CVE-2016-10799

cPanel before 58.0.4 does not set the Pear tmp directory during a PHP installation SEC-137...

CVE-2016-10997

The beauty-premium theme 1.0.8 for WordPress has CSRF with resultant arbitrary file upload in includes/sendmail.php...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2016-10757

In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php...

CVE-2016-10793

cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect ! in Mail::SPF scripts SEC-152...

CVE-2016-10775

cPanel before 60.0.25 allows arbitrary file-chown operations via reassignpostterminatecruft SEC-173...

CVE-2016-10766

edx-platform before 2016-06-06 allows CSRF...

CVE-2016-10812

In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs SEC-117...

CVE-2016-10902

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools...

CVE-2016-10920

The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS...

CVE-2016-10933

An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP...

CVE-2016-10852

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem SEC-85...

CVE-2016-10780

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

CVE-2016-10924

The ebook-download plugin before 1.2 for WordPress has directory traversal...

CVE-2016-10960

The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter...

CVE-2016-10313

Jensen of Scandinavia AS Air:Link 3G AL3G version 2.23m Rev. 3, Air:Link 5000AC AL5000AC version 1.13, and Air:Link 59300 AL59300 version 1.04 Rev. 4 devices allow remote attackers to conduct CSRF attacks via certain /goform/ pages...

CVE-2016-10977

The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal...

CVE-2016-10878

The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

CVE-2016-10785

cPanel before 60.0.25 allows attackers to discover file contents during file copy operations SEC-185...