CVE-2016-2022

HPE Systems Insight Manager SIM before 7.5.1 allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors, a different vulnerability than CVE-2016-2017, CVE-2016-2019, CVE-2016-2020, CVE-2016-2021, and CVE-2016-2030...

CVE-2016-3072

Multiple SQL injection vulnerabilities in the scopedsearch function in app/controllers/katello/api/v2/apicontroller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the 1 sortby or 2 sortorder parameter...

CVE-2014-8177

CVE-2014-8177 affects Red Hat Gluster Storage’s OpenStack Swift component (gluster-swift). The issue allows remote authenticated users to bypass the max_meta_count constraint by issuing multiple crafted requests that cumulatively exceed the configured limit, enabling excess metadata storage. Root...

jenkins: Arbitrary build parameters are passed to build scripts as environment variables (SECURITY-170)

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...

CVE-2016-1212

CVE-2016-1212 affects Futomi MP Form Mail CGI Professional Edition up to version 3.2.3, exposing a directory traversal vulnerability (CWE-22). The flaw allows remote authenticated administrators to read arbitrary files on the server via unspecified vectors. Public records from NVD/JVN describe th...

CVE-2016-4500

Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by leveraging root access...

CVE-2016-2285

Cross-site request forgery CSRF vulnerability on Moxa MiiNePortE14641 devices with firmware 1.1.10 Build 09120714, MiiNePortE17080 devices with firmware 1.1.10 Build 09120714, MiiNePortE21242 devices with firmware 1.1 Build 10080614, MiiNePortE24561 devices with firmware 1.1 Build 10080614, and...

CVE-2016-4501

CVE-2016-4501 affects ESC 8832 Data Controller (v3.02 and earlier). Root cause: improper session handling enables authentication bypass, allowing remote attackers to perform arbitrary configuration changes. Public exploitation is evidenced by a Metasploit module; advisories (ICS-CERT ICSA-16-147-...

CVE-2016-2311

Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover...

CVE-2016-2309

iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors...

Code injection

Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover...

CVE-2016-2309

iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors...

CVE-2016-2309

CVE-2016-2309 affects iRZ RUH2 prior to 2b: Unrestricted upload of firmware patches (CWE-434) allows remote authenticated users to upload unvalidated patches, potentially modifying firmware/data or causing DoS. Affected product: RUH2 serial-to-network converter. Root cause: firmware patch validat...

mysql: unspecified vulnerability related to Server:Parser (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser...

mysql: unspecified vulnerability in subcomponent: Server: Optimizer (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer...

mysql: unspecified vulnerability in subcomponent: Server: DML (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML...

mysql: unspecified vulnerability related to Server:DDL (CPU October 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL...

mysql: unspecified vulnerability in subcomponent: Server: Security: Encryption (CPU January 2016)

Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption...

Design/Logic Flaw

The grade-reporting feature in Singleview aka Single View in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" settings by leveraging the Non-Editing...

CVE-2016-2155

CVE-2016-2155 affects Moodle’s grade-reporting feature in Singleview where the grade:manage capability is not enforced. Versions impacted: Moodle 2.8.x prior to 2.8.11, 2.9.x prior to 2.9.5, and 3.0.x prior to 3.0.3. This allows remote authenticated users with the Non-Editing Instructor role to m...