CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2016 (CVSS score >= 6)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-1000217 89 Sql 2016-10-06 2016-12-22
7.5
None Remote Low Not required Partial Partial Partial
Zotpress plugin for WordPress SQLi in zp_get_account()
2 CVE-2016-1000216 78 2016-10-10 2017-07-07
9.0
None Remote Low ??? Complete Complete Complete
Ruckus Wireless H500 web management interface authenticated command injection
3 CVE-2016-1000213 352 CSRF 2016-10-25 2017-07-07
6.8
None Remote Medium Not required Partial Partial Partial
Ruckus Wireless H500 web management interface CSRF
4 CVE-2016-1000125 89 Sql 2016-10-06 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla
5 CVE-2016-1000124 89 Sql 2016-10-06 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
Unauthenticated SQL Injection in Huge-IT Portfolio Gallery Plugin v1.0.6
6 CVE-2016-1000123 89 Sql 2016-10-06 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
7 CVE-2016-1000122 89 Sql XSS 2016-10-27 2016-12-22
6.5
None Remote Low ??? Partial Partial Partial
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
8 CVE-2016-1000120 89 Sql XSS 2016-10-27 2016-12-22
6.5
None Remote Low ??? Partial Partial Partial
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
9 CVE-2016-1000119 79 XSS 2016-10-21 2018-05-02
6.5
None Remote Low ??? Partial Partial Partial
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
10 CVE-2016-1000118 79 XSS 2016-10-21 2018-05-02
6.5
None Remote Low ??? Partial Partial Partial
XSS & SQLi in HugeIT slideshow v1.0.4
11 CVE-2016-1000117 79 XSS 2016-10-21 2017-01-06
6.5
None Remote Low ??? Partial Partial Partial
XSS & SQLi in HugeIT slideshow v1.0.4
12 CVE-2016-1000116 79 Sql XSS 2016-10-21 2017-03-28
6.5
None Remote Low ??? Partial Partial Partial
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
13 CVE-2016-1000115 79 Sql XSS 2016-10-21 2017-11-13
6.5
None Remote Low ??? Partial Partial Partial
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
14 CVE-2016-1000113 89 Sql XSS 2016-10-06 2019-12-19
7.5
None Remote Low Not required Partial Partial Partial
XSS and SQLi in huge IT gallery v1.1.5 for Joomla
15 CVE-2016-1000112 22 Dir. Trav. 2016-10-06 2020-04-29
9.4
None Remote Low Not required Complete Complete None
Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin
16 CVE-2016-1000031 284 Exec Code 2016-10-25 2021-10-20
7.5
None Remote Low Not required Partial Partial Partial
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
17 CVE-2016-1000003 94 Exec Code 2016-10-07 2016-12-22
7.5
None Remote Low Not required Partial Partial Partial
Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.
18 CVE-2016-1000000 89 Sql 2016-10-06 2017-11-03
6.5
None Remote Low ??? Partial Partial Partial
Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection
19 CVE-2016-8878 125 Exec Code 2016-10-31 2016-11-29
6.8
None Remote Medium Not required Partial Partial Partial
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER."
20 CVE-2016-8877 787 Exec Code Overflow 2016-10-31 2016-11-29
6.8
None Remote Medium Not required Partial Partial Partial
Heap buffer overflow (Out-of-Bounds write) vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows allows remote attackers to execute arbitrary code via a crafted JPEG2000 image embedded in a PDF document, aka a "corrupted suffix pattern" issue.
21 CVE-2016-8876 125 Exec Code 2016-10-31 2016-11-29
6.8
None Remote Medium Not required Partial Partial Partial
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted TIFF image embedded in the XFA stream in a PDF document, aka "Read Access Violation starting at FoxitReader."
22 CVE-2016-8666 400 DoS 2016-10-16 2018-01-05
7.8
None Remote Low Not required None None Complete
The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039.
23 CVE-2016-8598 119 Exec Code Overflow 2016-10-28 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the zmq interface in csp_if_zmqhub.c in the libcsp library v1.4 and earlier allows hostile computers connected via a zmq interface to execute arbitrary code via a long packet.
