Filtered by CWE-20
Filtered by vendor Subscriptions
Total 12671 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-9606 1 Redhat 4 Jboss Bpms, Jboss Enterprise Application Platform, Jboss Enterprise Brms Platform and 1 more 2024-11-21 N/A
JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
CVE-2016-9587 2 Ansible, Redhat 7 Ansible, Ansible, Openshift and 4 more 2024-11-21 8.1 High
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVE-2016-9579 2 Canonical, Redhat 8 Ubuntu Linux, Ceph Storage, Ceph Storage Mon and 5 more 2024-11-21 N/A
A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
CVE-2016-9578 3 Debian, Redhat, Spice Project 8 Debian Linux, Enterprise Linux, Enterprise Linux Desktop and 5 more 2024-11-21 N/A
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server could send crafted messages which would cause the process to crash.
CVE-2016-9577 3 Debian, Redhat, Spice Project 8 Debian Linux, Enterprise Linux, Enterprise Linux Desktop and 5 more 2024-11-21 N/A
A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messages to the SPICE server causing a heap overflow leading to a crash or possible code execution.
CVE-2016-9494 1 Hughes 8 Dw7000, Dw7000 Firmware, Hn7000s and 5 more 2024-11-21 N/A
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to improper input validation. The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may lead to a denial of service.
CVE-2016-9094 1 Symantec 1 Endpoint Protection 2024-11-21 N/A
Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intended target client.
CVE-2016-9093 1 Symantec 1 Endpoint Protection 2024-11-21 N/A
A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 14.0 and later are not impacted by this issue. A non-admin user would need to be able to save an executable file to disk and then be able to successfully run that file. If properly constructed, the file could access the driver interface and potentially manipulate certain system calls. On all 32-bit systems and in most cases on 64-bit systems, this will result in a denial of service that will crash the system. In very narrow circumstances, and on 64-bit systems only, this could allow the user to run arbitrary code on the local machine with kernel-level privileges. This could result in a non-privileged user gaining privileged access on the local machine.
CVE-2016-9076 1 Mozilla 1 Firefox 2024-11-21 N/A
An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox < 50.
CVE-2016-9065 2 Google, Mozilla 2 Android, Firefox 2024-11-21 N/A
The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
CVE-2016-9042 4 Freebsd, Hpe, Ntp and 1 more 5 Freebsd, Hpux-ntp, Ntp and 2 more 2024-11-21 5.9 Medium
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
CVE-2016-9026 1 Exponentcms 1 Exponent Cms 2024-11-21 9.8 Critical
Exponent CMS before 2.6.0 has improper input validation in fileController.php.
CVE-2016-9025 1 Exponentcms 1 Exponent Cms 2024-11-21 9.8 Critical
Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
CVE-2016-9023 1 Exponentcms 1 Exponent Cms 2024-11-21 9.8 Critical
Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
CVE-2016-9022 1 Exponentcms 1 Exponent Cms 2024-11-21 9.8 Critical
Exponent CMS before 2.6.0 has improper input validation in usersController.php.
CVE-2016-9021 1 Exponentcms 1 Exponent Cms 2024-11-21 9.8 Critical
Exponent CMS before 2.6.0 has improper input validation in storeController.php.
CVE-2016-8786 1 Huawei 10 S12700, S12700 Firmware, S5700 and 7 more 2024-11-21 N/A
Huawei S12700 V200R005C00, V200R006C00, V200R007C00, V200R008C00, S5700 V200R006C00, V200R007C00, V200R008C00, S6700 V200R008C00, S7700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R001C00, V200R002C00, V200R003C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00 have a denial of service (DoS) vulnerability. Due to the lack of input validation, a remote attacker may craft a malformed Resource Reservation Protocol (RSVP) packet and send it to the device, causing a few buffer overflows and occasional device restart.
CVE-2016-8785 1 Huawei 8 S12700, S12700 Firmware, S5700 and 5 more 2024-11-21 N/A
Huawei S12700 V200R007C00, V200R008C00, S5700 V200R007C00, S7700 V200R002C00, V200R005C00, V200R006C00, V200R007C00, V200R008C00, S9700 V200R007C00 have an input validation vulnerability. Due to the lack of input validation, an attacker may craft a malformed packet and send it to the device using VRP, causing the device to display additional memory data and possibly leading to sensitive information leakage.
CVE-2016-8651 1 Redhat 2 Openshift, Openshift Container Platform 2024-11-21 N/A
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
CVE-2016-8647 1 Redhat 3 Ansible Engine, Rhev Manager, Virtualization 2024-11-21 4.9 Medium
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.