CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
6801 CVE-2016-6137 Exec Code 2016-09-27 2016-09-28
10.0
None Remote Low Not required Complete Complete Complete
An unspecified function in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands via unknown vectors, aka SAP Security Note 2203591.
6802 CVE-2016-6115 119 Exec Code Overflow 2017-02-01 2017-02-15
9.0
None Remote Low ??? Complete Complete Complete
IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the server to crash.
6803 CVE-2016-6082 416 Exec Code 2017-02-01 2017-02-08
10.0
None Remote Low Not required Complete Complete Complete
IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.
6804 CVE-2016-6042 119 Exec Code Overflow 2017-02-01 2017-02-09
9.3
None Remote Medium Not required Complete Complete Complete
IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system, caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim.
6805 CVE-2016-5872 20 2017-08-18 2017-08-22
10.0
None Remote Low Not required Complete Complete Complete
In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validated.
6806 CVE-2016-5871 119 Overflow 2017-08-18 2017-08-23
10.0
None Remote Low Not required Complete Complete Complete
In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists when loading an image file.
6807 CVE-2016-5864 264 Overflow 2017-08-16 2017-08-20
9.3
None Remote Medium Not required Complete Complete Complete
In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from userspace, and if they are set to a large value, integer overflow is possible followed by buffer overflow. In another function, a missing check for a lower bound may result in an out of bounds memory access.
6808 CVE-2016-5863 264 2017-08-16 2017-08-20
9.3
None Remote Medium Not required Complete Complete Complete
In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing which can lead to out-of-bounds accesses.
6809 CVE-2016-5843 89 Exec Code Sql 2016-09-17 2016-11-28
9.0
None Remote Low Not required Complete Partial Partial
Multiple SQL injection vulnerabilities in the FAQ package 2.x before 2.3.6, 4.x before 4.0.5, and 5.x before 5.0.5 in Open Ticket Request System (OTRS) allow remote attackers to execute arbitrary SQL commands via crafted search parameters.
6810 CVE-2016-5840 20 Exec Code 2016-06-30 2016-11-28
9.0
None Remote Low ??? Complete Complete Complete
hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
6811 CVE-2016-5814 119 Exec Code Overflow 2016-09-19 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
6812 CVE-2016-5799 285 2016-08-24 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 do not properly restrict authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
6813 CVE-2016-5791 287 2017-10-13 2017-11-03
10.0
None Remote Low Not required Complete Complete Complete
An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication.
6814 CVE-2016-5788 254 2016-11-25 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
General Electric (GE) Bently Nevada 3500/22M USB with firmware before 5.0 and Bently Nevada 3500/22M Serial have open ports, which makes it easier for remote attackers to obtain privileged access via unspecified vectors.
6815 CVE-2016-5745 284 2016-10-05 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
F5 BIG-IP LTM systems 11.x before 11.2.1 HF16, 11.3.x, 11.4.x before 11.4.1 HF11, 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2 allow remote attackers to modify or extract system configuration files via vectors involving NAT64.
6816 CVE-2016-5743 20 Exec Code 2016-07-22 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.2 Update 1 as distributed in SIMATIC PCS 7 8.2, and SIMATIC WinCC Runtime Professional before 13 SP1 Update 9 allow remote attackers to execute arbitrary code via crafted packets.
6817 CVE-2016-5700 284 Exec Code 2016-10-03 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12.0.0 before HF4, and 12.1.0 before HF2, when configured with the HTTP Explicit Proxy functionality or SOCKS profile, allow remote attackers to modify the system configuration, read system files, and possibly execute arbitrary code via unspecified vectors.
6818 CVE-2016-5686 287 Bypass 2016-10-05 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Johnson & Johnson Animas OneTouch Ping devices mishandle acknowledgements, which makes it easier for remote attackers to bypass authentication via a custom communication protocol.
6819 CVE-2016-5685 74 2016-11-29 2016-12-01
9.0
None Remote Low ??? Complete Complete Complete
Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection.
6820 CVE-2016-5681 119 Exec Code Overflow 2016-08-25 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1 2.07 before 2.07WWB05, DIR-817 Ax, DIR-818LW Bx before 2.05b03beta03, DIR-822 C1 3.01 before 3.01WWb02, DIR-823 A1 1.00 before 1.00WWb05, DIR-895L A1 1.11 before 1.11WWb04, DIR-890L A1 1.09 before 1.09b14, DIR-885L A1 1.11 before 1.11WWb07, DIR-880L A1 1.07 before 1.07WWb08, DIR-868L B1 2.03 before 2.03WWb01, and DIR-868L C1 3.00 before 3.00WWb01 devices allows remote attackers to execute arbitrary code via a long session cookie.
6821 CVE-2016-5680 119 Exec Code Overflow 2016-08-31 2017-09-03
9.0
None Remote Low ??? Complete Complete Complete
Stack-based buffer overflow in cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transfer_license command.