24 CVE-2016-8597 119 Exec Code Overflow 2016-10-28 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the csp_sfp_recv_fp in csp_sfp.c in the libcsp library v1.4 and earlier allows hostile components with network access to the SFP underlying network layers to execute arbitrary code via specially crafted SFP packets.
25 CVE-2016-8596 119 Exec Code Overflow 2016-10-28 2016-11-28
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the csp_can_process_frame in csp_if_can.c in the libcsp library v1.4 and earlier allows hostile components connected to the canbus to execute arbitrary code via a long csp packet.
26 CVE-2016-8582 89 Sql 2016-10-28 2017-09-03
7.5
None Remote Low Not required Partial Partial Partial
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
27 CVE-2016-8580 284 Exec Code 2016-10-28 2017-09-03
7.5
None Remote Low Not required Partial Partial Partial
PHP object injection vulnerabilities exist in multiple widget files in AlienVault OSSIM and USM before 5.3.2. These vulnerabilities allow arbitrary PHP code execution via magic methods in included classes.
28 CVE-2016-8565 284 2016-10-13 2017-07-29
6.4
None Remote Low Not required None Partial Partial
Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directories via crafted packets.
29 CVE-2016-8564 89 Exec Code Sql 2016-10-13 2017-07-29
6.4
None Remote Low Not required Partial Partial None
SQL injection vulnerability in Siemens Automation License Manager (ALM) before 5.3 SP3 Update 1 allows remote attackers to execute arbitrary SQL commands via crafted traffic to TCP port 4410.
30 CVE-2016-8339 119 Exec Code Overflow 2016-10-28 2018-08-08
7.5
None Remote Low Not required Partial Partial Partial
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. An out of bounds write vulnerability exists in the handling of the client-output-buffer-limit option during the CONFIG SET command for the Redis data structure store. A crafted CONFIG SET command can lead to an out of bounds write potentially resulting in code execution.
31 CVE-2016-8335 119 Exec Code Overflow 2016-10-28 2016-11-28
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable stack based buffer overflow vulnerability exists in the ipNameAdd functionality of Iceni Argus Version 6.6.04 (Sep 7 2012) NK - Linux x64 and Version 6.6.04 (Nov 14 2014) NK - Windows x64. A specially crafted pdf file can cause a buffer overflow resulting in arbitrary code execution. An attacker can send/provide malicious pdf file to trigger this vulnerability.
32 CVE-2016-8333 119 Exec Code Overflow 2016-10-28 2016-11-28
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable stack-based buffer overflow vulnerability exists in the ipfSetColourStroke functionality of Iceni Argus version 6.6.04 A specially crafted pdf file can cause a buffer overflow resulting in arbitrary code execution. An attacker can provide a malicious pdf file to trigger this vulnerability.
33 CVE-2016-8332 119 Exec Code Overflow 2016-10-28 2020-09-09
6.8
None Remote Medium Not required Partial Partial Partial
A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
34 CVE-2016-8331 Exec Code 2016-10-28 2017-07-01
6.8
None Remote Medium Not required Partial Partial Partial
An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.
35 CVE-2016-8281 284 2016-10-25 2017-07-29
6.5
None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-5536.
36 CVE-2016-8278 20 DoS 2016-10-03 2016-10-06
7.8
None Remote Low Not required None None Complete
Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service (device restart) via an unspecified URL.
37 CVE-2016-8277 20 DoS 2016-10-03 2016-10-06
6.8
None Remote Low ??? None None Complete
Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to cause a denial of service (device restart) via an unspecified command parameter.
38 CVE-2016-8276 119 DoS Exec Code Overflow 2016-10-03 2016-10-04
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600, when CHAP authentication is configured on the server, allows remote attackers to cause a denial of service (server restart) or execute arbitrary code via crafted packets sent during authentication.
39 CVE-2016-8203 119 DoS Overflow Mem. Corr. 2016-10-31 2017-07-29
7.8
None Remote Low Not required None None Complete
A memory corruption in the IPsec code path of Brocade NetIron OS on Brocade MLXs 5.8.00 through 5.8.00e, 5.9.00 through 5.9.00bd, 6.0.00, and 6.0.00a images could allow attackers to cause a denial of service (line card reset) via certain constructed IPsec control packets.
