba62c3b Integer overflow in the BnCrypto::onTransact function in media/libmedia/ICrypto.cpp in libmediaplayerservice in Android 6.x before 2016-02-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an improper size calculation, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25800375.

cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0812

2016-02-06T20:59:10.880-05:00

2016-03-14T11:41:04.347-04:00

6.6

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T13:37:59.063-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/84669ca8de55d38073a0dcb01074233b0a417541 The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.0 before 2016-02-01 does not properly check for setup completion, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25229538.

cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0813

2016-02-06T20:59:11.803-05:00

2016-03-14T11:42:13.323-04:00

6.6

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-03-09T13:38:09.283-05:00

CONFIRM http://source.android.com/security/bulletin/2016-02-01.html CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fbase/+/16a76dadcc23a13223e9c2216dad1fe5cad7d6e1 packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-01 does not properly check for device provisioning, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25476219.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0815

2016-03-12T16:59:00.117-05:00

2016-11-28T14:55:33.090-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84235 CONFIRM https://android.googlesource.com/platform%2Fframeworks%2Fav/+/5403587a74aee2fb57076528c3927851531c8afb The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0816

2016-03-12T16:59:01.557-05:00

2016-11-28T14:55:34.217-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84235 CONFIRM https://android.googlesource.com/platform/external/libavc/+/4a524d3a8ae9aa20c36430008e6bd429443f8f1d mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to decoder/ih264d_parse_islice.c and decoder/ih264d_parse_pslice.c, aka internal bug 25928803.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0818

2016-03-12T16:59:02.807-05:00

2016-11-28T14:55:35.327-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84245 CONFIRM https://android.googlesource.com/platform/external/conscrypt/+/4c9f9c2201116acf790fca25af43995d29980ee0 CONFIRM https://android.googlesource.com/platform/external/conscrypt/+/c4ab1b959280413fb11bf4fd7f6b4c2ba38bd779 The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0819

2016-03-12T16:59:03.853-05:00

2016-11-28T14:55:36.530-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84250 The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 25364034.

cpe:/o:google:android:6.0.1

CVE-2016-0820

2016-03-12T16:59:04.917-05:00

2016-11-28T14:55:37.747-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84257 The MediaTek Wi-Fi kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 26267358.

cpe:/o:google:android:6.0.1 cpe:/o:linux:linux_kernel:4.2:rc8

CVE-2016-0821

2016-03-12T16:59:05.900-05:00

2016-11-30T22:03:01.093-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8a5e5e02fc83aaf67053ab53b359af08c6c49aaf CONFIRM http://source.android.com/security/bulletin/2016-03-01.html DEBIAN DSA-3607 MLIST [oss-security] 20150502 Re: CVE request for a fixed bug existed in all versions of linux kernel from KeenTeam BID 84260 UBUNTU USN-2967-1 UBUNTU USN-2967-2 UBUNTU USN-2968-1 UBUNTU USN-2968-2 UBUNTU USN-2969-1 UBUNTU USN-2970-1 UBUNTU USN-2971-1 UBUNTU USN-2971-2 UBUNTU USN-2971-3 CONFIRM https://github.com/torvalds/linux/commit/8a5e5e02fc83aaf67053ab53b359af08c6c49aaf The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.

cpe:/o:google:android:6.0.1

CVE-2016-0822

2016-03-12T16:59:06.900-05:00

2016-11-28T14:55:39.873-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84263 The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access, aka internal bug 25873324.

cpe:/o:google:android:6.0.1 cpe:/o:linux:linux_kernel:3.19.2

CVE-2016-0823

2016-03-12T16:59:08.027-05:00

2016-11-28T14:55:41.047-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce MISC http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html CONFIRM http://source.android.com/security/bulletin/2016-03-01.html CONFIRM http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3 BID 84265 CONFIRM https://github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0824

2016-03-12T16:59:08.883-05:00

2016-11-28T14:55:42.077-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84262 CONFIRM https://android.googlesource.com/platform/external/libmpeg2/+/ffab15eb80630dc799eb410855c93525b75233c3 libmpeg2 in libstagefright in Android 6.x before 2016-03-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via crafted Bitstream data, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 25765591.

cpe:/o:google:android:6.0.1

CVE-2016-0825

2016-03-12T16:59:10.180-05:00

2016-11-28T14:55:43.170-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84269 The Widevine Trusted Application in Android 6.0.1 before 2016-03-01 allows attackers to obtain sensitive TrustZone secure-storage information by leveraging kernel access, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 20860039.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0826

2016-03-12T16:59:11.120-05:00

2016-11-28T14:55:44.157-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84268 CONFIRM https://android.googlesource.com/platform/frameworks/av/+/899823966e78552bb6dfd7772403a4f91471d2b0 CONFIRM https://android.googlesource.com/platform/frameworks/av/+/c9ab2b0bb05a7e19fb057e79b36e232809d70122 libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dump method for a camera service dump, which allows attackers to gain privileges via a crafted application that directly dumps, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26265403.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0827

2016-03-12T16:59:12.027-05:00

2016-11-28T14:55:45.250-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84268 CONFIRM https://android.googlesource.com/platform/frameworks/av/+/9e29523b9537983b4c4b205ff868d0b3bca0383b Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, related to EffectBundle.cpp and EffectReverb.cpp, aka internal bug 26347509.

CVE-2016-0828

2016-03-12T16:59:12.947-05:00

2016-11-28T14:55:46.250-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84261 CONFIRM https://android.googlesource.com/platform/frameworks/native/+/dded8fdbb700d6cc498debc69a780915bc34d755 The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.0.2 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:5.1.1 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0829

2016-03-12T16:59:13.853-05:00

2016-11-28T14:55:47.233-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84261 CONFIRM https://android.googlesource.com/platform/frameworks/native/+/d06421fd37fbb7fd07002e6738fac3a223cb1a62 The BnGraphicBufferProducer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not initialize a certain output data structure, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering a QUEUE_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338109.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0830

2016-03-12T16:59:15.057-05:00

2016-11-28T14:55:48.343-05:00

3.3

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84270 CONFIRM https://android.googlesource.com/platform/system/bt/+/d77f1999ecece56c1cbb333f4ddc26f0b5bac2c5 btif_config.c in Bluetooth in Android 6.x before 2016-03-01 allows remote attackers to cause a denial of service (memory corruption and persistent daemon crash) by triggering a large number of configuration entries, and consequently exceeding the maximum size of a configuration file, aka internal bug 26071376.

CVE-2016-0831

2016-03-12T16:59:15.947-05:00

2016-11-28T14:55:49.407-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84266 CONFIRM https://android.googlesource.com/platform/frameworks/opt/telephony/+/79eecef63f3ea99688333c19e22813f54d4a31b1 The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25778215.

CVE-2016-0832

2016-03-12T16:59:16.837-05:00

2016-11-28T14:55:50.593-05:00

6.6

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-03-01.html BID 84264 Setup Wizard in Android 5.1.x before LMY49H and 6.x before 2016-03-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25955042.

cpe:/o:google:android:-

CVE-2016-0833

2017-04-21T10:59:00.163-04:00

2017-04-26T21:59:00.477-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 98009 MISC http://www.securityfocus.com/bid/98009/info Android allows users to cause a denial of service.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0834

2016-04-17T20:59:00.120-04:00

2017-10-18T21:30:18.473-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://nvidia.custhelp.com/app/answers/detail/a_id/4561 CONFIRM http://source.android.com/security/bulletin/2016-04-02.html An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26220548.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0835

2016-04-17T20:59:01.103-04:00

2016-04-20T14:50:59.227-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:20:13.573-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/libmpeg2/+/58a6822d7140137ce957c6d2fc20bae1374186c1 CONFIRM https://android.googlesource.com/platform/external/libmpeg2/+/ba604d336b40fd4bde1622f64d67135bdbd61301 decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0836

2016-04-17T20:59:02.087-04:00

2016-04-19T22:51:10.837-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-18T14:03:50.813-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/libmpeg2/+/8b4ed5a23175b7ffa56eea4678db7287f825e985 Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0837

2016-04-17T20:59:03.010-04:00

2016-04-20T14:57:25.093-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:00:45.090-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/frameworks/av/+/7a282fb64fef25349e9d341f102d9cea3bf75baf MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0838

2016-04-17T20:59:03.900-04:00

2016-04-20T14:52:03.647-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:02:32.840-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/sonivox/+/24d7c408c52143bce7b49de82f3913fd8d1219cf CONFIRM https://android.googlesource.com/platform/external/sonivox/+/3ac044334c3ff6a61cb4238ff3ddaf17c7efcf49 Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0839

2016-04-17T20:59:04.977-04:00

2016-04-20T14:57:49.547-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:13:24.747-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/hardware/qcom/audio/+/ebbb82365172337c6c250c6cac4e326970a9e351 post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0840

2016-04-17T20:59:05.993-04:00

2016-04-20T12:41:32.603-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-18T13:59:44.003-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/libavc/+/c57fc3703ae2e0d41b1f6580c50015937f2d23c1 Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26399350.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0841

2016-04-17T20:59:06.887-04:00

2016-04-20T14:58:58.110-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T07:58:36.293-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/frameworks/av/+/3097f364237fb552871f7639d37a7afa4563e252 media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0842

2016-04-17T20:59:07.837-04:00

2016-04-20T12:43:38.513-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-18T15:53:42.940-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/libavc/+/943323f1d9d3dd5c2634deb26cbe72343ca6b3db The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0843

2016-04-17T20:59:08.777-04:00

2016-04-20T15:12:21.423-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:35:49.997-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197.

cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0844

2016-04-17T20:59:09.667-04:00

2016-04-20T15:17:34.600-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:26:16.793-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/sepolicy/+/57531cacb40682be4b1189c721fd1e7f25bf3786 The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via a crafted application, aka internal bug 26324307.

CVE-2016-0845

2017-05-11T10:29:57.203-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0846

2016-04-17T20:59:10.650-04:00

2017-09-07T21:29:52.403-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/frameworks/native/+/f3199c228aced7858b75a8070b8358c155ae0149 EXPLOIT-DB 39686 libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.

cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0847

2016-04-17T20:59:11.493-04:00

2016-04-21T09:23:18.570-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T09:16:17.017-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/packages/services/Telecomm/+/2750faaa1ec819eed9acffea7bd3daf867fda444 CONFIRM https://android.googlesource.com/platform/packages/services/Telephony/+/a294ae5342410431a568126183efe86261668b5d The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0848

2016-04-17T20:59:12.370-04:00

2016-04-20T15:24:30.343-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:32:16.137-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/bdc831357e7a116bc561d51bf2ddc85ff11c01a9 Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26211054.

cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0849

2016-04-17T20:59:13.290-04:00

2016-04-20T15:26:32.580-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-04-19T08:41:25.057-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/bootable/recovery/+/28a566f7731b4cb76d2a9ba16d997ac5aeb07dad Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.

cpe:/o:google:android:4.0 cpe:/o:google:android:4.0.1 cpe:/o:google:android:4.0.2 cpe:/o:google:android:4.0.3 cpe:/o:google:android:4.0.4 cpe:/o:google:android:4.1 cpe:/o:google:android:4.1.2 cpe:/o:google:android:4.2 cpe:/o:google:android:4.2.1 cpe:/o:google:android:4.2.2 cpe:/o:google:android:4.3 cpe:/o:google:android:4.3.1 cpe:/o:google:android:4.4 cpe:/o:google:android:4.4.1 cpe:/o:google:android:4.4.2 cpe:/o:google:android:4.4.3 cpe:/o:google:android:5.0 cpe:/o:google:android:5.0.1 cpe:/o:google:android:5.1 cpe:/o:google:android:5.1.0 cpe:/o:google:android:6.0 cpe:/o:google:android:6.0.1

CVE-2016-0850

2016-04-17T20:59:14.277-04:00

2016-04-21T09:29:12.570-04:00

5.8

ADJACENT_NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-04-19T08:28:36.307-04:00

CONFIRM http://source.android.com/security/bulletin/2016-04-02.html CONFIRM https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/c677ee92595335233eb0e7b59809a1a94e7a678a The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0851

2016-01-14T22:59:13.437-05:00

2016-01-20T14:55:10.737-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-01-15T12:15:59.210-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service (out-of-bounds memory access) via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0852

2016-01-14T22:59:14.483-05:00

2016-01-21T11:14:20.847-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-01-15T12:04:00.100-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Advantech WebAccess before 8.1 allows remote attackers to bypass an intended administrative requirement and obtain file or folder access via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0853

2016-01-14T22:59:15.500-05:00

2016-01-21T11:08:21.623-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-01-15T12:00:13.007-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Advantech WebAccess before 8.1 allows remote attackers to obtain sensitive information via crafted input.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0854

2016-01-14T22:59:16.407-05:00

2016-12-02T22:18:15.633-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload MISC http://www.zerodayinitiative.com/advisories/ZDI-16-127 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-128 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-129 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 EXPLOIT-DB 39735 Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0855

2016-01-14T22:59:17.357-05:00

2016-12-02T22:18:16.853-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-122 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-123 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-124 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-125 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-126 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Directory traversal vulnerability in Advantech WebAccess before 8.1 allows remote attackers to list arbitrary virtual-directory files via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0856

2016-01-14T22:59:18.250-05:00

2016-12-02T22:18:18.117-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-100 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-101 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-102 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-103 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-106 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-108 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-109 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-110 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-111 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-112 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-113 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-114 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-115 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-116 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-117 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-118 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-120 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0857

2016-01-14T22:59:19.313-05:00

2016-12-02T22:18:19.290-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-107 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-119 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-121 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0858

2016-01-14T22:59:20.173-05:00

2016-12-02T22:18:20.290-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-105 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Race condition in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted request.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0859

2016-01-14T22:59:21.030-05:00

2016-12-02T22:18:21.370-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-104 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Integer overflow in the Kernel service in Advantech WebAccess before 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted RPC request.

cpe:/a:advantech:webaccess:8.0

CVE-2016-0860

2016-01-14T22:59:21.890-05:00

2016-12-05T22:05:52.597-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov MISC http://www.zerodayinitiative.com/advisories/ZDI-16-058 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-074 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 Buffer overflow in the BwpAlarm subsystem in Advantech WebAccess before 8.1 allows remote attackers to cause a denial of service via a crafted RPC request.

cpe:/a:ge:ups_snmp_web_adapter_firmware:4.7

CVE-2016-0861

2016-02-05T06:59:00.127-05:00

2017-09-09T21:29:10.683-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf MISC http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html FULLDISC 20160203 GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Sensitive Info Vulnerabilities MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02 EXPLOIT-DB 39408 General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands via unspecified vectors.

cpe:/o:ge:snmp%2fweb_adapter_firmware:4.7

CVE-2016-0862

2016-02-05T06:59:01.173-05:00

2018-10-17T14:47:51.503-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2018-10-09T11:15:49.563-04:00

CONFIRM http://apps.geindustrial.com/publibrary/checkout/Application%20and%20Technical%7CGEIS_SNMP%7CPDF&filename=GEIS_SNMP.pdf MISC http://packetstormsecurity.com/files/135586/GE-Industrial-Solutions-UPS-SNMP-Adapter-Command-Injection.html FULLDISC 20160203 GE Industrial Solutions - UPS SNMP Adapter Command Injection and Clear-text Sensitive Info Vulnerabilities MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02 EXPLOIT-DB 39408 General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors.

cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:4.1.0 cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:5.0

CVE-2016-0863

2016-02-12T21:59:02.947-05:00

2016-05-09T13:13:34.097-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-05-09T10:43:43.357-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01 Cross-site request forgery (CSRF) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to hijack the authentication of arbitrary users.

cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:4.1.0 cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:5.0

CVE-2016-0864

2016-02-12T21:59:03.963-05:00

2016-05-09T13:44:36.230-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-09T10:44:58.193-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01 Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to obtain sensitive report and username information via unspecified vectors.

cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:4.1.0 cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:5.0

CVE-2016-0865

2016-02-12T21:59:05.010-05:00

2016-02-18T16:38:19.833-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2016-02-16T15:05:38.460-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01 Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote authenticated users to change arbitrary passwords via unspecified vectors.

cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:4.1.0 cpe:/a:tollgrade:smartgrid_lighthouse_sensor_management_system:5.0

CVE-2016-0866

2016-02-12T21:59:05.947-05:00

2016-02-18T14:42:00.863-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-02-16T15:04:04.217-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-040-01 Cross-site scripting (XSS) vulnerability in Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1, and 4.1.0 Build 16, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:carel:plantvisor_enhanced

CVE-2016-0867

2016-01-30T10:59:00.127-05:00

2016-03-01T10:18:35.640-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2016-02-26T18:25:01.867-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-021-01 CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.

cpe:/a:rockwellautomation:1763-l16awa_series_a:15.000 cpe:/a:rockwellautomation:1763-l16awa_series_b:15.000 cpe:/a:rockwellautomation:1763-l16bbb_series_a:15.000 cpe:/a:rockwellautomation:1763-l16bbb_series_b:15.000 cpe:/a:rockwellautomation:1763-l16bwa_series_a:15.000 cpe:/a:rockwellautomation:1763-l16bwa_series_b:15.000 cpe:/a:rockwellautomation:1763-l16dwd_series_a:15.000 cpe:/a:rockwellautomation:1763-l16dwd_series_b:15.000

CVE-2016-0868

2016-01-28T16:59:00.087-05:00

2016-12-22T11:05:03.130-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-22T11:00:51.417-05:00

SECTRACK 1034861 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-026-02 Stack-based buffer overflow on Rockwell Automation Allen-Bradley MicroLogix 1100 devices A through 15.000 and B before 15.002 allows remote attackers to execute arbitrary code via a crafted web request.

cpe:/a:microsys:promotic:8.3.10

CVE-2016-0869

2016-01-26T14:59:02.373-05:00

2016-02-23T11:26:09.593-05:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-02-19T13:38:38.477-05:00

CONFIRM http://www.promotic.eu/en/pmdoc/NewsPm803.htm#ver80311 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-026-01 Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document.

cpe:/a:trane:tracer_sc:4.2.1134

CVE-2016-0870

2016-09-18T21:59:00.133-04:00

2016-11-28T14:55:51.657-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 92979 MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-259-03 The web server in Trane Tracer SC 4.2.1134 and earlier allows remote attackers to read sensitive configuration files via a direct request.

cpe:/a:eaton_lighting_systems:eg2_web_control:4.04p

CVE-2016-0871

2016-04-06T19:59:03.457-04:00

2016-04-07T12:54:36.383-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-04-07T08:58:54.273-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-061-03 Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.