6822 CVE-2016-5679 78 Exec Code 2016-08-31 2017-09-03
9.0
None Remote Low ??? Complete Complete Complete
cgi-bin/cgi_main in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the sn parameter to the transfer_license command.
6823 CVE-2016-5678 798 2016-08-31 2017-09-03
10.0
None Remote Low Not required Complete Complete Complete
NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors.
6824 CVE-2016-5675 20 Exec Code 2016-08-31 2017-09-03
10.0
None Remote Low Not required Complete Complete Complete
handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
6825 CVE-2016-5674 20 Exec Code 2016-08-31 2017-09-03
10.0
None Remote Low Not required Complete Complete Complete
__debugging_center_utils___.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
6826 CVE-2016-5670 255 2016-08-03 2016-08-15
10.0
None Remote Low Not required Complete Complete Complete
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface.
6827 CVE-2016-5640 77 Exec Code Dir. Trav. 2016-08-03 2016-08-15
10.0
None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.
6828 CVE-2016-5636 190 Overflow 2016-09-02 2019-02-09
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.
6829 CVE-2016-5582 284 2016-10-25 2020-09-08
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573.
6830 CVE-2016-5568 284 2016-10-25 2020-09-08
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT.
6831 CVE-2016-5556 284 2016-10-25 2020-09-08
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Oracle Java SE 6u121, 7u111, and 8u102 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.
6832 CVE-2016-5474 2016-07-21 2017-09-01
9.0
None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RSB Kernel.
6833 CVE-2016-5457 2016-07-21 2017-09-01
9.0
None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to LUMAIN.
6834 CVE-2016-5411 255 2017-06-13 2017-07-05
10.0
None Remote Low Not required Complete Complete Complete
/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and contains the root password of the deployed system.
6835 CVE-2016-5402 94 Exec Code 2018-10-31 2019-10-09
9.0
None Remote Low ??? Complete Complete Complete
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
6836 CVE-2016-5397 77 2018-02-12 2020-06-04
9.0
None Remote Low ??? Complete Complete Complete
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
6837 CVE-2016-5365 264 Exec Code Overflow 2016-06-14 2016-06-14
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in Huawei Honor WS851 routers with software 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges via unspecified vectors, aka HWPSIRT-2016-05051.
6838 CVE-2016-5333 798 2016-08-31 2017-08-16
9.3
None Remote Medium Not required Complete Complete Complete
VMware Photos OS OVA 1.0 before 2016-08-14 has a default SSH public key in an authorized_keys file, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
6839 CVE-2016-5313 78 Exec Code 2017-04-12 2017-04-20
9.0
None Remote Low ??? Complete Complete Complete
Symantec Web Gateway (SWG) before 5.2.5 allows remote authenticated users to execute arbitrary OS commands.
6840 CVE-2016-5234 119 Exec Code Overflow 2016-06-13 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 videoconference devices with software before V500R002C00SPC100, when an unspecified service is enabled, allows remote attackers to execute arbitrary code via a crafted packet, aka HWPSIRT-2016-05054.
6841 CVE-2016-5228 119 Exec Code Overflow 2016-07-03 2017-09-03
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument. NOTE: some references mention CVE-2016-5226 but that is not a correct ID for any Rumba vulnerability.
6842 CVE-2016-5194 2019-11-20 2019-11-21
10.0
None Remote Low Not required Complete Complete Complete
Unspecified vulnerabilities in Google Chrome before 54.0.2840.59.
6843 CVE-2016-5179 119 Exec Code Overflow 2018-03-07 2018-03-27
10.0
None Remote Low Not required Complete Complete Complete
Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.
6844 CVE-2016-5118 284 Exec Code 2016-06-10 2019-12-27
10.0
None Remote Low Not required Complete Complete Complete
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
6845 CVE-2016-5101 284 Exec Code 2016-06-29 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.
6846 CVE-2016-5086 287 Bypass 2016-10-05 2016-12-24
9.3
None Remote Medium Not required Complete Complete Complete
Johnson & Johnson Animas OneTouch Ping devices allow remote attackers to bypass authentication via replay attacks.
6847 CVE-2016-5081 798 2016-08-24 2016-11-28
10.0
None Remote Low Not required Complete Complete Complete
ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session.
6848 CVE-2016-5080 DoS Exec Code Overflow 2016-07-19 2018-10-17
10.0
None Remote Low Not required Complete Complete Complete
Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled by ASN1C, via crafted ASN.1 data.
6849 CVE-2016-5071 264 2017-04-10 2017-04-14
10.0
None Remote Low Not required Complete Complete Complete
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 execute the management web application as root.
6850 CVE-2016-5067 77 2017-04-10 2017-04-14
9.0
None Remote Low ??? Complete Complete Complete
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Hayes AT command injection.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.