CVE-2016-6561: illumos smbsrv NULL pointer dereference allows system crash.
illumos smbsrv NULL pointer dereference allows system crash.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE archive
March 2016
Browse CVE records published in March 2016, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 729 matching CVEs · Page 8 of 15.
CVE-2016-6560: illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons...
illumos osnet-incorporation bcopy() and bzero() implementations make signed instead of unsigned comparisons allowing a system crash.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-6522: Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to caus...
Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6485: The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to gener...
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
Published Mar 1, 2017 · Updated Aug 6, 2024
CVE-2016-6349: The machinectl command in oci-register-machine allows local users to list running containers and possibly o...
The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.
Published Mar 29, 2017 · Updated Aug 6, 2024
CVE-2016-6350: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) vi...
OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6239: The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kern...
The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6255: Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the we...
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6243: thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kerne...
thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6242: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) vi...
OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6247: OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a...
OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6206: Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of se...
Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or execute arbitrary code via a crafted packet.
Published Mar 24, 2017 · Updated Aug 6, 2024
CVE-2016-6246: OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service...
OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username, (2) groupname, or (3) device name of the root node.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6111: IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML Ext...
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM Reference #: 2000833.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-6240: Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute ar...
Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6244: The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause...
The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tv_sec" value.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6245: OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a ge...
OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6241: Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary...
Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-6209: Cross-site scripting (XSS) vulnerability in Nagios.
Cross-site scripting (XSS) vulnerability in Nagios.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-6225: xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization...
xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-6036: IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting.
IBM Rational Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-6102: IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters.
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM Reference #: 2000359.
Published Mar 27, 2017 · Updated Aug 6, 2024
CVE-2016-6056: IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting.
IBM Call Center for Commerce 9.3 and 9.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000442.
Published Mar 27, 2017 · Updated Aug 6, 2024
CVE-2016-6031: IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting.
IBM Rational Quality Manager 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-6022: IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting.
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000784.
Published Mar 31, 2017 · Updated Aug 6, 2024
CVE-2016-5800: A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation P...
A malicious attacker can trigger a remote buffer overflow in the Communication Server in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0.
Published Mar 21, 2019 · Updated Aug 6, 2024
CVE-2016-5894: IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to inform...
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 7.0 and 8.0 is vulnerable to information disclosure vulnerability. A local user could view a plain text password in a Unix console. IBM Reference #: 1997408.
Published Mar 8, 2017 · Updated Aug 6, 2024
CVE-2016-5932: IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting.
IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1998294.
Published Mar 1, 2017 · Updated Aug 6, 2024
CVE-2016-5857: The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the con...
The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application, aka Android internal bug 34386529 and Qualcomm internal bug CR#1094140.
Published Mar 20, 2017 · Updated Aug 6, 2024
CVE-2016-5758: A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4....
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5757: iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerab...
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5756: Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2....
Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl, roma/jsp/admin/appliance/devicedetail_edit.jsp, roma/jsp/admin/managementip/mgmt_ip_details_frameset.jsp, roma/jsp/admin/managementip/mgmt_ip_details_middleframe.jsp, roma/jsp/volsc/monitoring/appliance.jsp, and roma/jsp/volsc/monitoring/graph.jsp.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5819: Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions pri...
Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scripting attack which may allow an attacker to execute arbitrary script code in the user’s browser within the trust relationship between their browser and the server.
Published Mar 21, 2019 · Updated Aug 6, 2024
CVE-2016-5933: IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to...
IBM Tivoli Monitoring 6.2 and 6.3 is vulnerable to possible host header injection attack that could lead to HTTP cache poisoning or firewall bypass. IBM Reference #: 1997223.
Published Mar 8, 2017 · Updated Aug 6, 2024
CVE-2016-5754: Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and...
Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5755: NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks...
NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5747: A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory b...
A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5752: The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2...
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5751: An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manage...
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5749: NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with ext...
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity (XXE) attack.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5750: The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 befor...
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5748: External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1...
External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users.
Published Mar 23, 2017 · Updated Aug 6, 2024
CVE-2016-5315: The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a deni...
The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.
Published Mar 7, 2017 · Updated Aug 6, 2024
CVE-2016-5314: Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote...
Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.
Published Mar 12, 2018 · Updated Aug 6, 2024
CVE-2016-5374: NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to by...
NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restrictions by leveraging improper handling of the owner_rights ACL entry.
Published Mar 1, 2017 · Updated Aug 6, 2024
CVE-2016-5239: The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers...
The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands via unspecified vectors.
Published Mar 15, 2017 · Updated Aug 6, 2024
CVE-2016-5179: Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.
Chrome OS before 53.0.2785.144 allows remote attackers to execute arbitrary commands at boot.
Published Mar 6, 2018 · Updated Aug 6, 2024
CVE-2016-4926: Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users wi...
Insufficient authentication vulnerability in Junos Space before 15.2R2 allows remote network based users with access to Junos Space web interface to perform certain administrative tasks without authentication.
Published Mar 20, 2017 · Updated Aug 6, 2024
CVE-2016-4928: Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform ce...
Cross site request forgery vulnerability in Junos Space before 15.2R2 allows remote attackers to perform certain administrative actions on Junos Space.
Published Mar 20, 2017 · Updated Aug 6, 2024
CVE-2016-4976: Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allow...
Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.
Published Mar 29, 2017 · Updated Aug 6, 2024