CVE & Exploit Intelligence Database

CVE-2016-1220 4.3 MEDIUM EPSS 0.00

Cybozu Garoon before 4.2.2 does not properly restrict access.

CWE-284 Apr 20, 2017

CVE-2016-1217 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the "Check available times" function in Cybozu Garoon before 4.2.2.

CWE-79 Apr 20, 2017

CVE-2016-1216 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the "New appointment" function in Cybozu Garoon before 4.2.2.

CWE-79 Apr 20, 2017

CVE-2016-1215 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the "User details" function in Cybozu Garoon before 4.2.2.

CWE-79 Apr 20, 2017

CVE-2016-1214 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the "Response request" function in Cybozu Garoon before 4.2.2.

CWE-79 Apr 20, 2017

CVE-2016-1213 6.1 MEDIUM EPSS 0.00

The "Scheduler" function in Cybozu Garoon before 4.2.2 allows remote attackers to redirect users to arbitrary websites.

CWE-601 Apr 20, 2017

CVE-2015-8959 6.5 MEDIUM EPSS 0.02

coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.

CWE-399 Apr 20, 2017

CVE-2015-8958 6.5 MEDIUM EPSS 0.01

coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.

CWE-125 Apr 20, 2017

CVE-2015-8957 6.5 MEDIUM EPSS 0.01

Buffer overflow in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (application crash) via a crafted SUN file.

CWE-119 Apr 20, 2017

CVE-2017-7718 5.5 MEDIUM EPSS 0.00

hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.

CWE-125 Apr 20, 2017

CVE-2016-6347 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Apr 20, 2017

CVE-2016-6341 5.5 MEDIUM EPSS 0.00

oVirt Engine before 4.0.3 does not include DWH_DB_PASSWORD in the list of keys to hide in log files, which allows local users to obtain sensitive password information by reading engine log files.

CWE-200 Apr 20, 2017

CVE-2016-6338 6.8 MEDIUM EPSS 0.00

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.

CWE-284 Apr 20, 2017

CVE-2016-6336 6.5 MEDIUM EPSS 0.00

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete.

CWE-284 Apr 20, 2017

CVE-2016-6334 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links.

CWE-79 Apr 20, 2017

CVE-2016-6333 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.

CWE-79 Apr 20, 2017

CVE-2016-5761 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script or HTML via a crafted email.

CWE-79 Apr 20, 2017

CVE-2016-5760 6.1 MEDIUM EPSS 0.00

Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.

CWE-79 Apr 20, 2017

CVE-2016-4849 6.1 MEDIUM EPSS 0.01

Multiple cross-site scripting (XSS) vulnerabilities in Geeklog IVYWE edition 2.1.1 allow remote attackers to inject arbitrary web script or HTML by leveraging use of the COM_getCurrentURL function in (1) public_html/layout/default/header.thtml, (2) public_html/layout/bento/header.thtml, (3) public_html/layout/fotos/header.thtml, or (4) public_html/layout/default/article/article.thtml.

CWE-79 Apr 20, 2017

CVE-2016-4847 6.1 MEDIUM EPSS 0.01

Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex.

CWE-79 Apr 20, 2017