40 CVE-2016-8101 264 +Priv 2016-10-10 2016-12-02
7.2
None Local Low Not required Complete Complete Complete
The updater subsystem in Intel SSD Toolbox before 3.3.7 allows local users to gain privileges via unspecified vectors.
41 CVE-2016-7991 388 2016-10-31 2016-12-02
7.8
None Remote Low Not required None Complete None
On Samsung Galaxy S4 through S7 devices, the "omacp" app ignores security information embedded in the OMACP messages resulting in remote unsolicited WAP Push SMS messages being accepted, parsed, and handled by the device, leading to unauthorized configuration changes, a subset of SVE-2016-6542.
42 CVE-2016-7990 190 DoS Exec Code Overflow 2016-10-31 2016-12-02
10.0
None Remote Low Not required Complete Complete Complete
On Samsung Galaxy S4 through S7 devices, an integer overflow condition exists within libomacp.so when parsing OMACP messages (within WAP Push SMS messages) leading to a heap corruption that can result in Denial of Service and potentially remote code execution, a subset of SVE-2016-6542.
43 CVE-2016-7989 254 2016-10-31 2016-12-02
7.8
None Remote Low Not required None None Complete
On Samsung Galaxy S4 through S7 devices, a malformed OTA WAP PUSH SMS containing an OMACP message sent remotely triggers an unhandled ArrayIndexOutOfBoundsException in Samsung's implementation of the WifiServiceImpl class within wifi-service.jar. This causes the Android runtime to continually crash, rendering the device unusable until a factory reset is performed, a subset of SVE-2016-6542.
44 CVE-2016-7988 275 2016-10-31 2016-12-02
7.8
None Remote Low Not required None None Complete
On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of SVE-2016-6542.
45 CVE-2016-7854 119 DoS Exec Code Overflow Mem. Corr. 2016-10-21 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852, and CVE-2016-7853.
46 CVE-2016-7853 119 DoS Exec Code Overflow Mem. Corr. 2016-10-21 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7852, and CVE-2016-7854.
47 CVE-2016-7852 119 DoS Exec Code Overflow Mem. Corr. 2016-10-21 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader DC Continuous before 15.020.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-6940, CVE-2016-6941, CVE-2016-6942, CVE-2016-6943, CVE-2016-6947, CVE-2016-6948, CVE-2016-6950, CVE-2016-6951, CVE-2016-6954, CVE-2016-6955, CVE-2016-6956, CVE-2016-6959, CVE-2016-6960, CVE-2016-6966, CVE-2016-6970, CVE-2016-6972, CVE-2016-6973, CVE-2016-6974, CVE-2016-6975, CVE-2016-6976, CVE-2016-6977, CVE-2016-6978, CVE-2016-6995, CVE-2016-6996, CVE-2016-6997, CVE-2016-6998, CVE-2016-7000, CVE-2016-7001, CVE-2016-7002, CVE-2016-7003, CVE-2016-7004, CVE-2016-7005, CVE-2016-7006, CVE-2016-7007, CVE-2016-7008, CVE-2016-7009, CVE-2016-7010, CVE-2016-7011, CVE-2016-7012, CVE-2016-7013, CVE-2016-7014, CVE-2016-7015, CVE-2016-7016, CVE-2016-7017, CVE-2016-7018, CVE-2016-7019, CVE-2016-7853, and CVE-2016-7854.
48 CVE-2016-7560 798 2016-10-05 2016-12-02
10.0
None Remote Low Not required Complete Complete Complete
The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which allows remote attackers to read or write to arbitrary files via unspecified vectors.
49 CVE-2016-7505 119 DoS Exec Code Overflow 2016-10-29 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
A buffer overflow vulnerability was observed in divby function of Artifex Software, Inc. MuJS before 8c805b4eb19cf2af689c860b77e6111d2ee439d5. A successful exploitation of this issue can lead to code execution or denial of service condition.
50 CVE-2016-7504 416 DoS Exec Code 2016-10-29 2016-12-02
7.5
None Remote Low Not required Partial Partial Partial
A use-after-free vulnerability was observed in Rp_toString function of Artifex Software, Inc. MuJS before 5c337af4b3df80cf967e4f9f6a21522de84b392a. A successful exploitation of this issue can lead to code execution or denial of service condition.
Total number of vulnerabilities : 342   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.