CVE-2016-0872

2017-11-07T16:29:00.260-05:00

2017-11-29T10:56:40.710-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-11-27T14:22:44.740-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07 A Plaintext Storage of a Password issue was discovered in Kabona AB WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.

cpe:/o:moxa:edr_g903_firmware:3.4.11

CVE-2016-0875

2016-05-30T21:59:00.133-04:00

2016-05-31T14:35:17.183-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-31T14:23:23.477-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01 Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.

cpe:/o:moxa:edr_g903_firmware:3.4.11

CVE-2016-0876

2016-05-30T21:59:01.100-04:00

2016-06-01T08:31:02.647-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-05-31T14:58:11.160-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01 Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file.

cpe:/o:moxa:edr_g903_firmware:3.4.11

CVE-2016-0877

2016-05-30T21:59:02.133-04:00

2016-05-31T14:50:40.723-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-05-31T14:31:02.300-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01 Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function.

cpe:/o:moxa:edr_g903_firmware:3.4.11

CVE-2016-0878

2016-05-30T21:59:03.117-04:00

2016-05-31T14:07:13.357-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-05-31T13:41:37.127-04:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01 Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests.

cpe:/o:moxa:edr_g903_firmware:3.4.11

CVE-2016-0879

2016-05-30T21:59:04.053-04:00

2016-06-02T09:58:31.907-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2017-01-09T11:58:50.107-05:00

MISC https://ics-cert.us-cert.gov/advisories/ICSA-16-042-01 Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL.

CVE-2016-0880

2017-05-11T10:29:57.233-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:emc:documentum_xcp:2.1 cpe:/a:emc:documentum_xcp:2.2

CVE-2016-0881

2016-02-11T20:59:00.113-05:00

2017-01-10T23:11:07.147-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2017-01-10T22:10:00.467-05:00

BUGTRAQ 20160209 ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities SECTRACK 1034993 EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and obtain sensitive repository information by appending a query to a REST request.

cpe:/a:emc:documentum_xcp:2.1 cpe:/a:emc:documentum_xcp:2.2

CVE-2016-0882

2016-02-11T20:59:01.100-05:00

2017-01-10T23:11:13.570-05:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

PARTIAL

http://nvd.nist.gov

2017-01-10T22:10:28.487-05:00

BUGTRAQ 20160209 ESA-2016-010 EMC Documentum xCP Security Update for Multiple Vulnerabilities SECTRACK 1034993 EMC Documentum xCP 2.1 before patch 23 and 2.2 before patch 11 allows remote authenticated users to read arbitrary files via a POST request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

cpe:/a:pivotal_software:operations_manager:1.5.13 cpe:/a:pivotal_software:operations_manager:1.6.0 cpe:/a:pivotal_software:operations_manager:1.6.1 cpe:/a:pivotal_software:operations_manager:1.6.2 cpe:/a:pivotal_software:operations_manager:1.6.3 cpe:/a:pivotal_software:operations_manager:1.6.4 cpe:/a:pivotal_software:operations_manager:1.6.5 cpe:/a:pivotal_software:operations_manager:1.6.6 cpe:/a:pivotal_software:operations_manager:1.6.7 cpe:/a:pivotal_software:operations_manager:1.6.8

CVE-2016-0883

2016-09-17T22:59:00.150-04:00

2016-10-03T13:37:20.490-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-09-30T14:58:20.307-04:00

CONFIRM https://pivotal.io/security/pcf-ops-manager-weak-authentication-scheme Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.

CVE-2016-0884

2017-05-11T10:29:57.267-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-0885

2017-05-11T10:29:57.280-04:00

2017-05-11T10:29:57.297-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:emc:documentum_xcp:2.1 cpe:/a:emc:documentum_xcp:2.2

CVE-2016-0886

2016-03-09T18:59:01.163-05:00

2017-01-10T23:09:57.090-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov

2017-01-10T22:11:37.230-05:00

BUGTRAQ 20160307 ESA-2016-012: EMC Documentum xCP - User Information Disclosure Vulnerability BID 84210 SECTRACK 1035197 EMC Documentum xCP 2.1 before patch 24 and 2.2 before patch 12 allows remote authenticated users to obtain sensitive user-account metadata via a members/xcp_member API call.

cpe:/a:emc:rsa_bsafe:4.0.0::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.2::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.4::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.5::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.5.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.7::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.8::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.9::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.10::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.0.11::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.0::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.0.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.1::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.2::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.3::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe:4.1.4::~~micro_edition_suite~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.0::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.0.4::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.0.5::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.0.5.3::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.1::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.1.1::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-c:4.1.2::~~micro_edition~~~ cpe:/a:emc:rsa_bsafe_crypto-j:6.0 cpe:/a:emc:rsa_bsafe_crypto-j:6.1 cpe:/a:emc:rsa_bsafe_crypto-j:6.1.1 cpe:/a:emc:rsa_bsafe_crypto-j:6.1.2 cpe:/a:emc:rsa_bsafe_crypto-j:6.2 cpe:/a:emc:rsa_bsafe_crypto-j:6.2.0.1 cpe:/a:emc:rsa_bsafe_ssl-c:2.8 cpe:/a:emc:rsa_bsafe_ssl-j:5.1 cpe:/a:emc:rsa_bsafe_ssl-j:6.0 cpe:/a:emc:rsa_bsafe_ssl-j:6.1 cpe:/a:emc:rsa_bsafe_ssl-j:6.1.2 cpe:/a:emc:rsa_bsafe_ssl-j:6.2

CVE-2016-0887

2016-04-12T19:59:31.413-04:00

2019-08-27T12:19:59.197-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-08-26T08:01:25.117-04:00

MISC http://packetstormsecurity.com/files/136656/RSA-BSAFE-Lenstras-Attack.html BUGTRAQ 20160411 ESA-2016-013: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Lenstra's Attack Vulnerability BUGTRAQ 20160411 ESA-2016-013: RSA BSAFE® Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Lenstra?s Attack Vulnerability SECTRACK 1035515 SECTRACK 1035516 SECTRACK 1035517 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x and 4.1.x before 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.0.x and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2.1, RSA BSAFE SSL-J before 6.2.1, and RSA BSAFE SSL-C before 2.8.9 allow remote attackers to discover a private-key prime by conducting a Lenstra side-channel attack that leverages an application's failure to detect an RSA signature failure during a TLS session.

cpe:/a:emc:documentum_d2:4.5

CVE-2016-0888

2016-04-07T06:59:00.117-04:00

2017-01-10T23:12:45.583-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2017-01-10T22:11:59.860-05:00

BUGTRAQ 20160404 ESA-2016-034: EMC Documentum D2 Configuration Object Vulnerability SECTRACK 1035459 EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors.

cpe:/a:emc:unisphere:8.1::~~~vmax~~

CVE-2016-0889

2016-04-15T10:59:01.177-04:00

2017-01-10T21:59:01.477-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

ALLOWS_ADMIN_ACCESS

BUGTRAQ 20160414 ESA-2016-036: EMC Unisphere for VMAX Virtual Appliance Arbitrary File Upload Vulnerability SECTRACK 1035580 An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.

cpe:/a:emc:powerpath_virtual_appliance:2.0 cpe:/a:emc:powerpath_virtual_appliance:2.0:sp1

CVE-2016-0890

2017-02-03T02:59:00.157-05:00

2017-03-02T11:18:46.743-05:00

6.0

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2017-03-02T10:20:03.693-05:00

CONFIRM http://www.securityfocus.com/archive/1/540065/30/0/threaded BID 95832 EMC PowerPath Virtual (Management) Appliance 2.0, EMC PowerPath Virtual (Management) Appliance 2.0 SP1 is affected by a sensitive information disclosure vulnerability that may potentially be exploited by malicious users to compromise the affected system.

cpe:/a:emc:vipr_srm:3.6.4

CVE-2016-0891

2016-04-20T13:59:00.150-04:00

2018-10-09T15:58:57.300-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136837/EMC-ViPR-SRM-Cross-Site-Request-Forgery.html BUGTRAQ 20160419 ESA-2016-039: EMC ViPR SRM Multiple Cross-Site Request Forgery Vulnerabilities FULLDISC 20160427 EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection BUGTRAQ 20160427 EMC M&R (Watch4net) lacks Cross-Site Request Forgery protection EXPLOIT-DB 39738 MISC https://www.securify.nl/advisory/SFY20141109/emc_m_r__watch4net__lacks_c%20ross_site_request_forgery_protection.html Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.

cpe:/a:emc:rsa_data_loss_prevention:9.6 cpe:/a:emc:rsa_data_loss_prevention:9.6.1 cpe:/a:emc:rsa_data_loss_prevention:9.6.2 cpe:/a:emc:rsa_data_loss_prevention:9.6.2.1 cpe:/a:emc:rsa_data_loss_prevention:9.6.2.2 cpe:/a:emc:rsa_data_loss_prevention:9.6.2.3 cpe:/a:emc:rsa_data_loss_prevention:9.6.2.4

CVE-2016-0892

2016-05-03T11:59:00.147-04:00

2016-11-30T22:03:02.000-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html BUGTRAQ 20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities SECTRACK 1035714 Cross-site scripting (XSS) vulnerability in EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2016-0893

2016-05-03T11:59:01.723-04:00

2016-11-30T22:03:02.953-05:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html BUGTRAQ 20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities SECTRACK 1035714 EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to obtain sensitive information by reading error messages.

CVE-2016-0894

2016-05-03T11:59:02.803-04:00

2016-11-30T22:03:04.143-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html BUGTRAQ 20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities SECTRACK 1035714 EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote authenticated users to bypass intended object access restrictions via a modified parameter.

CVE-2016-0895

2016-05-03T11:59:03.787-04:00

2016-11-30T22:03:05.377-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136888/RSA-Data-Loss-Prevention-XSS-Information-Disclosure.html BUGTRAQ 20160502 ESA-2016-041: RSA Data Loss Prevention Multiple Vulnerabilities SECTRACK 1035714 EMC RSA Data Loss Prevention 9.6 before SP2 P5 allows remote attackers to conduct clickjacking attacks via web-site elements with crafted transparency or opacity.

cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.33 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.7 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.8 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.9 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.10 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.11

CVE-2016-0896

2016-09-17T22:59:01.637-04:00

2016-11-28T14:55:53.750-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 92161 CONFIRM https://pivotal.io/security/cve-2016-0896 Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.

cpe:/a:pivotal_software:operations_manager:1.6.16 cpe:/a:pivotal_software:operations_manager:1.7.0 cpe:/a:pivotal_software:operations_manager:1.7.1 cpe:/a:pivotal_software:operations_manager:1.7.2 cpe:/a:pivotal_software:operations_manager:1.7.3 cpe:/a:pivotal_software:operations_manager:1.7.4 cpe:/a:pivotal_software:operations_manager:1.7.5 cpe:/a:pivotal_software:operations_manager:1.7.6 cpe:/a:pivotal_software:operations_manager:1.7.7

CVE-2016-0897

2016-09-17T22:59:02.870-04:00

2016-10-03T13:34:46.070-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-09-30T14:55:03.950-04:00

CONFIRM https://pivotal.io/security/cve-2016-0897 Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.

cpe:/a:pivotal_software:mysql:1.7.0::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.0.1::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.0.2::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.0.3::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.0.4::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.1::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.2::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.3::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.4::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.5::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.6::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.7::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.8::~~~pcf_tiles~~ cpe:/a:pivotal_software:mysql:1.7.9::~~~pcf_tiles~~

CVE-2016-0898

2018-03-29T18:29:00.260-04:00

2018-04-27T08:12:33.253-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-24T14:44:17.183-04:00

BID 95146 CONFIRM https://pivotal.io/security/cve-2016-0898 MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM.

cpe:/a:emc:rsa_archer_egrc:5.5 cpe:/a:emc:rsa_archer_egrc:5.5:sp1 cpe:/a:emc:rsa_archer_egrc:5.5.1 cpe:/a:emc:rsa_archer_egrc:5.5.1.3 cpe:/a:emc:rsa_archer_egrc:5.5.2.3

CVE-2016-0899

2016-07-04T12:59:00.130-04:00

2017-08-31T21:29:02.317-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160613 ESA-2016-047: RSA Archer GRC Platform Sensitive Information Disclosure Vulnerability SECTRACK 1036080 EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files.

cpe:/a:emc:rsa_authentication_manager:8.1:sp1

CVE-2016-0900

2016-05-07T06:59:01.640-04:00

2016-11-30T22:03:06.487-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html BUGTRAQ 20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities SECTRACK 1035755 Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-0901.

cpe:/a:emc:rsa_authentication_manager:8.1:sp1

CVE-2016-0901

2016-05-07T06:59:02.640-04:00

2016-11-30T22:03:07.563-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

cpe:/a:emc:rsa_authentication_manager:8.1:sp1

CVE-2016-0902

2016-05-07T06:59:03.720-04:00

2016-11-30T22:03:08.737-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/136994/RSA-Authentication-Manager-XSS-HTTP-Response-Splitting.html BUGTRAQ 20160504 ESA-2016-051: Patch 14 for RSA Authentication Manager 8.1 SP1 to Address Multiple Vulnerabilities SECTRACK 1035755 CRLF injection vulnerability in EMC RSA Authentication Manager before 8.1 SP1 P14 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

cpe:/a:emc:avamar_server:7.3.0

CVE-2016-0903

2016-09-20T22:59:01.490-04:00

2017-07-29T21:29:00.897-04:00

6.4

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities BID 93026 SECTRACK 1036844 Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent.

cpe:/a:emc:avamar_server:7.3.0

CVE-2016-0904

2016-09-20T22:59:03.053-04:00

2017-07-29T21:29:00.943-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities BID 93026 SECTRACK 1036844 Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of this key from another installation.

cpe:/a:emc:avamar_server:7.3.0

CVE-2016-0905

2016-09-20T22:59:04.570-04:00

2017-07-29T21:29:00.990-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities BID 93032 SECTRACK 1036844 Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command.

cpe:/a:emc:avamar:7.2.1

CVE-2016-0906

2016-07-06T10:59:00.130-04:00

2017-08-31T21:29:02.367-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20160706 ESA-2016-054: EMC Avamar Data Store and Avamar Virtual Edition Unauthorized Data Access Vulnerability SECTRACK 1036235 The web-restore interface in Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar through 7.1.2 and 7.2.x through 7.2.1 allows remote authenticated users to read or delete directories via a Linux backup-restore operation.

cpe:/o:emc:isilon_onefs:7.1.0.0 cpe:/o:emc:isilon_onefs:7.1.0.1 cpe:/o:emc:isilon_onefs:7.1.0.2 cpe:/o:emc:isilon_onefs:7.1.0.3 cpe:/o:emc:isilon_onefs:7.1.0.4 cpe:/o:emc:isilon_onefs:7.1.0.5 cpe:/o:emc:isilon_onefs:7.1.0.6 cpe:/o:emc:isilon_onefs:7.1.1.0 cpe:/o:emc:isilon_onefs:7.1.1.1 cpe:/o:emc:isilon_onefs:7.1.1.2 cpe:/o:emc:isilon_onefs:7.1.1.3 cpe:/o:emc:isilon_onefs:7.1.1.4 cpe:/o:emc:isilon_onefs:7.1.1.5 cpe:/o:emc:isilon_onefs:7.1.1.6 cpe:/o:emc:isilon_onefs:7.1.1.7 cpe:/o:emc:isilon_onefs:7.1.1.8 cpe:/o:emc:isilon_onefs:7.1.1.9 cpe:/o:emc:isilon_onefs:7.2.0.0 cpe:/o:emc:isilon_onefs:7.2.1.0 cpe:/o:emc:isilon_onefs:7.2.1.1 cpe:/o:emc:isilon_onefs:7.2.1.2 cpe:/o:emc:isilon_onefs:8.0.0.0 cpe:/o:emc:isilonsd_edge_onefs:8.0.0.0

CVE-2016-0907

2016-05-29T21:59:00.237-04:00

2017-08-08T11:18:21.347-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-08-08T11:17:05.003-04:00

BUGTRAQ 20160526 ESA-2016-061: EMC Isilon OneFS SMB Signing Vulnerability EMC Isilon OneFS 7.1.x and 7.2.x before 7.2.1.3 and 8.0.x before 8.0.0.1, and IsilonSD Edge OneFS 8.0.x before 8.0.0.1, does not require SMB signing within a DCERPC session over ncacn_np, which allows man-in-the-middle attackers to spoof SMB clients by modifying the client-server data stream, a similar issue to CVE-2016-2115.

cpe:/o:emc:isilon_onefs:7.1.0.0 cpe:/o:emc:isilon_onefs:7.1.0.1 cpe:/o:emc:isilon_onefs:7.1.0.2 cpe:/o:emc:isilon_onefs:7.1.0.3 cpe:/o:emc:isilon_onefs:7.1.0.4 cpe:/o:emc:isilon_onefs:7.1.0.5 cpe:/o:emc:isilon_onefs:7.1.0.6 cpe:/o:emc:isilon_onefs:7.1.1.0 cpe:/o:emc:isilon_onefs:7.1.1.1 cpe:/o:emc:isilon_onefs:7.1.1.2 cpe:/o:emc:isilon_onefs:7.1.1.3 cpe:/o:emc:isilon_onefs:7.1.1.4 cpe:/o:emc:isilon_onefs:7.1.1.5 cpe:/o:emc:isilon_onefs:7.1.1.6 cpe:/o:emc:isilon_onefs:7.1.1.7 cpe:/o:emc:isilon_onefs:7.1.1.8 cpe:/o:emc:isilon_onefs:7.2.0.0 cpe:/o:emc:isilon_onefs:7.2.0.1 cpe:/o:emc:isilon_onefs:7.2.0.2 cpe:/o:emc:isilon_onefs:7.2.0.3 cpe:/o:emc:isilon_onefs:7.2.0.4 cpe:/o:emc:isilon_onefs:7.2.0.5 cpe:/o:emc:isilon_onefs:7.2.1.0 cpe:/o:emc:isilon_onefs:7.2.1.1

CVE-2016-0908

2016-06-03T21:59:01.597-04:00

2017-01-10T21:59:01.853-05:00

6.8

LOCAL

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2016-08-03T15:03:29.790-04:00

ALLOWS_ADMIN_ACCESS

BUGTRAQ 20160602 ESA-2016-060: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Isilon OneFS 7.1.x before 7.1.1.9 and 7.2.x before 7.2.1.2 allows local users to obtain root shell access by leveraging administrative privileges.

cpe:/a:emc:avamar_data_store:7.3 cpe:/a:emc:avamar_server_virtual_edition:7.3

CVE-2016-0909

2016-11-15T14:30:00.217-05:00

2017-07-28T21:34:07.257-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://www.securityfocus.com/archive/1/539613 BID 93788 SECTRACK 1037066 EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users.

cpe:/o:emc:data_domain_os:5.5.3.3 cpe:/o:emc:data_domain_os:5.6.1.0 cpe:/o:emc:data_domain_os:5.7.1.0

CVE-2016-0910

2016-06-09T21:59:01.537-04:00

2017-01-10T21:59:01.993-05:00

4.3

LOCAL

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-06-23T13:04:30.033-04:00

BUGTRAQ 20160608 ESA-2016-064: EMC Data Domain Information Disclosure Vulnerability SECTRACK 1036074 EMC Data Domain OS 5.5 before 5.5.4.0, 5.6 before 5.6.1.004, and 5.7 before 5.7.2.0 stores session identifiers of GUI users in a world-readable file, which allows local users to hijack arbitrary accounts via unspecified vectors.

cpe:/o:emc:data_domain:5.7.1.0

CVE-2016-0911

2016-06-19T16:59:03.097-04:00

2017-01-10T23:13:03.773-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2017-01-10T22:14:09.613-05:00

