Vulnerabilities > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-04-14 | CVE-2016-4017 | Denial of Service vulnerability in SAP HANA The Data Provisioning Agent (aka DP Agent) in SAP HANA allows remote attackers to cause a denial of service (process crash) via unspecified vectors, aka SAP Security Note 2262710. | 5.0 |
| 2016-04-14 | CVE-2016-4016 | Cross-site Scripting vulnerability in SAP Java AS 7.4 Cross-site scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) 15 allows remote attackers to inject arbitrary web script or HTML via the title parameter to webdynpro/resources/sap.com/xapps~xmii~ui~admin~navigation/NavigationApplication, aka SAP Security Note 2201295. | 4.3 |
| 2016-04-14 | CVE-2016-4015 | Denial of Service vulnerability in SAP NetWeaver Enqueue Server The Enqueue Server in SAP NetWeaver JAVA AS 7.1 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted request, aka SAP Security Note 2258784. | 5.0 |
| 2016-04-14 | CVE-2016-3079 | Cross-site Scripting vulnerability in Redhat Satellite and Spacewalk-Java Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Spacewalk and Red Hat Satellite 5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to systems/SystemEntitlements.do; (2) the label parameter to admin/multiorg/EntitlementDetails.do; or the name of a (3) snapshot tag or (4) system group in System Set Manager (SSM). | 6.1 |
| 2016-04-14 | CVE-2016-2103 | Cross-site Scripting vulnerability in Redhat Satellite 5.7 Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the list_1680466951_oldfilterval parameter to systems/PhysicalList.do or (2) unspecified vectors involving systems/VirtualSystemsList.do. | 6.1 |
| 2016-04-14 | CVE-2015-8554 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in XEN Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." | 6.6 |
| 2016-04-14 | CVE-2015-8550 | Improper Access Control vulnerability in multiple products Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability. | 5.7 |
| 2016-04-14 | CVE-2015-7999 | SQL Injection vulnerability in Citrix Command Center 5.1/5.2 Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | 6.5 |
| 2016-04-14 | CVE-2015-0284 | Cross-site Scripting vulnerability in Redhat Satellite and Spacewalk-Java Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. | 5.4 |
| 2016-04-14 | CVE-2016-1378 | Information Exposure vulnerability in Cisco IOS Cisco IOS before 15.2(2)E1 on Catalyst switches allows remote attackers to obtain potentially sensitive software-version information via a request to the Network Mobility Services Protocol (NMSP) port, aka Bug ID CSCum62591. | 5.0 |