CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In July 2016 (CVSS score >= 5)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-6297 119 DoS Overflow 2016-07-25 2018-01-05
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.
2 CVE-2016-6296 119 DoS Overflow 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
3 CVE-2016-6295 416 DoS 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.
4 CVE-2016-6294 125 DoS 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
5 CVE-2016-6293 119 DoS Overflow 2016-07-25 2019-04-23
7.5
 None Remote Low Not required Partial Partial Partial
The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
6 CVE-2016-6291 119 DoS Overflow Mem. Corr. +Info 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.
7 CVE-2016-6290 416 DoS 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.
8 CVE-2016-6289 190 DoS Overflow 2016-07-25 2018-01-05
6.8
 None Remote Medium Not required Partial Partial Partial
Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.
9 CVE-2016-6288 119 DoS Overflow 2016-07-25 2018-01-05
7.5
 None Remote Low Not required Partial Partial Partial
The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.
10 CVE-2016-6174 Exec Code 2016-07-12 2020-06-03
6.8
 None Remote Medium Not required Partial Partial Partial
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
11 CVE-2016-6152 DoS Exec Code 2016-07-26 2021-04-09
9.0
 None Remote Low ??? Complete Complete Complete
CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
12 CVE-2016-6151 DoS Exec Code 2016-07-26 2016-11-28
9.0
 None Remote Low ??? Complete Complete Complete
CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
13 CVE-2016-5874 20 DoS 2016-07-22 2016-11-28
5.0
 None Remote Low Not required None None Partial
Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.
14 CVE-2016-5821 264 +Priv 2016-07-13 2018-10-09
7.2
 None Local Low Not required Complete Complete Complete
Huawei HiSuite before 4.0.4.204_ove (Out of China) and before 4.0.4.301 (China) use a weak ACL (FILE_WRITE_DATA for BUILTIN\Users) for the HiSuite service directory, which allows local users to gain SYSTEM privileges via a Trojan horse (1) SspiCli.dll or (2) USERENV.dll file or possibly other unspecified DLL files.
15 CVE-2016-5807 284 Bypass 2016-07-15 2016-11-28
5.5
 None Remote Low ??? Partial Partial None
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote authenticated users to bypass an intended administrative-authentication requirement, and read or change parameter values, via a direct request.
16 CVE-2016-5804 326 Bypass 2016-07-15 2021-07-16
5.0
 None Remote Low Not required Partial None None
Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.
17 CVE-2016-5797 200 +Info 2016-07-15 2016-11-28
5.0
 None Remote Low Not required Partial None None
Tollgrade LightHouse SMS before 5.1 patch 3 provides different error messages for failed authentication attempts depending on whether the username exists, which allows remote attackers to enumerate account names via a series of attempts.
18 CVE-2016-5790 Bypass 2016-07-15 2020-12-08
5.0
 None Remote Low Not required None None Partial
Tollgrade LightHouse SMS before 5.1 patch 3 allows remote attackers to bypass authentication and restart the software via unspecified vectors.
19 CVE-2016-5781 119 Exec Code Overflow 2016-07-12 2016-11-28
6.8
 None Remote Medium Not required Partial Partial Partial
Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
20 CVE-2016-5744 200 +Info 2016-07-22 2016-11-28
5.0
 None Remote Low Not required Partial None None
Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets.
21 CVE-2016-5743 20 Exec Code 2016-07-22 2016-11-28
10.0
 None Remote Low Not required Complete Complete Complete
Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.2 Update 1 as distributed in SIMATIC PCS 7 8.2, and SIMATIC WinCC Runtime Professional before 13 SP1 Update 9 allow remote attackers to execute arbitrary code via crafted packets.
22 CVE-2016-5739 200 +Info CSRF 2016-07-03 2018-10-30
5.0
 None Remote Low Not required Partial None None
The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer Content Security Policy (CSP) protection mechanism, which makes it easier for remote attackers to conduct CSRF attacks by reading an authentication token in a Referer header, related to libraries/Header.php.
23 CVE-2016-5734 94 Exec Code 2016-07-03 2017-07-01
7.5
 None Remote Low Not required Partial Partial Partial
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.
24 CVE-2016-5730 200 +Info 2016-07-03 2018-10-30
5.0
 None Remote Low Not required Partial None None
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.