BUGTRAQ 20160610 ESA-2016-062: EMC Data Domain Multiple Vulnerabilities SECTRACK 1036079 EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default no_root_squash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges.

cpe:/o:emc:data_domain:5.7.1.0

CVE-2016-0912

2016-06-19T16:59:04.033-04:00

2017-01-10T23:12:55.397-05:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov

2017-01-10T22:13:54.687-05:00

BUGTRAQ 20160610 ESA-2016-062: EMC Data Domain Multiple Vulnerabilities SECTRACK 1036079 EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 allows remote authenticated users to bypass intended password-change restrictions by leveraging access to (1) a different account with the same role as a target account or (2) an account's session at an unattended workstation.

cpe:/a:emc:networker_module_for_microsoft_applications:3.0 cpe:/a:emc:networker_module_for_microsoft_applications:3.0.1 cpe:/a:emc:networker_module_for_microsoft_applications:8.2.3.6 cpe:/a:emc:replication_manager:5.5.3

CVE-2016-0913

2016-10-04T21:59:05.823-04:00

2017-07-29T21:29:01.037-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20161004 ESA-2016-063: EMC Replication Manager and Network Module for Microsoft Remote Code Execution Vulnerability BID 93348 SECTRACK 1036940 The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft 8.2.x before 8.2.3.6 allows remote RM servers to execute arbitrary commands by placing a crafted script in an SMB share.

cpe:/a:emc:documentum_administrator:7.0 cpe:/a:emc:documentum_administrator:7.1 cpe:/a:emc:documentum_administrator:7.2 cpe:/a:emc:documentum_capital_projects:1.9 cpe:/a:emc:documentum_capital_projects:1.10 cpe:/a:emc:documentum_taskspace:6.7:sp3 cpe:/a:emc:documentum_webtop:6.8 cpe:/a:emc:documentum_webtop:6.8.1

CVE-2016-0914

2016-06-22T20:59:01.223-04:00

2017-01-10T23:10:46.487-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2017-01-10T22:12:53.007-05:00

BUGTRAQ 20160622 ESA-2016-069: EMC Documentum WebTop and WebTop Clients Improper Authorization Vulnerability SECTRACK 1036153 EMC Documentum WebTop 6.8 before Patch 13 and 6.8.1 before Patch 02, Documentum Administrator 7.x before 7.2 Patch 13, Documentum Capital Projects 1.9 before Patch 23 and 1.10 before Patch 10, and Documentum TaskSpace 6.7 SP3 allow remote authenticated users to bypass intended access restrictions and execute arbitrary IAPI/IDQL commands via the IAPI/IDQL interface.

cpe:/a:emc:authentication_manager_prime_self-service:3.0 cpe:/a:emc:authentication_manager_prime_self-service:3.1

CVE-2016-0915

2016-08-22T06:59:00.137-04:00

2017-08-15T21:29:04.290-04:00

5.5

NETWORK

LOW

SINGLE_INSTANCE

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20160806 ESA-2016-070: RSA Authentication Manager Prime SelfService Insecure Direct Object Reference Vulnerability BID 92394 SECTRACK 1036557 The Self-Service Portal in EMC RSA Authentication Manager (AM) Prime Self-Service 3.0 and 3.1 before 3.1 1915.42871 allows remote authenticated users to cause a denial of service (PIN change for an arbitrary user) via a modified token serial number within a PIN change request, related to a "direct object reference vulnerability."

cpe:/a:emc:networker:8.2.1.0 cpe:/a:emc:networker:8.2.1.1 cpe:/a:emc:networker:8.2.1.2 cpe:/a:emc:networker:8.2.1.3 cpe:/a:emc:networker:8.2.1.4 cpe:/a:emc:networker:8.2.1.5 cpe:/a:emc:networker:8.2.1.6 cpe:/a:emc:networker:8.2.1.7 cpe:/a:emc:networker:8.2.1.8 cpe:/a:emc:networker:8.2.2.0 cpe:/a:emc:networker:8.2.2.1 cpe:/a:emc:networker:9.0.0.0

CVE-2016-0916

2016-06-09T21:59:02.817-04:00

2019-02-20T12:00:56.260-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2019-02-20T11:43:10.517-05:00

BUGTRAQ 20160608 ESA-2016-072: EMC NetWorker Remote Code Execution Vulnerability SECTRACK 1036075 EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.

cpe:/a:emc:vnx1_oe_firmware:- cpe:/a:emc:vnx2_oe_firmware:- cpe:/a:emc:vnxe_oe_firmware:-

CVE-2016-0917

2016-09-20T22:59:05.663-04:00

2017-07-29T21:29:01.100-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-096: EMC Celerra, VNX1, VNX2 and VNXe SMB NTLM Authentication Weak Nonce Vulnerability CONFIRM http://www.securityfocus.com/archive/1/539993/30/0/threaded BID 93023 SECTRACK 1036843 The SMB service in EMC VNXe (VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638), VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra (all supported versions) does not prevent duplicate NTLM challenge-response nonces, which makes it easier for remote attackers to execute arbitrary code, or read or write to files, via a series of authentication requests, a related issue to CVE-2010-0231.

cpe:/a:emc:rsa_identity_management_and_governance:6.8.1 cpe:/a:emc:rsa_identity_management_and_governance:6.9.0 cpe:/a:emc:rsa_identity_management_and_governance:6.9.1 cpe:/a:emc:rsa_via_lifecycle_and_governance:7.0.0

CVE-2016-0918

2016-09-24T06:59:00.137-04:00

2017-07-29T21:29:01.147-04:00

4.0

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160923 ESA-2016-097: RSA Identity Governance and Lifecycle Information Disclosure Vulnerability BID 93108 SECTRACK 1036896 EMC RSA Identity Management and Governance before 6.8.1 P25 and 6.9.x before 6.9.1 P15 and RSA Via Lifecycle and Governance before 7.0.0 P04 allow remote authenticated users to obtain User Detail Popup information via a modified URL.

cpe:/a:emc:rsa_web_threat_detection:5.0 cpe:/a:emc:rsa_web_threat_detection:5.1 cpe:/a:emc:rsa_web_threat_detection:5.1.2

CVE-2016-0919

2017-02-03T02:59:00.217-05:00

2017-03-09T12:56:58.737-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-03-09T11:45:44.733-05:00

CONFIRM http://www.securityfocus.com/archive/1/540057/30/0/threaded BID 95820 SECTRACK 1037726 EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.

cpe:/a:emc:avamar_server:7.3.0

CVE-2016-0920

2016-09-20T22:59:06.697-04:00

2017-07-29T21:29:01.193-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities SECTRACK 1036844 Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration.

cpe:/a:emc:avamar_server:7.3.0

CVE-2016-0921

2016-09-20T22:59:07.820-04:00

2017-07-29T21:29:01.240-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov BUGTRAQ 20160919 ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities BID 93032 SECTRACK 1036844 Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program.

cpe:/a:emc:vipr_srm:3.7.1

CVE-2016-0922

2016-09-17T22:59:03.963-04:00

2016-11-28T14:56:04.440-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160913 ESA-2016-104: EMC ViPR SRM Multiple Vulnerabilities BID 92945 EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.

CVE-2016-0923

2016-09-17T22:59:04.980-04:00

2017-07-29T21:29:01.287-04:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160915 ESA-2016-094: RSA BSAFE Micro Edition Suite Multiple Vulnerabilities BID 92994 SECTRACK 1036835 The client in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.9 and 4.1.x before 4.1.5 places the weakest algorithms first in a signature-algorithm list transmitted to a server, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging server behavior in which the first algorithm is used.

CVE-2016-0924

2016-09-17T22:59:06.010-04:00

2016-10-17T23:47:35.957-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2004-2761. Reason: This candidate is subsumed by CVE-2004-2761. Notes: All CVE users should reference CVE-2004-2761 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:emc:rsa_adaptive_authentication_on-premise:7.2

CVE-2016-0925

2016-09-20T22:59:08.820-04:00

2017-07-29T21:29:01.350-04:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov BUGTRAQ 20160920 ESA-2016-093: RSA Adaptive Authentication (On-Premise) Cross-Site Scripting Vulnerability BID 93025 SECTRACK 1036851 Cross-site scripting (XSS) vulnerability in the Case Management application in EMC RSA Adaptive Authentication (On-Premise) before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.7 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.8 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.9 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.10 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.11 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.12 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.13 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.14 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.15 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.17 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.18 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.19 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.20 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.21 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.22 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.23 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.24 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.25 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.26 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.27 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.28 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.29 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.30 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.6.31 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.0 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.1 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.2 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.3 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.4 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.5 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.6 cpe:/a:pivotal_software:cloud_foundry_elastic_runtime:1.7.7

CVE-2016-0926

2016-09-17T22:59:06.933-04:00

2019-02-20T14:27:22.113-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-20T11:50:10.710-05:00

BID 91677 CONFIRM https://pivotal.io/security/cve-2016-0926 Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework.

CVE-2016-0927

2016-09-17T22:59:07.947-04:00

2016-09-30T10:44:30.823-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-09-30T10:31:29.813-04:00

CONFIRM https://pivotal.io/security/cve-2016-0927 Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.6.29 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.0 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.1 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.2 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.3 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.4 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.5 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.6 cpe:/a:pivotal:cloud_foundry_elastic_runtime:1.7.7

CVE-2016-0928

2016-09-17T22:59:08.997-04:00

2016-11-28T14:56:08.753-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91550 CONFIRM https://pivotal.io/security/cve-2016-0928 Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

cpe:/a:pivotal_software:rabbitmq:1.6.0 cpe:/a:pivotal_software:rabbitmq:1.6.1 cpe:/a:pivotal_software:rabbitmq:1.6.2 cpe:/a:pivotal_software:rabbitmq:1.6.3

CVE-2016-0929

2016-09-17T22:59:09.980-04:00

2016-11-28T14:56:09.707-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 91801 CONFIRM https://pivotal.io/security/cve-2016-0929 The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry (PCF) 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials from a command line.

cpe:/a:pivotal:operations_manager:1.6.18 cpe:/a:pivotal:operations_manager:1.7.0 cpe:/a:pivotal:operations_manager:1.7.1 cpe:/a:pivotal:operations_manager:1.7.2 cpe:/a:pivotal:operations_manager:1.7.3 cpe:/a:pivotal:operations_manager:1.7.4 cpe:/a:pivotal:operations_manager:1.7.5 cpe:/a:pivotal:operations_manager:1.7.6 cpe:/a:pivotal:operations_manager:1.7.7 cpe:/a:pivotal:operations_manager:1.7.8 cpe:/a:pivotal:operations_manager:1.7.9

CVE-2016-0930

2016-09-17T22:59:11.497-04:00

2016-11-28T14:56:10.927-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93027 CONFIRM https://pivotal.io/security/cve-2016-0930 Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.

cpe:/a:adobe:acrobat:11.0.0 cpe:/a:adobe:acrobat:11.0.1 cpe:/a:adobe:acrobat:11.0.2 cpe:/a:adobe:acrobat:11.0.3 cpe:/a:adobe:acrobat:11.0.4 cpe:/a:adobe:acrobat:11.0.5 cpe:/a:adobe:acrobat:11.0.6 cpe:/a:adobe:acrobat:11.0.7 cpe:/a:adobe:acrobat:11.0.8 cpe:/a:adobe:acrobat:11.0.9 cpe:/a:adobe:acrobat:11.0.10 cpe:/a:adobe:acrobat:11.0.11 cpe:/a:adobe:acrobat:11.0.12 cpe:/a:adobe:acrobat:11.0.13 cpe:/a:adobe:acrobat_dc:15.006.30097::~~classic~~~ cpe:/a:adobe:acrobat_dc:15.009.20077::~~continuous~~~ cpe:/a:adobe:acrobat_reader:11.0.0 cpe:/a:adobe:acrobat_reader:11.0.1 cpe:/a:adobe:acrobat_reader:11.0.2 cpe:/a:adobe:acrobat_reader:11.0.3 cpe:/a:adobe:acrobat_reader:11.0.4 cpe:/a:adobe:acrobat_reader:11.0.5 cpe:/a:adobe:acrobat_reader:11.0.6 cpe:/a:adobe:acrobat_reader:11.0.7 cpe:/a:adobe:acrobat_reader:11.0.8 cpe:/a:adobe:acrobat_reader:11.0.9 cpe:/a:adobe:acrobat_reader:11.0.10 cpe:/a:adobe:acrobat_reader:11.0.11 cpe:/a:adobe:acrobat_reader:11.0.12 cpe:/a:adobe:acrobat_reader:11.0.13 cpe:/a:adobe:acrobat_reader_dc:15.006.30097::~~classic~~~ cpe:/a:adobe:acrobat_reader_dc:15.009.20077::~~continuous~~~

CVE-2016-0931

2016-01-14T00:59:00.080-05:00

2016-12-07T18:43:35.190-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:55:14.327-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-009 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FileAttachment annotation, a different vulnerability than CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0932

2016-01-14T00:59:01.253-05:00

2016-12-07T18:42:55.527-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:54:12.350-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-008 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Use-after-free vulnerability in the Doc object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0934, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.

CVE-2016-0933

2016-01-14T00:59:02.207-05:00

2016-12-07T18:41:13.950-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:46:26.467-05:00

SECTRACK 1034646 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html IDEFENSE 20160112 Adobe Reader "U3D Bone Weight Modifier" Out-of-bounds Read Vulnerability Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0934

2016-01-14T00:59:03.203-05:00

2016-12-07T18:43:14.157-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:54:53.370-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-016 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Use-after-free vulnerability in AGM.dll in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2016-0932, CVE-2016-0937, CVE-2016-0940, and CVE-2016-0941.

CVE-2016-0935

2016-01-14T00:59:04.343-05:00

2016-12-07T18:41:23.657-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:46:45.923-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-017 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Double free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via a crafted ExtGState dictionary.

CVE-2016-0936

2016-01-14T00:59:05.233-05:00

2016-12-07T18:42:29.777-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:53:47.080-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-014 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG 2000 data, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0938, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0937

2016-01-14T00:59:06.157-05:00

2016-12-07T18:43:53.007-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:45:06.987-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-011 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Use-after-free vulnerability in the OCG object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0940, and CVE-2016-0941.

CVE-2016-0938

2016-01-14T00:59:07.060-05:00

2016-12-07T18:43:29.143-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:21:27.733-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-013 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html The AcroForm plugin in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0939, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0939

2016-01-14T00:59:08.013-05:00

2016-12-07T18:39:48.063-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:23:03.043-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-015 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0942, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0940

2016-01-14T00:59:09.280-05:00

2016-12-07T18:42:09.977-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:23:56.287-05:00

SECTRACK 1034646 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0941.

CVE-2016-0941

2016-01-14T00:59:10.157-05:00

2016-12-07T18:43:21.453-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:25:34.503-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-010 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Use-after-free vulnerability in the Search object implementation in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0932, CVE-2016-0934, CVE-2016-0937, and CVE-2016-0940.

CVE-2016-0942

2016-01-14T00:59:11.080-05:00

2016-12-07T18:42:03.630-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:23:43.817-05:00

SECTRACK 1034646 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0931, CVE-2016-0933, CVE-2016-0936, CVE-2016-0938, CVE-2016-0939, CVE-2016-0944, CVE-2016-0945, and CVE-2016-0946.

CVE-2016-0943

2016-01-14T00:59:11.953-05:00

2016-12-07T18:42:36.510-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2016-12-07T16:25:06.047-05:00

SECTRACK 1034646 MISC http://zerodayinitiative.com/advisories/ZDI-16-012 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X mishandle the Global object, which allows attackers to bypass JavaScript API execution restrictions via unspecified vectors.

CVE-2016-0944

2016-01-14T00:59:12.813-05:00

2016-12-07T18:41:34.547-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:23:32.657-05:00

CVE-2016-0945

2016-01-14T00:59:13.910-05:00

2016-12-07T18:42:15.943-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:24:06.380-05:00

CVE-2016-0946

2016-01-14T00:59:14.893-05:00

2016-12-07T18:39:55.267-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:23:17.513-05:00

CVE-2016-0947

2016-01-14T00:59:15.800-05:00

2016-12-07T18:42:22.320-05:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov

2016-12-07T16:24:48.747-05:00

SECTRACK 1034646 CONFIRM https://helpx.adobe.com/security/products/acrobat/apsb16-02.html Untrusted search path vulnerability in Adobe Download Manager, as used in Adobe Reader and Acrobat before 11.0.14, Acrobat and Acrobat Reader DC Classic before 15.006.30119, and Acrobat and Acrobat Reader DC Continuous before 15.010.20056 on Windows and OS X, allows local users to gain privileges via a crafted resource in an unspecified directory.

cpe:/a:adobe:connect:9.5

CVE-2016-0948

2016-02-10T15:59:00.123-05:00

2016-12-05T22:05:57.910-05:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov SECTRACK 1034978 CONFIRM https://helpx.adobe.com/security/products/connect/apsb16-07.html Cross-site request forgery (CSRF) vulnerability in Adobe Connect before 9.5.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

cpe:/a:adobe:connect:9.5.2

CVE-2016-0949

2016-02-10T15:59:01.577-05:00

2016-12-05T22:05:58.990-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034978 CONFIRM https://helpx.adobe.com/security/products/connect/apsb16-07.html Adobe Connect before 9.5.2 allows remote attackers to have an unspecified impact via a crafted parameter in a URL.

cpe:/a:adobe:connect:9.5.2

CVE-2016-0950

2016-02-10T15:59:03.187-05:00

2016-12-05T22:06:00.020-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/a:adobe:bridge_cc:6.1 cpe:/a:adobe:photoshop_cc:16.1.1

CVE-2016-0951

2016-02-10T15:59:04.607-05:00

2017-09-09T21:29:10.793-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034979 CONFIRM https://helpx.adobe.com/security/products/photoshop/apsb16-03.html EXPLOIT-DB 39429 Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0952 and CVE-2016-0953.

cpe:/a:adobe:bridge_cc:6.1 cpe:/a:adobe:photoshop_cc:16.1.1

CVE-2016-0952

2016-02-10T15:59:05.577-05:00

2017-09-09T21:29:10.857-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034979 CONFIRM https://helpx.adobe.com/security/products/photoshop/apsb16-03.html EXPLOIT-DB 39430 Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0951 and CVE-2016-0953.

cpe:/a:adobe:bridge_cc:6.1 cpe:/a:adobe:photoshop_cc:16.1.1

CVE-2016-0953

2016-02-10T15:59:06.687-05:00

2017-09-09T21:29:10.903-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SECTRACK 1034979 CONFIRM https://helpx.adobe.com/security/products/photoshop/apsb16-03.html EXPLOIT-DB 39431 Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0951 and CVE-2016-0952.

cpe:/a:adobe:digital_editions:4.5.0

CVE-2016-0954

2016-03-09T06:59:36.593-05:00

2017-09-07T21:29:52.467-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov BID 84214 SECTRACK 1035201 CONFIRM https://helpx.adobe.com/security/products/Digital-Editions/apsb16-06.html EXPLOIT-DB 39533 Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

cpe:/a:adobe:experience_manager:6.1.0

CVE-2016-0955

2016-02-10T15:59:07.670-05:00

2016-03-22T20:57:59.860-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-03-22T14:50:08.353-04:00

