Filtered by vendor Subscriptions
Total 322228 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-9589 1 Redhat 4 Jboss Enterprise Application Platform, Jboss Single Sign On, Jboss Wildfly Application Server and 1 more 2024-11-21 N/A
Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
CVE-2016-9587 2 Ansible, Redhat 7 Ansible, Ansible, Openshift and 4 more 2024-11-21 8.1 High
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVE-2016-9586 2 Haxx, Redhat 2 Curl, Rhel Software Collections 2024-11-21 N/A
curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any application that accepts a format string from the outside without necessary input filtering, it could allow remote attacks.
CVE-2016-9585 1 Redhat 1 Jboss Enterprise Application Platform 2024-11-21 N/A
Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
CVE-2016-9583 3 Jasper Project, Oracle, Redhat 9 Jasper, Outside In Technology, Enterprise Linux and 6 more 2024-11-21 N/A
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
CVE-2016-9581 1 Uclouvain 1 Openjpeg 2024-11-21 N/A
An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
CVE-2016-9580 1 Uclouvain 1 Openjpeg 2024-11-21 N/A
An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
CVE-2016-9579 2 Canonical, Redhat 8 Ubuntu Linux, Ceph Storage, Ceph Storage Mon and 5 more 2024-11-21 N/A
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
CVE-2016-9578 3 Debian, Redhat, Spice Project 8 Debian Linux, Enterprise Linux, Enterprise Linux Desktop and 5 more 2024-11-21 N/A
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.
CVE-2016-9577 3 Debian, Redhat, Spice Project 8 Debian Linux, Enterprise Linux, Enterprise Linux Desktop and 5 more 2024-11-21 N/A
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
CVE-2016-9575 2 Freeipa, Redhat 2 Freeipa, Enterprise Linux 2024-11-21 N/A
Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.
CVE-2016-9574 1 Mozilla 1 Network Security Services 2024-11-21 N/A
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVE-2016-9573 3 Debian, Redhat, Uclouvain 8 Debian Linux, Enterprise Linux, Enterprise Linux Desktop and 5 more 2024-11-21 N/A
An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap.
CVE-2016-9572 2 Debian, Uclouvain 2 Debian Linux, Openjpeg 2024-11-21 N/A
A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.
CVE-2016-9570 1 Carbonblack 1 Carbon Black 2024-11-21 N/A
cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer dereference, and application crash) by leveraging access to the NetMon named pipe.
CVE-2016-9569 1 Carbonblack 1 Carbon Black 2024-11-21 N/A
The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of service (out-of-bounds read and system crash) via a large counter value in an 0x62430028 IOCTL call.
CVE-2016-9568 1 Carbonblack 1 Carbon Black 2024-11-21 N/A
A security design issue can allow an unprivileged user to interact with the Carbon Black Sensor and perform unauthorized actions.
CVE-2016-9500 1 Accellion 1 Ftp Server 2024-11-21 N/A
Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multiple parameters (customTabCategoryName, customButton1Image) that are vulnerable to cross-site scripting.
CVE-2016-9499 1 Accellion 1 Ftp Server 2024-11-21 N/A
Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.
CVE-2016-9498 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application Manager's RMI registry is running with privileges of system administrator, by exploiting this vulnerability an attacker gains highest privileges on the underlying operating system.