51001 matches found
CVE-2016-10790
cPanel before 60.0.25 does not use TLS for HTTP POSTs to listinput.cpanel.net SEC-192...
CVE-2016-10978
The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...
CVE-2016-10305
Trango Apex = 2.1.1, ApexLynx 2.0, ApexOrion 2.0, ApexPlus = 3.2.0, Giga = 2.6.1, GigaLynx 2.0, GigaOrion 2.0, GigaPlus = 3.2.3, GigaPro = 1.4.1, StrataLink 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software...
CVE-2016-10710
Biscom Secure File Transfer SFT 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential numbers, which allows remote authenticated users to overwrite or read files via crafted requests. Version 5.0.1050 contains the fix...
CVE-2016-10963
The icegram plugin before 1.9.19 for WordPress has XSS...
CVE-2016-10945
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...
CVE-2016-10783
cPanel before 60.0.25 allows self stored XSS in SSLlistkeys SEC-182...
CVE-2016-10927
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php...
CVE-2016-10954
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload...
CVE-2016-10873
The wp-database-backup plugin before 4.3.3 for WordPress has XSS...
CVE-2016-10792
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives SEC-141...
CVE-2016-10837
cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path SEC-46...
CVE-2016-10378
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107admin/menus.php, related to the menuSaveVisibility function...
CVE-2016-10721
partclone.restore in Partclone 0.2.87 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the partclone image header. An attacker may be able to execute arbitrary code in the context of the user running the affected application...
CVE-2016-10802
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler SEC-142...
CVE-2016-10316
Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct Open Redirect attacks via the return-url parameter to /goform/formLogout...
CVE-2016-10820
cPanel before 55.9999.141 allows daemons to access their controlling TTYs SEC-31...
CVE-2016-9021
Exponent CMS before 2.6.0 has improper input validation in storeController.php...