MISC http://www.csnc.ch/misc/files/advisories/CVE-2016-0955_AEM-XSS.txt CONFIRM https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html Cross-site scripting (XSS) vulnerability in Adobe Experience Manager (AEM) 6.1.0 allows remote authenticated users to inject arbitrary web script or HTML via a folder title field that is mishandled in the Deletion popup dialog.

cpe:/a:adobe:experience_manager:5.6.1 cpe:/a:adobe:experience_manager:6.0.0 cpe:/a:adobe:experience_manager:6.1.0 cpe:/a:apache:sling

CVE-2016-0956

2016-02-10T15:59:08.623-05:00

2018-10-09T15:58:57.880-04:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/135720/Apache-Sling-Framework-2.3.6-Information-Disclosure.html FULLDISC 20160210 Apache Sling Framework v2.3.6 (Adobe AEM) [CVE-2016-0956] - Information Disclosure Vulnerability BUGTRAQ 20160210 Apache Sling Framework v2.3.6 - Information Disclosure Vulnerability CONFIRM https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html EXPLOIT-DB 39435 The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.

cpe:/a:adobe:dispatcher:4.1.4 cpe:/a:adobe:experience_manager:5.6.1 cpe:/a:adobe:experience_manager:6.0.0 cpe:/a:adobe:experience_manager:6.1.0

CVE-2016-0957

2016-02-10T15:59:09.967-05:00

2016-02-25T14:44:38.713-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2016-02-23T13:32:09.633-05:00

CONFIRM https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors.

cpe:/a:adobe:experience_manager:5.6.1 cpe:/a:adobe:experience_manager:6.0.0 cpe:/a:adobe:experience_manager:6.1.0

CVE-2016-0958

2016-02-10T15:59:10.967-05:00

2016-02-18T17:56:24.760-05:00

7.8

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov

2016-02-18T14:20:19.270-05:00

CONFIRM https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 might allow remote attackers to have an unspecified impact via a crafted serialized Java object.

cpe:/a:adobe:air:20.0.0.204 cpe:/a:adobe:air:20.0.0.204::~~~android~~ cpe:/a:adobe:air_sdk:20.0.0.204 cpe:/a:adobe:air_sdk_%26_compiler:20.0.0.204 cpe:/a:adobe:flash_player:20.0.0.228::~~~chrome~~ cpe:/a:adobe:flash_player:20.0.0.228::~~~edge~~ cpe:/a:adobe:flash_player:20.0.0.228::~~~internet_explorer~~ cpe:/a:adobe:flash_player:20.0.0.235 cpe:/a:adobe:flash_player_extended_support_release:18.0.0.268 cpe:/a:adobe:flash_player_for_linux:11.2.202.554

CVE-2016-0959

2017-06-27T16:29:00.807-04:00

2018-01-04T21:30:31.040-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov REDHAT RHSA-2015:2697 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1294580 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-01.html Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.

cpe:/a:adobe:air:20.0.0.233 cpe:/a:adobe:air:20.0.0.260 cpe:/a:adobe:air_sdk:20.0.0.260 cpe:/a:adobe:air_sdk_%5c%26_compiler:20.0.0.260 cpe:/a:adobe:flash_player:11.2.202.569 cpe:/a:adobe:flash_player:19.0.0.185 cpe:/a:adobe:flash_player:19.0.0.207 cpe:/a:adobe:flash_player:19.0.0.226 cpe:/a:adobe:flash_player:19.0.0.245 cpe:/a:adobe:flash_player:20.0.0.228 cpe:/a:adobe:flash_player:20.0.0.235 cpe:/a:adobe:flash_player:20.0.0.286 cpe:/a:adobe:flash_player:20.0.0.306 cpe:/a:adobe:flash_player:20.0.0.306::~~~chrome~~ cpe:/a:adobe:flash_player:20.0.0.306::~~~edge~~ cpe:/a:adobe:flash_player:20.0.0.306::~~~internet_explorer~~ cpe:/a:adobe:flash_player_esr:18.0.0.329

CVE-2016-0960

2016-03-12T10:59:02.790-05:00

2017-01-03T21:59:00.450-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0961

2016-03-12T10:59:03.773-05:00

2017-01-03T21:59:00.527-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0962

2016-03-12T10:59:05.023-05:00

2017-01-03T21:59:00.637-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0963

2016-03-12T10:59:05.993-05:00

2017-02-03T21:59:00.740-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84308 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0993 and CVE-2016-1010.

CVE-2016-0964

2016-02-10T15:59:11.873-05:00

2017-09-09T21:29:10.997-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39467 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0965

2016-02-10T15:59:12.797-05:00

2017-09-09T21:29:11.077-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39460 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0966

2016-02-10T15:59:13.797-05:00

2016-12-05T22:06:04.457-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0967

2016-02-10T15:59:14.827-05:00

2017-09-09T21:29:11.187-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39466 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0968

2016-02-10T15:59:15.907-05:00

2016-12-05T22:06:06.567-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0969

2016-02-10T15:59:16.890-05:00

2016-12-05T22:06:07.567-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0970

2016-02-10T15:59:17.827-05:00

2016-12-05T22:06:08.833-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0971

2016-02-10T15:59:19.060-05:00

2017-09-09T21:29:11.263-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39465 Heap-based buffer overflow in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors.

CVE-2016-0972

2016-02-10T15:59:20.063-05:00

2016-12-05T22:06:10.943-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0973

2016-02-10T15:59:21.063-05:00

2016-12-05T22:06:12.147-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 MISC http://zerodayinitiative.com/advisories/ZDI-16-161/ CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Use-after-free vulnerability in the URLRequest object implementation in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via a URLLoader.load call, a different vulnerability than CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

CVE-2016-0974

2016-02-10T15:59:22.047-05:00

2017-09-09T21:29:11.340-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39463 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

CVE-2016-0975

2016-02-10T15:59:23.030-05:00

2016-12-05T22:06:14.383-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 MISC http://zerodayinitiative.com/advisories/ZDI-16-160/ CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Use-after-free vulnerability in the instanceof function in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code by leveraging improper reference handling, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

CVE-2016-0976

2016-02-10T15:59:24.217-05:00

2016-12-05T22:06:15.570-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0977

2016-02-10T15:59:25.250-05:00

2016-12-05T22:06:16.680-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0978, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0978

2016-02-10T15:59:26.280-05:00

2016-12-05T22:06:17.803-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0979, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0979

2016-02-10T15:59:27.157-05:00

2016-12-05T22:06:18.850-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0980, and CVE-2016-0981.

CVE-2016-0980

2016-02-10T15:59:28.157-05:00

2016-12-05T22:06:19.993-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0981.

CVE-2016-0981

2016-02-10T15:59:29.547-05:00

2016-12-05T22:06:21.070-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0964, CVE-2016-0965, CVE-2016-0966, CVE-2016-0967, CVE-2016-0968, CVE-2016-0969, CVE-2016-0970, CVE-2016-0972, CVE-2016-0976, CVE-2016-0977, CVE-2016-0978, CVE-2016-0979, and CVE-2016-0980.

CVE-2016-0982

2016-02-10T15:59:30.530-05:00

2016-12-05T22:06:22.163-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0983, and CVE-2016-0984.

CVE-2016-0983

2016-02-10T15:59:31.657-05:00

2016-12-05T22:06:23.227-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0984.

CVE-2016-0984

2016-02-10T15:59:32.563-05:00

2017-09-09T21:29:11.437-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39462 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

cpe:/a:adobe:air:20.0.0.233 cpe:/a:adobe:air_sdk:20.0.0.233 cpe:/a:adobe:air_sdk_%5c%26_compiler:20.0.0.233 cpe:/a:adobe:flash_player:11.2.202.559 cpe:/a:adobe:flash_player:18.0.0.326 cpe:/a:adobe:flash_player:19.0.0.185 cpe:/a:adobe:flash_player:19.0.0.207 cpe:/a:adobe:flash_player:19.0.0.226 cpe:/a:adobe:flash_player:19.0.0.245 cpe:/a:adobe:flash_player:20.0.0.228 cpe:/a:adobe:flash_player:20.0.0.235 cpe:/a:adobe:flash_player:20.0.0.286 cpe:/a:opensuse:nonfree:13.1 cpe:/a:opensuse:nonfree:13.2 cpe:/o:opensuse:linux_enterprise_desktop:11:sp4 cpe:/o:opensuse:linux_enterprise_desktop:12 cpe:/o:opensuse:linux_enterprise_desktop:12:sp1 cpe:/o:opensuse:linux_enterprise_workstation_extension:12 cpe:/o:opensuse:linux_enterprise_workstation_extension:12:sp1 cpe:/o:redhat:enterprise_linux_desktop:5.0 cpe:/o:redhat:enterprise_linux_desktop_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary:6.0 cpe:/o:redhat:enterprise_linux_server_supplementary_eus:6.7z cpe:/o:redhat:enterprise_linux_supplementary:5.0 cpe:/o:redhat:enterprise_linux_workstation_supplementary:6.0

CVE-2016-0985

2016-02-10T15:59:33.517-05:00

2017-09-09T21:29:11.527-04:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0398 SUSE SUSE-SU-2016:0400 SUSE openSUSE-SU-2016:0412 SUSE openSUSE-SU-2016:0415 REDHAT RHSA-2016:0166 SECTRACK 1034970 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-04.html GENTOO GLSA-201603-07 EXPLOIT-DB 39461 Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."

CVE-2016-0986

2016-03-12T10:59:06.930-05:00

2017-01-03T21:59:00.717-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0987

2016-03-12T10:59:07.823-05:00

2016-12-02T22:19:03.377-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0988

2016-03-12T10:59:08.743-05:00

2016-12-02T22:19:04.610-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0989

2016-03-12T10:59:09.963-05:00

2017-01-03T21:59:00.810-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0992, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0990

2016-03-12T10:59:10.977-05:00

2016-12-02T22:19:06.830-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0991

2016-03-12T10:59:11.900-05:00

2016-12-02T22:19:07.907-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0992

2016-03-12T10:59:12.823-05:00

2017-01-03T21:59:00.903-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1002, and CVE-2016-1005.

CVE-2016-0993

2016-03-12T10:59:13.743-05:00

2017-02-03T21:59:00.850-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

CVE-2016-0994

2016-03-12T10:59:14.917-05:00

2016-12-02T22:19:11.330-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-194/ CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0995

2016-03-12T10:59:15.900-05:00

2016-12-02T22:19:12.597-05:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0996

2016-03-12T10:59:16.853-05:00

2016-12-02T22:19:13.720-05:00

9.3

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-193/ CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 Use-after-free vulnerability in the setInterval method in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0997

2016-03-12T10:59:17.870-05:00

2017-09-07T21:29:52.577-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39613 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0998

2016-03-12T10:59:18.823-05:00

2017-09-07T21:29:52.687-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39612 EXPLOIT-DB 39631 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-0999

2016-03-12T10:59:20.027-05:00

2017-09-07T21:29:52.793-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39611 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.

CVE-2016-1000

2016-03-12T10:59:21.027-05:00

2017-09-07T21:29:52.903-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 REDHAT RHSA-2016:1582 REDHAT RHSA-2016:1583 BID 84312 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39610 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.

cpe:/a:ipswitch:whatsup_gold:16.4

CVE-2016-1000000

2016-10-06T10:59:15.583-04:00

2017-11-02T21:29:01.497-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 94496 MISC https://www.tenable.com/security/research/tra-2016-15 Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection

cpe:/a:flask-oidc_project:flask-oidc:0.1.2

CVE-2016-1000001

2016-10-07T14:59:00.210-04:00

2017-02-19T01:16:19.183-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-07T14:28:19.207-05:00

MISC https://github.com/puiterwijk/flask-oidc/blob/master/flask_oidc/__init__.py#L293 flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect

cpe:/a:mirror_manager_project:mirror_manager:0.7.2

CVE-2016-1000003

2016-10-07T14:59:01.303-04:00

2016-12-22T09:40:13.323-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:43:17.290-05:00

MISC https://github.com/fedora-infra/mirrormanager2/commit/2e227f6023477cbdbefd577f15d0846aa40c8775.patch MISC https://github.com/fedora-infra/mirrormanager2/commit/eb9b542bc818071b9eee41c3583b7e6e172b3a53.patch Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.

cpe:/a:pagure_project:pagure:2.2.1

CVE-2016-1000007

2016-10-07T14:59:02.350-04:00

2017-02-19T01:16:19.277-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-07T14:28:28.237-05:00

MISC https://pagure.io/pagure/c/070d63983fe5daef92005ea33d3b8c693c224c77.patch Pagure 2.2.1 XSS in raw file endpoint

cpe:/a:tp-link:tp-link:-

CVE-2016-1000009

2016-10-06T10:59:16.693-04:00

2018-04-13T08:50:30.763-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-04-12T14:09:44.617-04:00

BUGTRAQ 20160701 Logic security flaw in TP-LINK - tplinklogin.net MISC https://pbs.twimg.com/media/CmnQ3F0WIAAs_X0.jpg MISC https://pbs.twimg.com/media/CmnQGI0WAAIbPHA.jpg TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.

CVE-2016-1000013

2018-06-17T16:29:00.213-04:00

2018-06-17T16:29:00.227-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10531. Reason: This candidate is a reservation duplicate of CVE-2016-10531. Notes: All CVE users should reference CVE-2016-10531 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000014

2016-10-06T10:59:17.757-04:00

2016-10-06T10:59:17.897-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3956. Reason: This candidate is a duplicate of CVE-2016-3956. Notes: All CVE users should reference CVE-2016-3956 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000023

2018-06-17T16:29:00.260-04:00

2018-06-17T16:29:00.277-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10540. Reason: This candidate is a reservation duplicate of CVE-2016-10540. Notes: All CVE users should reference CVE-2016-10540 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000025

2018-06-17T16:29:00.307-04:00

2018-06-17T16:29:00.323-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10542. Reason: This candidate is a reservation duplicate of CVE-2016-10542. Notes: All CVE users should reference CVE-2016-10542 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:pidgin:pidgin:- cpe:/a:pidgin:pidgin:1.5.1 cpe:/a:pidgin:pidgin:2.0.0 cpe:/a:pidgin:pidgin:2.0.1 cpe:/a:pidgin:pidgin:2.0.2 cpe:/a:pidgin:pidgin:2.1.0 cpe:/a:pidgin:pidgin:2.1.1 cpe:/a:pidgin:pidgin:2.2.0 cpe:/a:pidgin:pidgin:2.2.1 cpe:/a:pidgin:pidgin:2.2.2 cpe:/a:pidgin:pidgin:2.3.0 cpe:/a:pidgin:pidgin:2.3.1 cpe:/a:pidgin:pidgin:2.4.0 cpe:/a:pidgin:pidgin:2.4.1 cpe:/a:pidgin:pidgin:2.4.2 cpe:/a:pidgin:pidgin:2.4.3 cpe:/a:pidgin:pidgin:2.5.0 cpe:/a:pidgin:pidgin:2.5.1 cpe:/a:pidgin:pidgin:2.5.2 cpe:/a:pidgin:pidgin:2.5.3 cpe:/a:pidgin:pidgin:2.5.4 cpe:/a:pidgin:pidgin:2.5.5 cpe:/a:pidgin:pidgin:2.5.6 cpe:/a:pidgin:pidgin:2.5.7 cpe:/a:pidgin:pidgin:2.5.8 cpe:/a:pidgin:pidgin:2.5.9 cpe:/a:pidgin:pidgin:2.6.0 cpe:/a:pidgin:pidgin:2.6.1 cpe:/a:pidgin:pidgin:2.6.2 cpe:/a:pidgin:pidgin:2.6.3 cpe:/a:pidgin:pidgin:2.6.4 cpe:/a:pidgin:pidgin:2.6.5 cpe:/a:pidgin:pidgin:2.6.6 cpe:/a:pidgin:pidgin:2.7.0 cpe:/a:pidgin:pidgin:2.7.1 cpe:/a:pidgin:pidgin:2.7.2 cpe:/a:pidgin:pidgin:2.7.3 cpe:/a:pidgin:pidgin:2.7.4 cpe:/a:pidgin:pidgin:2.7.5 cpe:/a:pidgin:pidgin:2.7.6 cpe:/a:pidgin:pidgin:2.7.7 cpe:/a:pidgin:pidgin:2.7.8 cpe:/a:pidgin:pidgin:2.7.9 cpe:/a:pidgin:pidgin:2.7.10 cpe:/a:pidgin:pidgin:2.7.11 cpe:/a:pidgin:pidgin:2.8.0 cpe:/a:pidgin:pidgin:2.9.0 cpe:/a:pidgin:pidgin:2.10.0 cpe:/a:pidgin:pidgin:2.10.1 cpe:/a:pidgin:pidgin:2.10.2 cpe:/a:pidgin:pidgin:2.10.3 cpe:/a:pidgin:pidgin:2.10.4 cpe:/a:pidgin:pidgin:2.10.5 cpe:/a:pidgin:pidgin:2.10.6 cpe:/a:pidgin:pidgin:2.10.7 cpe:/a:pidgin:pidgin:2.10.8 cpe:/a:pidgin:pidgin:2.10.9 cpe:/a:pidgin:pidgin:2.10.10 cpe:/a:pidgin:pidgin:2.10.11 cpe:/a:pidgin:pidgin:2.10.12 cpe:/o:suse:linux_enterprise_server:11:sp4

CVE-2016-1000030

2018-09-05T13:29:00.230-04:00

2018-11-14T14:34:45.520-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-10-26T12:21:54.217-04:00

CONFIRM https://access.redhat.com/security/cve/cve-2016-1000030 CONFIRM https://bitbucket.org/pidgin/main/commits/d6fc1ce76ffe CONFIRM https://pidgin.im/news/security/?id=91 GENTOO GLSA-201701-38 CONFIRM https://www.suse.com/pt-br/security/cve/CVE-2016-1000030/ Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.

cpe:/a:apache:commons_fileupload:1.3.2

CVE-2016-1000031

2016-10-25T10:29:00.180-04:00

2019-05-24T13:29:00.273-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov SUSE openSUSE-SU-2019:1399 CONFIRM http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html BID 93604 MISC http://www.zerodayinitiative.com/advisories/ZDI-16-570/ CONFIRM https://issues.apache.org/jira/browse/FILEUPLOAD-279 CONFIRM https://issues.apache.org/jira/browse/WW-4812 MLIST [announce] 20181105 [SECURITY] Immediately upgrade commons-fileupload to version 1.3.3 when running Struts 2.3.36 or prior CONFIRM https://security.netapp.com/advisory/ntap-20190212-0001/ MISC https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html CONFIRM https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html MISC https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html MISC https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html MISC https://www.tenable.com/security/research/tra-2016-12 MISC https://www.tenable.com/security/research/tra-2016-23 MISC https://www.tenable.com/security/research/tra-2016-30 Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

cpe:/a:python:tgcaptcha2:0.3.0

CVE-2016-1000032

2016-10-25T10:29:01.667-04:00

2017-01-18T21:59:02.030-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC https://bugzilla.redhat.com/show_bug.cgi?id=1316083 MISC https://patrick.uiterwijk.org/2016/03/09/fedora-spam-dwf-2016-89000/ TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.

cpe:/a:shotwell_project:shotwell:0.22.0 cpe:/o:redhat:enterprise_linux:7.0

CVE-2016-1000033

2016-10-25T10:29:03.353-04:00

2017-02-19T01:16:22.060-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-11-07T14:28:56.087-05:00

MISC https://bugzilla.gnome.org/show_bug.cgi?id=754488 Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.