25 CVE-2016-5706 399 DoS 2016-07-03 2018-10-30
5.0
 None Remote Low Not required None None Partial
js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
26 CVE-2016-5703 89 Exec Code Sql 2016-07-03 2018-10-30
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in libraries/central_columns.lib.php in phpMyAdmin 4.4.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to execute arbitrary SQL commands via a crafted database name that is mishandled in a central column query.
27 CVE-2016-5661 284 Exec Code 2016-07-15 2016-11-28
6.5
 None Remote Low ??? Partial Partial Partial
Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads, which allows remote authenticated users to execute arbitrary code via modified _EventArgument and filename parameters.
28 CVE-2016-5654 264 +Priv 2016-07-19 2016-11-28
8.5
 None Remote Medium ??? Complete Complete Complete
Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter.
29 CVE-2016-5637 119 DoS Exec Code Overflow Bypass 2016-07-15 2018-10-17
6.8
 None Remote Medium Not required Partial Partial Partial
The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a "type confusion" issue.
30 CVE-2016-5477 2016-07-21 2017-09-01
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1 and 3.0.1 allows remote attackers to affect confidentiality via vectors related to Administration.
31 CVE-2016-5476 2016-07-21 2017-09-01
6.5
 None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Retail Applications 13.0, 13.1, 13.2, 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Install.
32 CVE-2016-5475 2016-07-21 2017-09-01
8.0
 None Remote Low ??? Complete Partial Partial
Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Install.
33 CVE-2016-5474 2016-07-21 2017-09-01
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RSB Kernel.
34 CVE-2016-5472 2016-07-21 2017-09-01
7.2
 None Local Low Not required Complete Complete Complete
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows local users to affect confidentiality, integrity, and availability via vectors related to Install and Packaging.
35 CVE-2016-5470 2016-07-21 2017-09-01
7.1
 None Remote Medium Not required Complete None None
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality via vectors related to Application Designer.
36 CVE-2016-5468 2016-07-21 2017-09-01
5.5
 None Remote Low ??? Partial Partial None
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect confidentiality and integrity via vectors related to EAI, a different vulnerability than CVE-2016-5451.
37 CVE-2016-5467 2016-07-21 2017-09-01
5.5
 None Remote Low ??? Partial Partial None
Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to eProcurement.
38 CVE-2016-5465 2016-07-21 2017-09-01
5.8
 None Remote Medium Not required Partial Partial None
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Panel Processor.
39 CVE-2016-5458 2016-07-21 2017-09-01
5.5
 None Remote Low ??? Partial Partial None
Unspecified vulnerability in the Oracle Communications EAGLE Application Processor component in Oracle Communications Applications 16.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to APPL.
40 CVE-2016-5457 2016-07-21 2017-09-01
9.0
 None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to LUMAIN.
41 CVE-2016-5456 2016-07-21 2017-09-01
6.3
 None Remote Medium ??? Complete None None
Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect confidentiality via vectors related to Services.
42 CVE-2016-5455 2016-07-21 2017-09-01
5.0
 None Remote Low Not required Partial None None
Unspecified vulnerability in the Oracle Communications Messaging Server component in Oracle Communications Applications 6.3, 7.0, and 8.0 allows remote attackers to affect confidentiality via vectors related to Multiplexor.
43 CVE-2016-5454 2016-07-21 2017-09-01
5.4
 None Local Medium Not required None Partial Complete
Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect integrity and availability via vectors related to Verified Boot.
44 CVE-2016-5453 2016-07-21 2017-09-01
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to IPMI.
45 CVE-2016-5451 2016-07-21 2017-09-01
5.5
 None Remote Low ??? Partial Partial None
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect confidentiality and integrity via vectors related to EAI, a different vulnerability than CVE-2016-5468.
46 CVE-2016-5449 2016-07-21 2017-09-01
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect availability via vectors related to Console Redirection.
47 CVE-2016-5448 2016-07-21 2017-09-01
6.4
 None Remote Low Not required None Partial Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect integrity and availability via vectors related to SNMP.
48 CVE-2016-5447 2016-07-21 2017-09-01
6.5
 None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
49 CVE-2016-5446 2016-07-21 2017-09-01
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Infrastructure.
50 CVE-2016-5445 2016-07-21 2017-09-01
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Total number of vulnerabilities : 515   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.