Vulnerabilities
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-12-22 | CVE-2016-9675 | Out-of-bounds Write vulnerability in multiple products openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. | 7.8 |
| 2016-12-22 | CVE-2016-9181 | XXE vulnerability in Image-Info Project Image-Info for Perl 1.16/1.30 perl-Image-Info: When parsing an SVG file, external entity expansion (XXE) was not disabled. | 7.1 |
| 2016-12-22 | CVE-2016-9180 | XXE vulnerability in Xmltwig Xml-Twig for Perl perl-XML-Twig: The option to `expand_external_ents`, documented as controlling external entity expansion in XML::Twig does not work. | 9.1 |
| 2016-12-22 | CVE-2016-9179 | Improper Input Validation vulnerability in Lynx lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host. | 7.5 |
| 2016-12-22 | CVE-2016-7091 | Information Exposure vulnerability in Redhat products sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. | 4.4 |
| 2016-12-21 | CVE-2016-7172 | Information Exposure vulnerability in Netapp Snap Creator Framework NetApp Snap Creator Framework before 4.3.1 discloses sensitive information which could be viewed by an unauthorized user. | 7.5 |
| 2016-12-21 | CVE-2016-5851 | XXE vulnerability in Python-Openxml Project Python-Docx python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document. | 8.8 |
| 2016-12-21 | CVE-2016-2349 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in BMC Remedy Action Request System 8.1/9.0/9.1 Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password. | 7.5 |
| 2016-12-20 | CVE-2016-9757 | Cross-site Scripting vulnerability in Rapid7 Nexpose 6.4.12 In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. | 5.4 |
| 2016-12-20 | CVE-2016-5303 | Cross-site Scripting vulnerability in Horde Groupware 5.2.15 Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute. | 6.1 |