CVE-2016-1000100

2016-10-06T10:59:17.927-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5385. Reason: This candidate is a duplicate of CVE-2016-5385. Notes: All CVE users should reference CVE-2016-5385 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000101

2016-10-06T10:59:17.960-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5386. Reason: This candidate is a duplicate of CVE-2016-5386. Notes: All CVE users should reference CVE-2016-5386 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000102

2016-10-06T10:59:17.990-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5387. Reason: This candidate is a duplicate of CVE-2016-5387. Notes: All CVE users should reference CVE-2016-5387 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000106

2016-10-06T10:59:18.020-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-5388. Reason: This candidate is a duplicate of CVE-2016-5388. Notes: All CVE users should reference CVE-2016-5388 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:contus-video-comments_project:contus-video-comments:1.0::~~~wordpress~~

CVE-2016-1000112

2016-10-06T10:59:18.053-04:00

2017-01-15T21:59:00.463-05:00

9.4

NETWORK

LOW

NONE

COMPLETE

NONE

http://nvd.nist.gov BID 93967 MISC http://www.vapidlabs.com/advisory.php?v=163 Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin

cpe:/a:huge-it:huge-it_image_gallery:1.1.5::~~~joomla%21~~

CVE-2016-1000113

2016-10-06T10:59:19.067-04:00

2018-05-02T09:07:07.310-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-05-01T11:16:22.227-04:00

MISC http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-pro BID 92102 MISC http://www.vapidlabs.com/advisory.php?v=164 XSS and SQLi in huge IT gallery v1.1.5 for Joomla

cpe:/a:huge-it:huge-it_image_gallery:1.1.5::~~~joomla%21~~

CVE-2016-1000114

2016-10-06T10:59:20.303-04:00

2018-05-02T11:24:15.580-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2018-05-01T14:00:46.483-04:00

MISC http://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-pro BID 92102 MISC http://www.vapidlabs.com/advisory.php?v=164 XSS in huge IT gallery v1.1.5 for Joomla

cpe:/a:huge-it:portfolio_gallery_manager:1.1.0::~~~joomla%21~~

CVE-2016-1000115

2016-10-21T10:59:00.183-04:00

2017-11-13T11:17:42.107-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2017-11-10T17:25:59.153-05:00

MISC http://huge-it.com/joomla-portfolio-gallery/ BID 93821 MISC http://www.vapidlabs.com/advisory.php?v=165 Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS

cpe:/a:huge-it:portfolio_gallery_manager:1.1.5::~~~joomla~~

CVE-2016-1000116

2016-10-21T10:59:01.870-04:00

2017-03-27T21:59:00.397-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://huge-it.com/joomla-portfolio-gallery/ BID 93821 MISC http://www.vapidlabs.com/advisory.php?v=165 Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS

cpe:/a:huge-it:slideshow:1.0.4::~~~joomla~~

CVE-2016-1000117

2016-10-21T10:59:03.027-04:00

2017-01-05T21:59:00.677-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov MISC http://extensions.joomla.org/extensions/extension/photos-a-images/slideshow/slideshow BID 93822 MISC http://www.vapidlabs.com/advisory.php?v=166 XSS & SQLi in HugeIT slideshow v1.0.4

cpe:/a:huge-it:slideshow:1.0.4::~~~joomla%21~~

CVE-2016-1000118

2016-10-21T10:59:04.010-04:00

2018-05-02T11:22:04.463-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-05-01T14:27:41.617-04:00

MISC http://extensions.joomla.org/extensions/extension/photos-a-images/slideshow/slideshow BID 93822 MISC http://www.vapidlabs.com/advisory.php?v=166 XSS & SQLi in HugeIT slideshow v1.0.4

cpe:/a:huge-it:catalog:1.0.4::~~~joomla%21~~

CVE-2016-1000119

2016-10-21T10:59:05.450-04:00

2018-05-02T09:05:06.787-04:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-05-01T11:41:22.807-04:00

MISC http://extensions.joomla.org/extensions/extension/e-commerce/shopping-cart/catalog BID 92185 MISC http://www.vapidlabs.com/advisory.php?v=167 SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla

cpe:/a:huge-it:catalog:1.0.4::~~~joomla~~

CVE-2016-1000120

2016-10-27T17:59:00.187-04:00

2016-12-22T09:37:41.993-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:38:58.093-05:00

cpe:/a:huge-it:slider:1.0.9::~~~joomla~~

CVE-2016-1000121

2016-10-27T17:59:02.060-04:00

2016-11-28T14:56:41.900-05:00

3.5

NETWORK

MEDIUM

SINGLE_INSTANCE

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://extensions.joomla.org/extensions/extension/photos-a-images/slider BID 92160 MISC http://www.vapidlabs.com/advisory.php?v=168 XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension

cpe:/a:huge-it:slider:1.0.9::~~~joomla~~

CVE-2016-1000122

2016-10-27T17:59:03.920-04:00

2016-12-22T09:39:00.067-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:39:27.787-05:00

MISC http://extensions.joomla.org/extensions/extension/photos-a-images/slider BID 92160 MISC http://www.vapidlabs.com/advisory.php?v=168 XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension

cpe:/a:huge-it:video_gallery:1.0.9::~~~joomla~~

CVE-2016-1000123

2016-10-06T10:59:21.397-04:00

2017-09-05T21:29:00.453-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://huge-it.com/joomla-video-gallery/ BID 93107 MISC http://www.vapidlabs.com/advisory.php?v=169 EXPLOIT-DB 42596 Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla

cpe:/a:huge-it:portfolio_gallery:1.0.6::~~~joomla%21~~

CVE-2016-1000124

2016-10-06T10:59:22.257-04:00

2017-09-05T21:29:00.500-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://huge-it.com/joomla-portfolio-gallery/ BID 93268 MISC http://www.vapidlabs.com/advisory.php?v=170 EXPLOIT-DB 42597 Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6

cpe:/a:huge-it:huge-it_catalog:1.0.7::~~~joomla%21~~

CVE-2016-1000125

2016-10-06T10:59:23.333-04:00

2017-09-05T21:29:00.547-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://huge-it.com/joomla-catalog/ MISC http://www.vapidlabs.com/advisory.php?v=171 EXPLOIT-DB 42598 Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla

cpe:/a:admin-font-editor_project:admin-font-editor:1.8::~~~wordpress~~

CVE-2016-1000126

2016-10-10T16:59:00.173-04:00

2016-11-28T14:56:46.057-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93896 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=526 MISC https://wordpress.org/plugins/admin-font-editor Reflected XSS in wordpress plugin admin-font-editor v1.8

cpe:/a:ajax-random-post_project:ajax-random-post:2.00::~~~wordpress~~

CVE-2016-1000127

2016-10-10T16:59:01.563-04:00

2016-11-28T14:56:47.057-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93895 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=494 MISC https://wordpress.org/plugins/ajax-random-post Reflected XSS in wordpress plugin ajax-random-post v2.00

cpe:/a:anti-plagiarism_project:anti-plagiarism:3.60::~~~wordpress~~

CVE-2016-1000128

2016-10-10T16:59:03.000-04:00

2016-12-22T09:36:33.267-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:37:13.873-05:00

BID 93890 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=161 MISC https://wordpress.org/plugins/anti-plagiarism Reflected XSS in wordpress plugin anti-plagiarism v3.60

cpe:/a:defa-online-image-protector_project:defa-online-image-protector:3.3::~~~wordpress~~

CVE-2016-1000129

2016-10-10T16:59:04.080-04:00

2016-11-28T14:56:49.180-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93892 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=449 MISC https://wordpress.org/plugins/defa-online-image-protector Reflected XSS in wordpress plugin defa-online-image-protector v3.3

cpe:/a:e-search_project:e-search:1.0::~~~wordpress~~

CVE-2016-1000130

2016-10-10T16:59:05.220-04:00

2016-12-22T09:36:06.780-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:36:49.947-05:00

MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=394 MISC https://wordpress.org/plugins/e-search Reflected XSS in wordpress plugin e-search v1.0

cpe:/a:e-search_project:esearch:1.0::~~~wordpress~~

CVE-2016-1000131

2016-10-10T16:59:06.457-04:00

2016-12-22T09:37:32.227-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:43:40.573-05:00

BID 93867 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=393 MISC https://wordpress.org/plugins/e-search Reflected XSS in wordpress plugin e-search v1.0

cpe:/a:cminds:enhanced-tooltipglossary:3.2.8::~~~wordpress~~

CVE-2016-1000132

2016-10-10T16:59:07.783-04:00

2016-12-22T09:39:45.257-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:39:52.647-05:00

BID 93865 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=37 MISC https://wordpress.org/plugins/enhanced-tooltipglossary Reflected XSS in wordpress plugin enhanced-tooltipglossary v3.2.8

cpe:/a:designsandcode:forget-about-shorcode-buttons:1.1.1::~~~wordpress~~

CVE-2016-1000133

2016-10-10T16:59:09.080-04:00

2016-11-28T14:56:52.463-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93869 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=602 MISC https://wordpress.org/plugins/forget-about-shortcode-buttons Reflected XSS in wordpress plugin forget-about-shortcode-buttons v1.1.1

cpe:/a:hdw-tube_project:hdw-tube:1.2::~~~wordpress~~

CVE-2016-1000134

2016-10-10T16:59:10.190-04:00

2016-12-22T09:21:44.147-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:35:15.653-05:00

BID 93868 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=530 MISC https://wordpress.org/plugins/hdw-tube Reflected XSS in wordpress plugin hdw-tube v1.2

cpe:/a:hdw-tube_project:hdw-tube:1.2::~~~wordpress~~

CVE-2016-1000135

2016-10-10T16:59:11.313-04:00

2016-12-22T09:36:56.707-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:36:25.633-05:00

BID 93820 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=533 MISC https://wordpress.org/plugins/hdw-tube Reflected XSS in wordpress plugin hdw-tube v1.2

cpe:/a:heat-trakr_project:heat-trackr:1.0::~~~wordpress~~

CVE-2016-1000136

2016-10-10T16:59:12.517-04:00

2016-11-28T14:56:55.697-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93818 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=798 MISC https://wordpress.org/plugins/heat-trackr Reflected XSS in wordpress plugin heat-trackr v1.0

cpe:/a:hero-maps-pro_project:hero-maps-pro:2.1.0::~~~wordpress~~

CVE-2016-1000137

2016-10-10T16:59:13.550-04:00

2016-12-22T09:39:53.507-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:40:33.497-05:00

BID 93815 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=658 MISC https://wordpress.org/plugins/hero-maps-pro Reflected XSS in wordpress plugin hero-maps-pro v2.1.0

cpe:/a:indexisto_project:indexisto:1.0.5::~~~wordpress~~

CVE-2016-1000138

2016-10-10T16:59:14.643-04:00

2016-11-28T14:56:58.963-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93816 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=38 MISC https://wordpress.org/plugins/indexisto Reflected XSS in wordpress plugin indexisto v1.0.5

cpe:/a:infusionsoft_project:infusionsoft:1.5.11::~~~wordpress~~

CVE-2016-1000139

2016-10-10T16:59:15.753-04:00

2016-12-22T09:37:58.307-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:40:45.360-05:00

BID 93819 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=864 MISC https://wordpress.org/plugins/infusionsoft Reflected XSS in wordpress plugin infusionsoft v1.5.11

cpe:/a:new-year-firework_project:new-year-firework:1.1.9::~~~wordpress~~

CVE-2016-1000140

2016-10-10T16:59:17.003-04:00

2016-11-28T14:57:01.183-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93817 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=453 MISC https://wordpress.org/plugins/new-year-firework Reflected XSS in wordpress plugin new-year-firework v1.1.9

cpe:/a:page-layout-builder_project:page-layout-builder:1.9.3::~~~wordpress~~

CVE-2016-1000141

2016-10-10T16:59:18.097-04:00

2016-11-28T14:57:02.183-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93804 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=358 MISC https://wordpress.org/plugins/page-layout-builder Reflected XSS in wordpress plugin page-layout-builder v1.9.3

cpe:/a:parsi-font_project:parsi-font:4.2.5::~~~wordpress~~

CVE-2016-1000142

2016-10-10T16:59:19.300-04:00

2016-12-22T09:40:18.980-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:42:53.787-05:00

BID 93802 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=435 MISC https://wordpress.org/plugins/parsi-font Reflected XSS in wordpress plugin parsi-font v4.2.5

cpe:/a:photoxhibit_project:photoxhibit:2.1.8::~~~wordpress~~

CVE-2016-1000143

2016-10-10T16:59:20.470-04:00

2016-11-28T14:57:04.357-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93803 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=780 MISC https://wordpress.org/plugins/photoxhibit Reflected XSS in wordpress plugin photoxhibit v2.1.8

cpe:/a:photoxhibit_project:photoxhibit:2.1.8::~~~wordpress~~

CVE-2016-1000144

2016-10-10T16:59:21.957-04:00

2016-12-22T09:37:48.510-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:39:12.047-05:00

BID 93585 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=778 MISC https://wordpress.org/plugins/photoxhibit Reflected XSS in wordpress plugin photoxhibit v2.1.8

cpe:/a:pondol-carousel_project:pondol-carousel:1.0::~~~wordpress~~

CVE-2016-1000145

2016-10-10T16:59:23.067-04:00

2016-12-22T09:40:46.297-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:42:24.203-05:00

BID 93586 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=524 MISC https://wordpress.org/plugins/pondol-carousel Reflected XSS in wordpress plugin pondol-carousel v1.0

cpe:/a:pondol-formmail_project:pondol-formmail:1.1::~~~wordpress~~

CVE-2016-1000146

2016-10-10T16:59:24.160-04:00

2016-11-28T14:57:07.793-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93584 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=787 MISC https://wordpress.org/plugins/pondol-formmail Reflected XSS in wordpress plugin pondol-formmail v1.1

cpe:/a:recipes-writer_project:recipes-writer:1.0.4::~~~wordpress~~

CVE-2016-1000147

2016-10-10T16:59:25.190-04:00

2016-12-22T09:28:44.750-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:38:05.430-05:00

BID 93589 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=380 MISC https://wordpress.org/plugins/recipes-writer Reflected XSS in wordpress plugin recipes-writer v1.0.4

cpe:/a:s3-video_project:s3-video:0.983::~~~wordpress~~

CVE-2016-1000148

2016-10-10T16:59:26.567-04:00

2016-11-28T14:57:09.840-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93583 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=240 MISC https://wordpress.org/plugins/s3-video Reflected XSS in wordpress plugin s3-video v0.983

cpe:/a:simpel-reserveren_project:simpel-reserveren:3.5.2::~~~wordpress~~

CVE-2016-1000149

2016-10-10T16:59:27.567-04:00

2016-11-28T14:57:10.763-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93582 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=474 MISC https://wordpress.org/plugins/simpel-reserveren Reflected XSS in wordpress plugin simpel-reserveren v3.5.2

cpe:/a:oxil:simplified-content:1.0.0::~~~wordpress~~

CVE-2016-1000150

2016-10-10T16:59:28.643-04:00

2016-12-22T09:35:46.260-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:37:32.157-05:00

BID 93581 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=853 MISC https://wordpress.org/plugins/simplified-content Reflected XSS in wordpress plugin simplified-content v1.0.0

cpe:/a:tera-charts_project:tera-charts:1.0::~~~wordpress~~

CVE-2016-1000151

2016-10-10T16:59:29.613-04:00

2016-12-22T09:37:04.317-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:43:49.480-05:00

BID 93580 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=455 MISC https://wordpress.org/plugins/tera-charts Reflected XSS in wordpress plugin tera-charts v1.0

cpe:/a:tidio-form_project:tidio-form:1.0::~~~wordpress~~

CVE-2016-1000152

2016-10-10T16:59:30.673-04:00

2016-12-22T09:39:38.773-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:39:40.460-05:00

BID 93579 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=799 MISC https://wordpress.org/plugins/tidio-form Reflected XSS in wordpress plugin tidio-form v1.0

cpe:/a:tidio-gallery_project:tidio-gallery:1.1::~~~wordpress~~

CVE-2016-1000153

2016-10-10T16:59:31.877-04:00

2016-12-22T09:23:29.170-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:35:00.337-05:00

BID 93543 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=427 MISC https://wordpress.org/plugins/tidio-gallery Reflected XSS in wordpress plugin tidio-gallery v1.1

cpe:/a:browserweb:whizz:1.0.7::~~~wordpress~~

CVE-2016-1000154

2016-10-10T16:59:32.940-04:00

2016-11-28T14:57:16.373-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 93538 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=112 MISC https://wordpress.org/plugins/whizz Reflected XSS in wordpress plugin whizz v1.0.7

cpe:/a:wpsolr:wpsolr-search-engine:7.6::~~~wordpress~~

CVE-2016-1000155

2016-10-10T16:59:33.940-04:00

2016-12-22T09:40:01.713-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2016-12-21T14:43:27.917-05:00

BID 93536 MISC http://www.vapidlabs.com/wp/wp_advisory.php?v=303 MISC https://wordpress.org/plugins/wpsolr-search-engine Reflected XSS in wordpress plugin wpsolr-search-engine v7.6

cpe:/a:mailcwp_project:mailcwp:1.100::~~~wordpress~~

CVE-2016-1000156

2016-12-14T13:59:00.200-05:00

2016-12-15T14:03:39.673-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-15T13:39:25.673-05:00

MISC http://www.vapidlabs.com/advisory.php?v=175 MISC https://wordpress.org/plugins/mailcwp/ Mailcwp remote file upload vulnerability incomplete fix v1.100

cpe:/a:squid-cache:squid:3.1.10 cpe:/a:squid-cache:squid:3.1.11 cpe:/a:squid-cache:squid:3.1.12 cpe:/a:squid-cache:squid:3.1.14 cpe:/a:squid-cache:squid:3.1.15 cpe:/a:squid-cache:squid:3.1.16 cpe:/a:squid-cache:squid:3.1.17 cpe:/a:squid-cache:squid:3.1.18 cpe:/a:squid-cache:squid:3.1.19 cpe:/a:squid-cache:squid:3.1.20 cpe:/a:squid-cache:squid:3.1.21 cpe:/a:squid-cache:squid:3.1.22 cpe:/a:squid-cache:squid:3.1.23 cpe:/a:squid-cache:squid:3.2.0.3 cpe:/a:squid-cache:squid:3.2.0.4 cpe:/a:squid-cache:squid:3.2.0.5 cpe:/a:squid-cache:squid:3.2.0.6 cpe:/a:squid-cache:squid:3.2.0.7 cpe:/a:squid-cache:squid:3.2.0.8 cpe:/a:squid-cache:squid:3.2.0.9 cpe:/a:squid-cache:squid:3.2.0.10 cpe:/a:squid-cache:squid:3.2.0.11 cpe:/a:squid-cache:squid:3.2.0.12 cpe:/a:squid-cache:squid:3.2.0.13 cpe:/a:squid-cache:squid:3.2.0.14 cpe:/a:squid-cache:squid:3.2.0.15 cpe:/a:squid-cache:squid:3.2.0.16 cpe:/a:squid-cache:squid:3.2.0.17 cpe:/a:squid-cache:squid:3.2.0.18 cpe:/a:squid-cache:squid:3.2.0.19 cpe:/a:squid-cache:squid:3.2.1 cpe:/a:squid-cache:squid:3.2.2 cpe:/a:squid-cache:squid:3.2.3 cpe:/a:squid-cache:squid:3.2.4 cpe:/a:squid-cache:squid:3.2.5 cpe:/a:squid-cache:squid:3.2.6 cpe:/a:squid-cache:squid:3.2.7 cpe:/a:squid-cache:squid:3.2.8 cpe:/a:squid-cache:squid:3.2.9 cpe:/a:squid-cache:squid:3.2.10 cpe:/a:squid-cache:squid:3.2.11 cpe:/a:squid-cache:squid:3.2.12 cpe:/a:squid-cache:squid:3.2.13 cpe:/a:squid-cache:squid:3.2.14 cpe:/a:squid-cache:squid:3.3.0.1 cpe:/a:squid-cache:squid:3.3.0.2 cpe:/a:squid-cache:squid:3.3.0.3 cpe:/a:squid-cache:squid:3.3.1 cpe:/a:squid-cache:squid:3.3.2 cpe:/a:squid-cache:squid:3.3.3 cpe:/a:squid-cache:squid:3.3.4 cpe:/a:squid-cache:squid:3.3.5 cpe:/a:squid-cache:squid:3.3.6 cpe:/a:squid-cache:squid:3.3.7 cpe:/a:squid-cache:squid:3.3.8 cpe:/a:squid-cache:squid:3.3.9 cpe:/a:squid-cache:squid:3.3.10 cpe:/a:squid-cache:squid:3.3.11 cpe:/a:squid-cache:squid:3.3.12 cpe:/a:squid-cache:squid:3.3.13 cpe:/a:squid-cache:squid:3.3.14 cpe:/a:squid-cache:squid:3.4.0.1 cpe:/a:squid-cache:squid:3.4.0.2 cpe:/a:squid-cache:squid:3.4.0.3 cpe:/a:squid-cache:squid:3.4.0.4 cpe:/a:squid-cache:squid:3.4.1 cpe:/a:squid-cache:squid:3.4.2 cpe:/a:squid-cache:squid:3.4.3 cpe:/a:squid-cache:squid:3.4.4 cpe:/a:squid-cache:squid:3.4.5 cpe:/a:squid-cache:squid:3.4.6 cpe:/a:squid-cache:squid:3.4.7 cpe:/a:squid-cache:squid:3.4.8 cpe:/a:squid-cache:squid:3.4.9 cpe:/a:squid-cache:squid:3.4.10 cpe:/a:squid-cache:squid:3.4.11 cpe:/a:squid-cache:squid:3.4.12 cpe:/a:squid-cache:squid:3.4.13 cpe:/a:squid-cache:squid:3.4.14 cpe:/a:squid-cache:squid:3.5.0.1 cpe:/a:squid-cache:squid:3.5.0.2 cpe:/a:squid-cache:squid:3.5.0.3 cpe:/a:squid-cache:squid:3.5.0.4 cpe:/a:squid-cache:squid:3.5.1 cpe:/a:squid-cache:squid:3.5.2 cpe:/a:squid-cache:squid:3.5.3 cpe:/a:squid-cache:squid:3.5.4 cpe:/a:squid-cache:squid:3.5.5 cpe:/a:squid-cache:squid:3.5.6 cpe:/a:squid-cache:squid:3.5.7 cpe:/a:squid-cache:squid:3.5.8 cpe:/a:squid-cache:squid:3.5.9 cpe:/a:squid-cache:squid:3.5.10 cpe:/a:squid-cache:squid:3.5.11 cpe:/a:squid-cache:squid:3.5.12 cpe:/a:squid-cache:squid:3.5.13 cpe:/a:squid-cache:squid:3.5.14 cpe:/a:squid-cache:squid:3.5.15 cpe:/a:squid-cache:squid:3.5.16 cpe:/a:squid-cache:squid:3.5.17 cpe:/a:squid-cache:squid:3.5.18 cpe:/a:squid-cache:squid:3.5.19 cpe:/a:squid-cache:squid:3.5.20 cpe:/a:squid-cache:squid:3.5.21 cpe:/a:squid-cache:squid:3.5.22 cpe:/a:squid-cache:squid:4.0.1 cpe:/a:squid-cache:squid:4.0.2 cpe:/a:squid-cache:squid:4.0.3 cpe:/a:squid-cache:squid:4.0.4 cpe:/a:squid-cache:squid:4.0.5 cpe:/a:squid-cache:squid:4.0.6 cpe:/a:squid-cache:squid:4.0.7 cpe:/a:squid-cache:squid:4.0.8 cpe:/a:squid-cache:squid:4.0.9 cpe:/a:squid-cache:squid:4.0.10 cpe:/a:squid-cache:squid:4.0.11 cpe:/a:squid-cache:squid:4.0.12 cpe:/a:squid-cache:squid:4.0.13 cpe:/a:squid-cache:squid:4.0.14 cpe:/a:squid-cache:squid:4.0.15 cpe:/a:squid-cache:squid:4.0.16 cpe:/o:debian:debian_linux:8.0

CVE-2016-10002

2017-01-27T12:59:00.133-05:00

2018-01-04T21:30:31.167-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2017:0182 REDHAT RHSA-2017:0183 DEBIAN DSA-3745 MLIST [oss-security] 20161217 Re: CVE Request - squid HTTP proxy multiple Information Disclosure issues BID 94953 SECTRACK 1037513 CONFIRM http://www.squid-cache.org/Advisories/SQUID-2016_11.txt Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

cpe:/h:ruckus:wireless_h500:-

CVE-2016-1000213

2016-10-25T10:29:04.900-04:00

2017-07-06T21:29:00.277-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt MISC https://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/ Ruckus Wireless H500 web management interface CSRF

cpe:/h:ruckus:wireless_h500:-

CVE-2016-1000214

2016-10-25T10:29:06.260-04:00

2017-07-06T21:29:00.323-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

cpe:/h:ruckus:wireless_h500:-

CVE-2016-1000215

2016-10-25T10:29:07.790-04:00

2017-07-06T21:29:00.387-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

cpe:/h:ruckus:wireless_h500:-

CVE-2016-1000216

2016-10-10T16:59:35.003-04:00

2017-07-06T21:29:00.433-04:00

9.0

NETWORK

LOW

SINGLE_INSTANCE

COMPLETE

http://nvd.nist.gov CONFIRM http://b910a83a1a1fa9c20d93-2435f2f08e773abe005b52170fce6d94.r84.cf2.rackcdn.com/security/faq-security-advisory-id-062117.txt BID 93539 MISC http://www.tripwire.com/state-of-security/vulnerability-management/ruckus-vulnerability/ MISC https://bitbucket.org/dudux/ruckus-rootshell Ruckus Wireless H500 web management interface authenticated command injection

cpe:/a:zotpress_project:zotpress:6.1.2::~~~wordpress~~

CVE-2016-1000217

2016-10-06T10:59:24.460-04:00

2016-12-22T09:40:38.483-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-21T14:42:35.393-05:00

BID 93894 MISC https://wordpress.org/plugins/zotpress/changelog/ MISC https://wordpress.org/support/topic/sql-injection-in-api_user_id/ Zotpress plugin for WordPress SQLi in zp_get_account()

cpe:/a:elastic:kibana_reporting:2.4.0::~~~kibana~~

CVE-2016-1000218

2017-06-16T17:29:00.243-04:00

2017-07-05T12:26:32.127-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-06-30T09:23:04.083-04:00

BID 99253 CONFIRM https://www.elastic.co/community/security Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page.

cpe:/a:elasticsearch:kibana:4.1.0 cpe:/a:elasticsearch:kibana:4.1.1 cpe:/a:elasticsearch:kibana:4.1.2 cpe:/a:elasticsearch:kibana:4.1.3 cpe:/a:elasticsearch:kibana:4.1.4 cpe:/a:elasticsearch:kibana:4.1.5 cpe:/a:elasticsearch:kibana:4.1.6 cpe:/a:elasticsearch:kibana:4.1.7 cpe:/a:elasticsearch:kibana:4.1.8 cpe:/a:elasticsearch:kibana:4.1.9 cpe:/a:elasticsearch:kibana:4.1.10 cpe:/a:elasticsearch:kibana:4.5.0 cpe:/a:elasticsearch:kibana:4.5.1 cpe:/a:elasticsearch:kibana:4.5.2 cpe:/a:elasticsearch:kibana:4.5.3

CVE-2016-1000219

2017-06-16T17:29:00.273-04:00

2019-02-20T14:50:34.323-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-20T11:51:17.963-05:00

BID 99178 CONFIRM https://www.elastic.co/community/security Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield.

CVE-2016-1000220

2017-06-16T17:29:00.307-04:00

2019-02-20T14:50:52.590-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2019-02-20T11:52:17.543-05:00

BID 99179 CONFIRM https://www.elastic.co/community/security Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers.

cpe:/a:elastic:logstash:2.3.3

CVE-2016-1000221

2017-06-16T17:29:00.337-04:00

2019-06-17T11:48:30.920-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-28T12:29:59.043-04:00

BID 99126 CONFIRM https://www.elastic.co/community/security Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.

cpe:/a:elastic:logstash:2.1.1

CVE-2016-1000222

2017-06-16T17:29:00.367-04:00

2019-06-17T11:48:32.360-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-06-28T13:07:49.930-04:00

CONFIRM https://www.elastic.co/community/security Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data.

cpe:/a:ibm:api_connect:5.0.6.0 cpe:/a:ibm:api_connect:5.0.6.1 cpe:/a:ibm:api_connect:5.0.6.2 cpe:/a:ibm:api_connect:5.0.6.3 cpe:/a:ibm:api_connect:5.0.6.4 cpe:/a:ibm:api_connect:5.0.6.5 cpe:/a:ibm:api_connect:5.0.7.0 cpe:/a:ibm:api_connect:5.0.7.1 cpe:/a:ibm:api_connect:5.0.7.2 cpe:/a:ibm:api_connect:5.0.8.0 cpe:/a:redhat:openshift_container_platform:3.1 cpe:/a:redhat:openshift_container_platform:3.2 cpe:/a:redhat:openshift_container_platform:3.3 cpe:/a:salesforce:tough-cookie:0.9.7::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.8::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.9::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.11::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.12::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.13::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.14::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.9.15::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.10.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.11.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.12.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.12.1::~~~node.js~~ cpe:/a:salesforce:tough-cookie:0.13.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:1.0.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:1.1.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:1.2.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:2.0.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:2.1.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:2.2.0::~~~node.js~~ cpe:/a:salesforce:tough-cookie:2.2.1::~~~node.js~~ cpe:/a:salesforce:tough-cookie:2.2.2::~~~node.js~~

CVE-2016-1000232

2018-09-05T13:29:00.373-04:00

2018-10-31T11:02:32.663-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-10-26T14:45:47.957-04:00

REDHAT RHSA-2016:2101 REDHAT RHSA-2017:2912 CONFIRM https://access.redhat.com/security/cve/cve-2016-1000232 CONFIRM https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae CONFIRM https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534 CONFIRM https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/ MISC https://www.npmjs.com/advisories/130 NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.

CVE-2016-1000258

2017-04-14T10:59:00.213-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10325. Reason: This candidate is a reservation duplicate of CVE-2016-10325. Notes: All CVE users should reference CVE-2016-10325 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000259

2017-04-14T10:59:00.243-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10326. Reason: This candidate is a reservation duplicate of CVE-2016-10326. Notes: All CVE users should reference CVE-2016-10326 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000268

2017-04-03T01:59:00.160-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-7510. Reason: This candidate is a reservation duplicate of CVE-2016-7510. Notes: All CVE users should reference CVE-2016-7510 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:dthdevelopment:dt_register:2.1.0::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.1.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.1.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.1.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.0::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.2.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.3.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.4.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.4.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.4.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.5.9::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.6.9::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.9::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.10::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.11::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.12::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.13::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.14::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.15::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.16::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.17::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.7.18::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.11::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.12::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.13::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:2.8.14::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.0::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.6::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.0.9::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.1::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.2::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.3::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.4::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.5::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.7::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.8::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.9::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.10::~~~joomla%21~~ cpe:/a:dthdevelopment:dt_register:3.1.11::~~~joomla%21~~

CVE-2016-1000271

2019-02-04T16:29:00.223-05:00

2019-02-22T13:54:10.297-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-22T13:18:14.103-05:00

MISC https://packetstormsecurity.com/files/140141/Joomla-DT-Register-SQL-Injection.html Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server.

CVE-2016-1000276

2019-02-04T17:29:00.237-05:00

2019-02-25T14:29:00.750-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000010. Reason: This candidate is a duplicate of CVE-2017-1000010. Notes: All CVE users should reference CVE-2017-1000010 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:haraka_project:haraka:2.8.8

CVE-2016-1000282

2019-02-05T12:29:00.233-05:00

2019-02-06T08:11:23.070-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2019-02-05T14:26:06.977-05:00

MISC https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.

cpe:/a:squid-cache:squid:3.5.0.1 cpe:/a:squid-cache:squid:3.5.0.2 cpe:/a:squid-cache:squid:3.5.0.3 cpe:/a:squid-cache:squid:3.5.0.4 cpe:/a:squid-cache:squid:3.5.1 cpe:/a:squid-cache:squid:3.5.2 cpe:/a:squid-cache:squid:3.5.3 cpe:/a:squid-cache:squid:3.5.4 cpe:/a:squid-cache:squid:3.5.5 cpe:/a:squid-cache:squid:3.5.6 cpe:/a:squid-cache:squid:3.5.7 cpe:/a:squid-cache:squid:3.5.8 cpe:/a:squid-cache:squid:3.5.9 cpe:/a:squid-cache:squid:3.5.10 cpe:/a:squid-cache:squid:3.5.11 cpe:/a:squid-cache:squid:3.5.12 cpe:/a:squid-cache:squid:3.5.13 cpe:/a:squid-cache:squid:3.5.14 cpe:/a:squid-cache:squid:3.5.15 cpe:/a:squid-cache:squid:3.5.16 cpe:/a:squid-cache:squid:3.5.17 cpe:/a:squid-cache:squid:3.5.18 cpe:/a:squid-cache:squid:3.5.19 cpe:/a:squid-cache:squid:3.5.20 cpe:/a:squid-cache:squid:3.5.21 cpe:/a:squid-cache:squid:3.5.22 cpe:/a:squid-cache:squid:4.0.1 cpe:/a:squid-cache:squid:4.0.2 cpe:/a:squid-cache:squid:4.0.3 cpe:/a:squid-cache:squid:4.0.4 cpe:/a:squid-cache:squid:4.0.5 cpe:/a:squid-cache:squid:4.0.6 cpe:/a:squid-cache:squid:4.0.7 cpe:/a:squid-cache:squid:4.0.8 cpe:/a:squid-cache:squid:4.0.9 cpe:/a:squid-cache:squid:4.0.10 cpe:/a:squid-cache:squid:4.0.11 cpe:/a:squid-cache:squid:4.0.12 cpe:/a:squid-cache:squid:4.0.13 cpe:/a:squid-cache:squid:4.0.14 cpe:/a:squid-cache:squid:4.0.15 cpe:/a:squid-cache:squid:4.0.16

CVE-2016-10003

2017-01-27T12:59:00.180-05:00

2017-02-27T21:37:35.973-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-02-27T21:07:37.893-05:00

MLIST [oss-security] 20161217 Re: CVE Request - squid HTTP proxy multiple Information Disclosure issues BID 94953 SECTRACK 1037512 CONFIRM http://www.squid-cache.org/Advisories/SQUID-2016_10.txt Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.

CVE-2016-1000306

2017-04-06T19:59:00.193-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1000307. Reason: This candidate is a reservation duplicate of CVE-2016-1000307. Notes: All CVE users should reference CVE-2016-1000307 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:clip-bucket:clipbucket:2.8.1

CVE-2016-1000307

2017-04-06T19:59:00.223-04:00

2017-04-12T14:47:39.847-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-04-12T14:12:28.957-04:00

MISC https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/DWF/2016/1000307/CVE-2016-1000307.json Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to ProfileSettings page; (2) note parameter to PersonalNotes Section; (3) closed_msg, description, allowed_types parameters to WebsiteConfigurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55

CVE-2016-1000338

2018-06-01T16:29:00.217-04:00

2018-10-17T06:29:02.587-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0 MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update UBUNTU USN-3727-1 In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000339

2018-06-04T09:29:00.233-04:00

2018-11-28T06:29:00.347-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/413b42f4d770456508585c830cfcde95f9b0e93b#diff-54656f860db94b867ba7542430cd2ef0 CONFIRM https://github.com/bcgit/bc-java/commit/8a73f08931450c17c749af067b6a8185abdfd2c0#diff-494fb066bed02aeb76b6c005632943f2 MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.51 cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.52 cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.53 cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.54 cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55

CVE-2016-1000340

2018-06-04T09:29:00.293-04:00

2018-11-28T06:29:00.627-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/790642084c4e0cadd47352054f868cc8397e2c00#diff-e5934feac8203ca0104ab291a3560a31 CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000341

2018-06-04T09:29:00.340-04:00

2018-11-28T06:29:00.720-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000342

2018-06-04T09:29:00.387-04:00

2018-11-28T06:29:00.907-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9 MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000343

2018-06-04T09:29:00.437-04:00

2018-11-28T06:29:01.080-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55

CVE-2016-1000344

2018-06-04T17:29:00.223-04:00

2018-11-28T06:29:01.250-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000345

2018-06-04T17:29:00.270-04:00

2018-11-28T06:29:01.377-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098 MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55 cpe:/o:debian:debian_linux:8.0

CVE-2016-1000346

2018-06-04T17:29:00.303-04:00

2018-11-28T06:29:01.563-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937 MLIST [debian-lts-announce] 20180707 [SECURITY] [DLA 1418-1] bouncycastle security update CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ UBUNTU USN-3727-1 In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.

CVE-2016-1000348

2017-04-02T21:59:00.167-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10211. Reason: This candidate is a reservation duplicate of CVE-2016-10211. Notes: All CVE users should reference CVE-2016-10211 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000349

2017-04-03T01:59:00.190-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10209. Reason: This candidate is a reservation duplicate of CVE-2016-10209. Notes: All CVE users should reference CVE-2016-10209 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000350

2017-04-02T21:59:00.197-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10222. Reason: This candidate is a reservation duplicate of CVE-2016-10222. Notes: All CVE users should reference CVE-2016-10222 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000351

2017-04-03T01:59:00.223-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10226. Reason: This candidate is a reservation duplicate of CVE-2016-10226. Notes: All CVE users should reference CVE-2016-10226 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:bouncycastle:legion-of-the-bouncy-castle-java-crytography-api:1.55

CVE-2016-1000352

2018-06-04T17:29:00.350-04:00

2018-11-28T06:29:01.737-05:00

5.8

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov REDHAT RHSA-2018:2669 REDHAT RHSA-2018:2927 CONFIRM https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f CONFIRM https://security.netapp.com/advisory/ntap-20181127-0004/ In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.

CVE-2016-1000360

2017-05-07T04:29:00.167-04:00

2017-05-07T04:29:00.180-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9847. Reason: This candidate is a reservation duplicate of CVE-2016-9847. Notes: All CVE users should reference CVE-2016-9847 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000361

2017-05-07T04:29:00.197-04:00

2017-05-07T04:29:00.213-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9848. Reason: This candidate is a reservation duplicate of CVE-2016-9848. Notes: All CVE users should reference CVE-2016-9848 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000362

2017-05-07T04:29:00.227-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9849. Reason: This candidate is a reservation duplicate of CVE-2016-9849. Notes: All CVE users should reference CVE-2016-9849 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000363

2017-05-07T04:29:00.260-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9850. Reason: This candidate is a reservation duplicate of CVE-2016-9850. Notes: All CVE users should reference CVE-2016-9850 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000364

2017-05-07T04:29:00.290-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9851. Reason: This candidate is a reservation duplicate of CVE-2016-9851. Notes: All CVE users should reference CVE-2016-9851 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000365

2017-05-07T04:29:00.320-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, CVE-2016-9855. Reason: This candidate is a reservation duplicate of CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and CVE-2016-9855. Notes: All CVE users should reference CVE-2016-9852, CVE-2016-9853, CVE-2016-9854, and/or CVE-2016-9855 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000366

2017-05-07T04:29:00.367-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9856, CVE-2016-9857. Reason: This candidate is a reservation duplicate of CVE-2016-9856 and CVE-2016-9857. Notes: All CVE users should reference CVE-2016-9856 and/or CVE-2016-9857 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000367

2017-05-07T04:29:00.400-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9858, CVE-2016-9859, CVE-2016-9860. Reason: This candidate is a reservation duplicate of CVE-2016-9858, CVE-2016-9859, and CVE-2016-9860. Notes: All CVE users should reference CVE-2016-9858, CVE-2016-9859, and/or CVE-2016-9860 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000368

2017-05-07T04:29:00.430-04:00

2017-05-07T04:29:00.447-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9861. Reason: This candidate is a reservation duplicate of CVE-2016-9861. Notes: All CVE users should reference CVE-2016-9861 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000369

2017-05-07T04:29:00.463-04:00

2017-05-07T04:29:00.477-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9862. Reason: This candidate is a reservation duplicate of CVE-2016-9862. Notes: All CVE users should reference CVE-2016-9862 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000370

2017-05-07T04:29:00.493-04:00

2017-05-07T04:29:00.510-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9863. Reason: This candidate is a reservation duplicate of CVE-2016-9863. Notes: All CVE users should reference CVE-2016-9863 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000371

2017-05-07T04:29:00.527-04:00

2017-05-07T04:29:00.540-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9864. Reason: This candidate is a reservation duplicate of CVE-2016-9864. Notes: All CVE users should reference CVE-2016-9864 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000372

2017-05-07T04:29:00.557-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9865. Reason: This candidate is a reservation duplicate of CVE-2016-9865. Notes: All CVE users should reference CVE-2016-9865 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000373

2017-05-07T04:29:00.587-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-9866. Reason: This candidate is a reservation duplicate of CVE-2016-9866. Notes: All CVE users should reference CVE-2016-9866 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVE-2016-1000393

2017-05-07T16:29:00.153-04:00

2017-05-07T16:29:00.167-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10220. Reason: This candidate is a reservation duplicate of CVE-2016-10220. Notes: All CVE users should reference CVE-2016-10220 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:sap:solution_manager:7.1 cpe:/a:sap:solution_manager:7.1:sp10 cpe:/a:sap:solution_manager:7.1:sp12 cpe:/a:sap:solution_manager:7.1:sp14 cpe:/a:sap:solution_manager:7.1:sp5 cpe:/a:sap:solution_manager:7.20 cpe:/a:sap:solution_manager:7.20:sp01 cpe:/a:sap:solution_manager:7.20:sp03 cpe:/a:sap:solution_manager:7.31

CVE-2016-10005

2016-12-19T02:59:00.167-05:00

2018-12-10T14:29:14.500-05:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/140232/SAP-Solman-7.31-Information-Disclosure.html FULLDISC 20161220 [ERPSCAN-16-035] SAP Solman - user accounts disclosure BID 92949 MISC https://erpscan.io/advisories/erpscan-16-035-sap-solman-user-accounts-dislosure/ Webdynpro in SAP Solman 7.1 through 7.31 allows remote attackers to obtain sensitive information via webdynpro/dispatcher/sap.com/caf~eu~gp~example~timeoff~wd requests, aka SAP Security Note 2344524.

cpe:/a:antisamy_project:antisamy:1.5.4

CVE-2016-10006

2016-12-24T13:59:00.130-05:00

2017-07-26T21:29:00.413-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

NONE

http://nvd.nist.gov BID 95101 SECTRACK 1037532 CONFIRM https://github.com/nahsra/antisamy/issues/2 In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

cpe:/a:dotcms:dotcms:1.9 cpe:/a:dotcms:dotcms:1.9.2.1 cpe:/a:dotcms:dotcms:1.9.5.1 cpe:/a:dotcms:dotcms:2.0 cpe:/a:dotcms:dotcms:2.0.1 cpe:/a:dotcms:dotcms:2.1 cpe:/a:dotcms:dotcms:2.1.1 cpe:/a:dotcms:dotcms:2.2 cpe:/a:dotcms:dotcms:2.2.1 cpe:/a:dotcms:dotcms:2.3 cpe:/a:dotcms:dotcms:2.3.1 cpe:/a:dotcms:dotcms:2.3.2 cpe:/a:dotcms:dotcms:2.5 cpe:/a:dotcms:dotcms:2.5.1 cpe:/a:dotcms:dotcms:2.5.2 cpe:/a:dotcms:dotcms:2.5.3 cpe:/a:dotcms:dotcms:2.5.4 cpe:/a:dotcms:dotcms:3.0 cpe:/a:dotcms:dotcms:3.0.1 cpe:/a:dotcms:dotcms:3.1 cpe:/a:dotcms:dotcms:3.2 cpe:/a:dotcms:dotcms:3.2.1 cpe:/a:dotcms:dotcms:3.2.2 cpe:/a:dotcms:dotcms:3.2.3 cpe:/a:dotcms:dotcms:3.2.4 cpe:/a:dotcms:dotcms:3.3 cpe:/a:dotcms:dotcms:3.3.1 cpe:/a:dotcms:dotcms:3.3.2 cpe:/a:dotcms:dotcms:3.5 cpe:/a:dotcms:dotcms:3.5.1 cpe:/a:dotcms:dotcms:3.6.0 cpe:/a:dotcms:dotcms:3.6.1 cpe:/a:dotcms:dotcms:3.6.2 cpe:/a:dotcms:dotcms:3.7.0 cpe:/a:dotcms:dotcms:3.7.1 cpe:/a:dotcms:dotcms:4.0.0 cpe:/a:dotcms:dotcms:4.0.1 cpe:/a:dotcms:dotcms:4.1.0

CVE-2016-10007

2018-02-19T16:29:00.207-05:00

2018-03-05T11:04:53.993-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-03-05T09:45:05.853-05:00

MISC https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.

CVE-2016-10008

2018-02-19T16:29:00.270-05:00

2018-03-05T10:48:58.250-05:00

6.5

NETWORK

LOW

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov

2018-03-05T09:59:17.653-05:00

MISC https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.

cpe:/a:openbsd:openssh:7.3

CVE-2016-10009

2017-01-04T21:59:03.057-05:00

2018-09-11T06:29:00.757-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html MLIST [oss-security] 20161219 Announce: OpenSSH 7.4 released BID 94968 SECTRACK 1037490 CONFIRM http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637 REDHAT RHSA-2017:2029 MISC https://bugs.chromium.org/p/project-zero/issues/detail?id=1009 CONFIRM https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5 MLIST [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update FREEBSD FreeBSD-SA-17:01 CONFIRM https://security.netapp.com/advisory/ntap-20171130-0002/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us UBUNTU USN-3538-1 EXPLOIT-DB 40963 CONFIRM https://www.openssh.com/txt/release-7.4 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

CVE-2016-1001

2016-03-12T10:59:21.900-05:00

2017-09-07T21:29:53.013-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39609 Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.

cpe:/a:openbsd:openssh:7.3

CVE-2016-10010

2017-01-04T21:59:03.087-05:00

2018-05-31T21:29:00.373-04:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/140262/OpenSSH-Local-Privilege-Escalation.html MLIST [oss-security] 20161219 Announce: OpenSSH 7.4 released BID 94972 SECTRACK 1037490 CONFIRM http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637 MISC https://bugs.chromium.org/p/project-zero/issues/detail?id=1010 CONFIRM https://github.com/openbsd/src/commit/c76fac666ea038753294f2ac94d310f8adece9ce FREEBSD FreeBSD-SA-17:01 CONFIRM https://security.netapp.com/advisory/ntap-20171130-0002/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us EXPLOIT-DB 40962 CONFIRM https://www.openssh.com/txt/release-7.4 sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.

cpe:/a:openbsd:openssh:7.3

CVE-2016-10011

2017-01-04T21:59:03.120-05:00

2018-09-11T06:29:00.867-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov MLIST [oss-security] 20161219 Announce: OpenSSH 7.4 released BID 94977 SECTRACK 1037490 CONFIRM http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637 REDHAT RHSA-2017:2029 CONFIRM https://github.com/openbsd/src/commit/ac8147a06ed2e2403fb6b9a0c03e618a9333c0e9 MLIST [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update CONFIRM https://security.netapp.com/advisory/ntap-20171130-0002/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us CONFIRM https://www.openssh.com/txt/release-7.4 authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.

cpe:/a:openbsd:openssh:7.3

CVE-2016-10012

2017-01-04T21:59:03.150-05:00

2018-09-11T06:29:00.943-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov MLIST [oss-security] 20161219 Announce: OpenSSH 7.4 released BID 94975 SECTRACK 1037490 CONFIRM http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637 REDHAT RHSA-2017:2029 CONFIRM https://github.com/openbsd/src/commit/3095060f479b86288e31c79ecbc5131a66bcd2f9 MLIST [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update CONFIRM https://security.netapp.com/advisory/ntap-20171130-0002/ CONFIRM https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us CONFIRM https://www.openssh.com/txt/release-7.4 The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege-separation process, related to the m_zback and m_zlib data structures.

cpe:/o:xen:xen:4.8.0

CVE-2016-10013

2017-01-26T10:59:00.127-05:00

2017-11-03T21:29:15.020-04:00

4.6

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov DEBIAN DSA-3847 BID 94963 SECTRACK 1037491 CONFIRM http://xenbits.xen.org/xsa/advisory-204.html Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVE-2016-10014

2017-05-11T10:29:57.313-04:00

2017-05-11T10:29:57.327-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10015

2017-05-11T10:29:57.343-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10016

2017-05-11T10:29:57.373-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10017

2017-05-11T10:29:57.390-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10018

2017-05-11T10:29:57.420-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10019

2017-05-11T10:29:57.437-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-1002

2016-03-12T10:59:22.870-05:00

2017-09-07T21:29:53.123-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov SUSE SUSE-SU-2016:0715 SUSE SUSE-SU-2016:0716 SUSE openSUSE-SU-2016:0719 SUSE openSUSE-SU-2016:0734 BID 84311 SECTRACK 1035251 CONFIRM https://helpx.adobe.com/security/products/flash-player/apsb16-08.html GENTOO GLSA-201603-07 EXPLOIT-DB 39608 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1005.

CVE-2016-10020

2017-05-11T10:29:57.467-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10021

2017-05-11T10:29:57.483-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10022

2017-05-11T10:29:57.517-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

CVE-2016-10023

2017-05-11T10:29:57.530-04:00

2017-05-11T10:29:57.547-04:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:citrix:xenserver:6.0.2 cpe:/a:citrix:xenserver:6.2.0 cpe:/a:citrix:xenserver:6.5 cpe:/a:citrix:xenserver:7.0 cpe:/o:xen:xen:4.8.0

CVE-2016-10024

2017-01-26T10:59:00.190-05:00

2017-11-03T21:29:15.117-04:00

4.9

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov DEBIAN DSA-3847 BID 95021 SECTRACK 1037517 CONFIRM http://xenbits.xen.org/xsa/advisory-202.html GENTOO GLSA-201612-56 CONFIRM https://support.citrix.com/article/CTX219378 Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

cpe:/a:citrix:xenserver:6.0.2 cpe:/a:citrix:xenserver:6.2.0 cpe:/a:citrix:xenserver:6.5 cpe:/a:citrix:xenserver:7.0 cpe:/o:xen:xen:4.6.0 cpe:/o:xen:xen:4.6.1 cpe:/o:xen:xen:4.6.3 cpe:/o:xen:xen:4.6.4 cpe:/o:xen:xen:4.7.0 cpe:/o:xen:xen:4.7.1 cpe:/o:xen:xen:4.8.0

CVE-2016-10025

2017-01-26T10:59:00.237-05:00

2017-01-27T09:22:48.617-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-01-27T08:36:37.277-05:00

BID 95026 SECTRACK 1037518 CONFIRM http://xenbits.xen.org/xsa/advisory-203.html CONFIRM https://support.citrix.com/article/CTX219378 VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

cpe:/a:ikiwiki:ikiwiki:3.20161219

CVE-2016-10026

2017-02-13T13:59:00.363-05:00

2017-11-03T21:29:15.163-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov CONFIRM http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/ DEBIAN DSA-3760 MLIST [oss-security] 20161221 Re: CVE request: ikiwiki: authorization bypass when reverting changes MLIST [oss-security] 20161229 ikiwiki: CVE-2016-9645 (incomplete fix for CVE-2016-10026), CVE-2016-9646 (commit metadata forgery) CONFIRM https://ikiwiki.info/security/#index46h2 ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

cpe:/a:ignite_realtime:smack:4.1.8 cpe:/o:fedoraproject:fedora:25

CVE-2016-10027

2017-01-12T18:59:00.197-05:00

2017-01-18T14:49:41.960-05:00

2.6

NETWORK

HIGH

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-01-18T14:41:45.983-05:00

MLIST [oss-security] 20161222 Re: CVE Request: Smack: TLS SecurityMode.required not always enforced, leading to striptls attack BID 95129 CONFIRM https://community.igniterealtime.org/blogs/ignite/2016/11/22/smack-security-advisory-2016-11-22 CONFIRM https://github.com/igniterealtime/Smack/commit/059ee99ba0d5ff7758829acf5a9aeede09ec820b CONFIRM https://github.com/igniterealtime/Smack/commit/a9d5cd4a611f47123f9561bc5a81a4555fe7cb04 CONFIRM https://issues.igniterealtime.org/projects/SMACK/issues/SMACK-739 FEDORA FEDORA-2016-897a1e6698 Race condition in the XMPP library in Smack before 4.1.9, when the SecurityMode.required TLS setting has been set, allows man-in-the-middle attackers to bypass TLS protections and trigger use of cleartext for client authentication by stripping the "starttls" feature from a server response.

cpe:/a:qemu:qemu

CVE-2016-10028

2017-02-27T17:59:00.353-05:00

2017-06-30T21:29:31.577-04:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov CONFIRM http://git.qemu-project.org/?p=qemu.git;a=commit;h=abd7f08b2353f43274b785db8c7224f082ef4d31 MLIST [oss-security] 20161220 CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities MLIST [oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu-3d: OOB access while reading virgl capabilities BID 94981 SECTRACK 1037525 MLIST [qemu-devel] 20161214 [PATCH] display: virtio-gpu-3d: check virgl capabilities max_size GENTOO GLSA-201701-49 The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.

cpe:/a:qemu:qemu

CVE-2016-10029

2017-02-27T17:59:00.387-05:00

2017-02-28T10:38:07.880-05:00

2.1

LOCAL

LOW

NONE

PARTIAL

http://nvd.nist.gov

2017-02-28T10:32:09.693-05:00

CONFIRM http://git.qemu-project.org/?p=qemu.git;a=commit;h=2fe760554eb3769d70f608a158474f CONFIRM http://git.qemu-project.org/?p=qemu.git;a=commit;h=acfc4846508a02cc4c83aa27799fd7 MLIST [oss-security] 20161220 CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout MLIST [oss-security] 20161222 Re: CVE request Qemu: display: virtio-gpu: out of bounds read in virtio_gpu_set_scanout BID 94978 SECTRACK 1037526 The virtio_gpu_set_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a scanout id in a VIRTIO_GPU_CMD_SET_SCANOUT command larger than num_scanouts.

CVE-2016-1003

2016-12-30T21:59:36.847-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10033. Reason: This candidate is a duplicate of CVE-2016-10033. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2016-10033 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

cpe:/a:schedmd:slurm:15.08.12 cpe:/a:schedmd:slurm:16.05.0 cpe:/a:schedmd:slurm:16.05.0:pre1 cpe:/a:schedmd:slurm:16.05.0:pre2 cpe:/a:schedmd:slurm:16.05.0:rc1 cpe:/a:schedmd:slurm:16.05.0:rc2 cpe:/a:schedmd:slurm:16.05.1 cpe:/a:schedmd:slurm:16.05.2 cpe:/a:schedmd:slurm:16.05.3 cpe:/a:schedmd:slurm:16.05.4 cpe:/a:schedmd:slurm:16.05.5 cpe:/a:schedmd:slurm:16.05.6 cpe:/a:schedmd:slurm:17.02.0:pre1 cpe:/a:schedmd:slurm:17.02.0:pre2 cpe:/a:schedmd:slurm:17.02.0:pre3

CVE-2016-10030

2017-01-05T06:59:00.133-05:00

2017-01-10T21:59:05.197-05:00

7.6

NETWORK

HIGH

NONE

COMPLETE

http://nvd.nist.gov BID 95299 CONFIRM https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee CONFIRM https://www.schedmd.com/news.php?id=178 The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.

cpe:/a:wampserver:wampserver:3.0.6

CVE-2016-10031

2016-12-27T02:59:00.150-05:00

2016-12-30T21:59:36.907-05:00

6.9

LOCAL

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov MISC http://forum.wampserver.com/read.php?2,144473 MISC https://packetstormsecurity.com/files/140279/Wampserver-3.0.6-Privilege-Escalation.html MISC https://sourceforge.net/p/wampserver/bugs/52/ EXPLOIT-DB 40967 ** DISPUTED ** WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions, running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts, the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer."

cpe:/a:phpmailer_project:phpmailer:5.2.17

CVE-2016-10033

2016-12-30T14:59:00.137-05:00

2018-10-09T15:58:58.393-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MISC http://packetstormsecurity.com/files/140291/PHPMailer-Remote-Code-Execution.html MISC http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html FULLDISC 20161227 PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] MISC http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection BUGTRAQ 20161227 PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] BID 95108 SECTRACK 1037533 CONFIRM https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html CONFIRM https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.18 CONFIRM https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities MISC https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html CONFIRM https://www.drupal.org/psa-2016-004 EXPLOIT-DB 40968 EXPLOIT-DB 40969 EXPLOIT-DB 40970 EXPLOIT-DB 40974 EXPLOIT-DB 40986 EXPLOIT-DB 41962 EXPLOIT-DB 41996 EXPLOIT-DB 42024 EXPLOIT-DB 42221 The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

cpe:/a:zend:zend-mail:2.4.10 cpe:/a:zend:zend-mail:2.5.0 cpe:/a:zend:zend-mail:2.5.1 cpe:/a:zend:zend-mail:2.5.2 cpe:/a:zend:zend-mail:2.6.0 cpe:/a:zend:zend-mail:2.6.1 cpe:/a:zend:zend-mail:2.6.2 cpe:/a:zend:zend-mail:2.7.0 cpe:/a:zend:zend-mail:2.7.1 cpe:/a:zend:zend_framework:2.4.10

CVE-2016-10034

2016-12-30T14:59:00.217-05:00

2018-10-21T06:29:01.003-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 95144 SECTRACK 1037539 CONFIRM https://framework.zend.com/security/advisory/ZF2016-04 MISC https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html GENTOO GLSA-201804-10 EXPLOIT-DB 40979 EXPLOIT-DB 40986 EXPLOIT-DB 42221 The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.

cpe:/a:jfrog:artifactory:1.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.0.7::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.1.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.2.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.0:-:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:beta3:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:beta4:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:beta5:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:beta6:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:rc1:~~~-~~ cpe:/a:jfrog:artifactory:1.3.0:rc2:~~~-~~ cpe:/a:jfrog:artifactory:1.3.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.3.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.4.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.4.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.4.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.4.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:1.4.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.7::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.8::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.0.9::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.1::~~~-~~ cpe:/a:jfrog:artifactory:2.1.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.2::~~~-~~ cpe:/a:jfrog:artifactory:2.1.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.3::~~~-~~ cpe:/a:jfrog:artifactory:2.1.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.7::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.1.8::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.0::~~~-~~ cpe:/a:jfrog:artifactory:2.2.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.1::~~~-~~ cpe:/a:jfrog:artifactory:2.2.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.2::~~~-~~ cpe:/a:jfrog:artifactory:2.2.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.3::~~~-~~ cpe:/a:jfrog:artifactory:2.2.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.4::~~~-~~ cpe:/a:jfrog:artifactory:2.2.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.5::~~~-~~ cpe:/a:jfrog:artifactory:2.2.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.7::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.7.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.2.7.1-snapshot::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.3.0::~~~-~~ cpe:/a:jfrog:artifactory:2.3.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.3.1::~~~-~~ cpe:/a:jfrog:artifactory:2.3.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.3.1-hap-624::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.3.2::~~~-~~ cpe:/a:jfrog:artifactory:2.3.3::~~~-~~ cpe:/a:jfrog:artifactory:2.3.4::~~~-~~ cpe:/a:jfrog:artifactory:2.3.4.1::~~~-~~ cpe:/a:jfrog:artifactory:2.4.0::~~~-~~ cpe:/a:jfrog:artifactory:2.4.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.1::~~~-~~ cpe:/a:jfrog:artifactory:2.4.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.2::~~~-~~ cpe:/a:jfrog:artifactory:2.4.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.5::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.6::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.4.7::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.5.0::~~~-~~ cpe:/a:jfrog:artifactory:2.5.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.5.1::~~~-~~ cpe:/a:jfrog:artifactory:2.5.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.5.1.1::~~~-~~ cpe:/a:jfrog:artifactory:2.5.2::~~~-~~ cpe:/a:jfrog:artifactory:2.6.0::~~~-~~ cpe:/a:jfrog:artifactory:2.6.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.6.1::~~~-~~ cpe:/a:jfrog:artifactory:2.6.2::~~~-~~ cpe:/a:jfrog:artifactory:2.6.3::~~~-~~ cpe:/a:jfrog:artifactory:2.6.4::~~~-~~ cpe:/a:jfrog:artifactory:2.6.5::~~~-~~ cpe:/a:jfrog:artifactory:2.6.6::~~~-~~ cpe:/a:jfrog:artifactory:2.6.7::~~~-~~ cpe:/a:jfrog:artifactory:2.7.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.7.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.7.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.8.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.8.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.8.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.9.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.9.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.9.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.10.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.10.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.10.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.10.3::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.10.4::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.11.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.12.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.12.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.12.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.13.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.13.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.14.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.15.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.15.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.16.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.16.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:2.16.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.0.0::~~~-~~ cpe:/a:jfrog:artifactory:3.0.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.0.1::~~~-~~ cpe:/a:jfrog:artifactory:3.0.2::~~~-~~ cpe:/a:jfrog:artifactory:3.0.3::~~~-~~ cpe:/a:jfrog:artifactory:3.0.4::~~~-~~ cpe:/a:jfrog:artifactory:3.1.0::~~~-~~ cpe:/a:jfrog:artifactory:3.1.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.1.1::~~~-~~ cpe:/a:jfrog:artifactory:3.1.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.1.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.2.0::~~~-~~ cpe:/a:jfrog:artifactory:3.2.0::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.2.1::~~~-~~ cpe:/a:jfrog:artifactory:3.2.1::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.2.2::~~~-~~ cpe:/a:jfrog:artifactory:3.2.2::~~~jenkins~~ cpe:/a:jfrog:artifactory:3.3.0::~~~-~~ cpe:/a:jfrog:artifactory:3.3.0.1::~~~-~~ cpe:/a:jfrog:artifactory:3.3.1::~~~-~~ cpe:/a:jfrog:artifactory:3.4.0::~~~-~~ cpe:/a:jfrog:artifactory:3.4.1::~~~-~~ cpe:/a:jfrog:artifactory:3.4.2::~~~-~~ cpe:/a:jfrog:artifactory:3.5.0::~~~-~~ cpe:/a:jfrog:artifactory:3.5.1::~~~-~~ cpe:/a:jfrog:artifactory:3.5.2::~~~-~~ cpe:/a:jfrog:artifactory:3.5.3::~~~-~~ cpe:/a:jfrog:artifactory:3.6.0::~~~-~~ cpe:/a:jfrog:artifactory:3.7.0::~~~-~~ cpe:/a:jfrog:artifactory:3.8.0::~~~-~~ cpe:/a:jfrog:artifactory:3.9.0::~~~-~~ cpe:/a:jfrog:artifactory:3.9.1::~~~-~~ cpe:/a:jfrog:artifactory:3.9.2::~~~-~~ cpe:/a:jfrog:artifactory:3.9.3::~~~-~~ cpe:/a:jfrog:artifactory:3.9.4::~~~-~~ cpe:/a:jfrog:artifactory:3.9.5::~~~-~~ cpe:/a:jfrog:artifactory:4.0.0::~~~-~~ cpe:/a:jfrog:artifactory:4.0.1::~~~-~~ cpe:/a:jfrog:artifactory:4.0.2::~~~-~~ cpe:/a:jfrog:artifactory:4.1.0::~~~-~~ cpe:/a:jfrog:artifactory:4.1.2::~~~-~~ cpe:/a:jfrog:artifactory:4.1.3::~~~-~~ cpe:/a:jfrog:artifactory:4.2.0::~~~-~~ cpe:/a:jfrog:artifactory:4.2.1::~~~-~~ cpe:/a:jfrog:artifactory:4.2.2::~~~-~~ cpe:/a:jfrog:artifactory:4.3.0::~~~-~~ cpe:/a:jfrog:artifactory:4.3.1::~~~-~~ cpe:/a:jfrog:artifactory:4.3.2::~~~-~~ cpe:/a:jfrog:artifactory:4.3.3::~~~-~~ cpe:/a:jfrog:artifactory:4.4.0::~~~-~~ cpe:/a:jfrog:artifactory:4.4.1::~~~-~~ cpe:/a:jfrog:artifactory:4.4.2::~~~-~~ cpe:/a:jfrog:artifactory:4.4.3::~~~-~~ cpe:/a:jfrog:artifactory:4.5.0::~~~-~~ cpe:/a:jfrog:artifactory:4.5.1::~~~-~~ cpe:/a:jfrog:artifactory:4.5.2::~~~-~~ cpe:/a:jfrog:artifactory:4.6.0::~~~-~~ cpe:/a:jfrog:artifactory:4.6.1::~~~-~~ cpe:/a:jfrog:artifactory:4.7.0::~~~-~~ cpe:/a:jfrog:artifactory:4.7.1::~~~-~~ cpe:/a:jfrog:artifactory:4.7.2::~~~-~~ cpe:/a:jfrog:artifactory:4.7.3::~~~-~~ cpe:/a:jfrog:artifactory:4.7.4::~~~-~~ cpe:/a:jfrog:artifactory:4.7.5::~~~-~~ cpe:/a:jfrog:artifactory:4.7.6::~~~-~~ cpe:/a:jfrog:artifactory:4.7.7::~~~-~~ cpe:/a:jfrog:artifactory:4.8.0::~~~-~~ cpe:/a:jfrog:artifactory:4.8.1::~~~-~~ cpe:/a:jfrog:artifactory:4.8.2::~~~-~~ cpe:/a:jfrog:artifactory:4.9.0::~~~-~~ cpe:/a:jfrog:artifactory:4.9.1::~~~-~~ cpe:/a:jfrog:artifactory:4.10.0::~~~-~~ cpe:/a:jfrog:artifactory:4.11.0::~~~-~~ cpe:/a:jfrog:artifactory:4.11.1::~~~-~~ cpe:/a:jfrog:artifactory:4.11.2::~~~-~~ cpe:/a:jfrog:artifactory:4.12.0.1::~~~-~~ cpe:/a:jfrog:artifactory:4.12.1::~~~-~~ cpe:/a:jfrog:artifactory:4.12.2::~~~-~~ cpe:/a:jfrog:artifactory:4.13.0::~~~-~~ cpe:/a:jfrog:artifactory:4.13.1::~~~-~~ cpe:/a:jfrog:artifactory:4.13.2::~~~-~~ cpe:/a:jfrog:artifactory:4.14.0::~~~-~~ cpe:/a:jfrog:artifactory:4.14.1::~~~-~~ cpe:/a:jfrog:artifactory:4.14.2::~~~-~~ cpe:/a:jfrog:artifactory:4.14.3::~~~-~~ cpe:/a:jfrog:artifactory:4.15.0::~~~-~~

CVE-2016-10036

2018-05-01T15:29:01.013-04:00

2018-06-13T10:23:58.963-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2018-06-06T23:24:09.787-04:00

MISC http://packetstormsecurity.com/files/147378/Jfrog-Artifactory-Code-Execution-Shell-Upload.html EXPLOIT-DB 44543 CONFIRM https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory4.16 Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.

cpe:/a:modx:modx_revolution:2.5.1-pl

CVE-2016-10037

2016-12-24T06:59:00.147-05:00

2016-12-30T21:59:36.953-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov BID 95127 CONFIRM https://github.com/modxcms/revolution/pull/13177 CONFIRM https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id (aka dir) parameter, related to browser/directory/getlist.

cpe:/a:modx:modx_revolution:2.5.1-pl

CVE-2016-10038

2016-12-24T06:59:00.193-05:00

2016-12-29T09:28:02.827-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-28T10:02:16.367-05:00

BID 95097 CONFIRM https://github.com/modxcms/revolution/pull/13177 CONFIRM https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.

cpe:/a:modx:modx_revolution:2.5.1-pl

CVE-2016-10039

2016-12-24T06:59:00.240-05:00

2016-12-29T09:28:32.330-05:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov

2016-12-28T10:46:48.407-05:00

BID 95096 CONFIRM https://github.com/modxcms/revolution/pull/13177 CONFIRM https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles.

CVE-2016-1004

2016-12-30T21:59:36.987-05:00

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.

cpe:/a:qt:qxmlsimplereader:4.8.5

CVE-2016-10040

2017-03-07T10:59:00.237-05:00

2017-03-08T11:55:28.540-05:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-03-07T14:23:35.783-05:00

MLIST [oss-security] 20161224 Re: Qt QXmlSimpleReader MLIST [oss-security] 20170114 Re: [Security] Qt QXmlSimpleReader BID 95113 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1409597 Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

cpe:/a:sprecher-automation:sprecon-e_service_program:3.42:sp0

CVE-2016-10041

2016-12-25T02:59:00.157-05:00

2017-01-06T22:00:36.070-05:00

4.6

NETWORK

HIGH

SINGLE_INSTANCE

PARTIAL

http://nvd.nist.gov BID 95296 CONFIRM https://www.sprecher-automation.com/en/it-security/ An issue was discovered in Sprecher Automation SPRECON-E Service Program before 3.43 SP0. Under certain preconditions, it is possible to execute telegram simulation as a non-admin user. As prerequisites, a user must have created an online-connection, validly authenticated and authorized as administrator, and executed telegram simulation. After that, the online-connection must have been closed. Incorrect caching of client data then may lead to privilege escalation, where a subsequently acting non-admin user is permitted to do telegram simulation. In order to exploit this vulnerability, a potential attacker would need to have both a valid engineering-account in the SPRECON RBAC system as well as access to a service/maintenance computer with SPRECON-E Service Program running. Additionally, a valid admin-user must have closed the service connection beforehand without closing the program, having executed telegram simulation; the attacker then has access to the running software instance. Hence, there is no risk from external attackers.

cpe:/o:arcadyan:swisscom_internet-box_firmware:-

CVE-2016-10042

2017-06-28T20:29:00.200-04:00

2017-07-07T13:31:32.733-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-07-07T11:23:07.867-04:00

CONFIRM https://www.swisscom.ch/content/dam/swisscom/de/about/nachhaltigkeit/digitale-schweiz/sicherheit/bug-bounty/files/cve-2016-10042.txt Authorization Bypass in the Web interface of Arcadyan SLT-00 Star* (aka Swisscom Internet-Box) devices before R7.7 allows unauthorized reconfiguration of the static routing table via an unauthenticated HTTP request, leading to denial of service and information disclosure.

cpe:/a:mrf:web_panel:9.0.1

CVE-2016-10043

2017-01-31T13:59:00.437-05:00

2017-03-13T10:59:38.647-04:00

10.0

NETWORK

LOW

NONE

COMPLETE

http://nvd.nist.gov

2017-03-10T13:51:19.467-05:00

EXPLOIT-DB 41179 An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application's responses. Attackers could execute unauthorized commands, which could then be used to disable the software, or read, write, and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner (apache user).

cpe:/o:google:android:7.1.1 cpe:/o:linux:linux_kernel:4.7.6

CVE-2016-10044

2017-02-07T02:59:00.293-05:00

2017-07-24T21:29:00.873-04:00

7.2

LOCAL

LOW

NONE

COMPLETE

http://nvd.nist.gov CONFIRM http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=22f6b4d34fcf039c63a94e7670e0da24f8575a5a CONFIRM http://source.android.com/security/bulletin/2017-02-01.html CONFIRM http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.7 BID 96122 SECTRACK 1037798 CONFIRM https://github.com/torvalds/linux/commit/22f6b4d34fcf039c63a94e7670e0da24f8575a5a The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.

cpe:/a:phpmailer_project:phpmailer:5.2.19

CVE-2016-10045

2016-12-30T14:59:00.247-05:00

2018-10-09T15:59:00.550-04:00

7.5

NETWORK

LOW

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20161228 Re: PHPMailer < 5.2.18 Remote Code Execution [updated advisory] [CVE-2016-10033] MISC http://packetstormsecurity.com/files/140286/PHPMailer-Remote-Code-Execution.html MISC http://packetstormsecurity.com/files/140350/PHPMailer-Sendmail-Argument-Injection.html FULLDISC 20161227 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) MISC http://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection BUGTRAQ 20161228 PHPMailer < 5.2.20 Remote Code Execution PoC 0day Exploit (CVE-2016-10045) (Bypass of the CVE-2016-1033 patch) BID 95130 SECTRACK 1037533 CONFIRM https://developer.joomla.org/security-centre/668-20161205-phpmailer-security-advisory.html CONFIRM https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.20 CONFIRM https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities MISC https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.html EXPLOIT-DB 40969 EXPLOIT-DB 40986 EXPLOIT-DB 42221 The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

cpe:/a:imagemagick:imagemagick:6.9.5-4

CVE-2016-10046

2017-03-23T13:59:00.283-04:00

2017-03-24T09:37:17.083-04:00

4.3

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov

2017-03-24T07:24:37.617-04:00

MLIST [oss-security] 20161226 Re: CVE requests for various ImageMagick issues BID 95183 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1410448 CONFIRM https://github.com/ImageMagick/ImageMagick/commit/989f9f88ea6db09b99d25586e912c921c0da8d3f Heap-based buffer overflow in the DrawImage function in magick/draw.c in ImageMagick before 6.9.5-5 allows remote attackers to cause a denial of service (application crash) via a crafted image file.

cpe:/a:imagemagick:imagemagick:6.9.4-6

CVE-2016-10047

2017-03-23T13:59:00.313-04:00

2017-03-24T09:08:26.477-04:00

7.1

NETWORK

MEDIUM

NONE

COMPLETE

http://nvd.nist.gov

2017-03-24T08:15:16.817-04:00

MLIST [oss-security] 20161226 Re: CVE requests for various ImageMagick issues BID 95182 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1410449 CONFIRM https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb Memory leak in the NewXMLTree function in magick/xml-tree.c in ImageMagick before 6.9.4-7 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML file.

cpe:/a:imagemagick:imagemagick:6.9.4-7 cpe:/o:opensuse_project:leap:42.1

CVE-2016-10048

2017-03-23T13:59:00.343-04:00

2017-03-24T09:08:37.647-04:00

5.0

NETWORK

LOW

NONE

PARTIAL

NONE

http://nvd.nist.gov

2017-03-24T08:02:43.067-04:00

SUSE openSUSE-SU-2017:0391 SUSE openSUSE-SU-2017:0399 MLIST [oss-security] 20161226 Re: CVE requests for various ImageMagick issues BID 95186 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1410451 CONFIRM https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors.

cpe:/a:imagemagick:imagemagick:6.9.4-3

CVE-2016-10049

2017-03-23T13:59:00.390-04:00

2017-03-24T21:59:00.393-04:00

6.8

NETWORK

MEDIUM

NONE

PARTIAL

http://nvd.nist.gov MLIST [oss-security] 20161226 Re: CVE requests for various ImageMagick issues BID 95180 CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=1410452 CONFIRM https://github.com/ImageMagick/ImageMagick/commit/3e9165285eda6e1bb71172031d3048b51bb443a4 MISC https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=29710 Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick before 6.9.4-4 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted RLE file.