CVE & Exploit Intelligence Database

CVE-2016-7139 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CWE-79 Mar 07, 2017

CVE-2016-7138 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CWE-79 Mar 07, 2017

CVE-2016-7137 6.1 MEDIUM EPSS 0.00

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.

CWE-601 Mar 07, 2017

CVE-2016-7136 6.1 MEDIUM EPSS 0.00

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.

CWE-79 Mar 07, 2017

CVE-2016-7135 4.9 MEDIUM EPSS 0.01

Directory traversal vulnerability in Plone CMS 5.x through 5.0.6 and 4.2.x through 4.3.11 allows remote administrators to read arbitrary files via a .. (dot dot) in the path parameter in a getFile action to Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions.

CWE-22 Mar 07, 2017

CVE-2016-6522 5.5 MEDIUM EPSS 0.00

Integer overflow in the uvm_map_isavail function in uvm/uvm_map.c in OpenBSD 5.9 allows local users to cause a denial of service (kernel panic) via a crafted mmap call, which triggers the new mapping to overlap with an existing mapping.

CWE-190 Mar 07, 2017

CVE-2016-6350 5.5 MEDIUM EPSS 0.00

OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path starting with 10,9.

CWE-476 Mar 07, 2017

CVE-2016-6247 5.5 MEDIUM EPSS 0.00

OpenBSD 5.8 and 5.9 allows certain local users to cause a denial of service (kernel panic) by unmounting a filesystem with an open vnode on the mnt_vnodelist.

CWE-20 Mar 07, 2017

CVE-2016-6246 4.4 MEDIUM EPSS 0.00

OpenBSD 5.8 and 5.9 allows certain local users with kern.usermount privileges to cause a denial of service (kernel panic) by mounting a tmpfs with a VNOVAL in the (1) username, (2) groupname, or (3) device name of the root node.

CWE-20 Mar 07, 2017

CVE-2016-6245 5.5 MEDIUM EPSS 0.00

OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a large size in a getdents system call.

Mar 07, 2017

CVE-2016-6243 5.5 MEDIUM EPSS 0.00

thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (kernel panic) via a crafted value in the tsp parameter of the __thrsleep system call.

CWE-20 Mar 07, 2017

CVE-2016-6242 5.5 MEDIUM EPSS 0.00

OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (assertion failure and kernel panic) via a large ident value in a kevent system call.

CWE-189 Mar 07, 2017

CVE-2016-6239 5.5 MEDIUM EPSS 0.00

The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allows attackers to cause a denial of service (kernel panic and crash) via a large size value.

CWE-20 Mar 07, 2017

CVE-2016-4948 6.1 MEDIUM EPSS 0.00

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera Manager 5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Template Name field when renaming a template; (2) KDC Server host, (3) Kerberos Security Realm, (4) Kerberos Encryption Types, (5) Advanced Configuration Snippet (Safety Valve) for [libdefaults] section of krb5.conf, (6) Advanced Configuration Snippet (Safety Valve) for the Default Realm in krb5.conf, (7) Advanced Configuration Snippet (Safety Valve) for remaining krb5.conf, or (8) Active Directory Account Prefix fields in the Kerberos wizard; or (9) classicWizard parameter to cmf/cloudera-director/redirect.

CWE-79 Mar 07, 2017

CVE-2016-4947 5.3 MEDIUM EPSS 0.00

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to desktop/api/users/autocomplete.

CWE-200 Mar 07, 2017

CVE-2016-4946 6.1 MEDIUM EPSS 0.00

Multiple cross-site scripting (XSS) vulnerabilities in Cloudera HUE 3.9.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name or (2) Last name field in the HUE Users page.

CWE-79 Mar 07, 2017

CVE-2016-9148 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in CA Service Desk Manager (formerly CA Service Desk) 12.9 and 14.1 allows remote attackers to inject arbitrary web script or HTML via the QBE.EQ.REF_NUM parameter.

CWE-79 Mar 07, 2017

CVE-2016-5315 5.5 MEDIUM EPSS 0.00

The setByteArray function in tif_dir.c in libtiff 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted tiff image.

CWE-125 Mar 07, 2017

CVE-2016-10040 5.5 MEDIUM EPSS 0.01

Stack-based buffer overflow in QXmlSimpleReader in Qt 4.8.5 allows remote attackers to cause a denial of service (application crash) via a xml file with multiple nested open tags.

CWE-119 Mar 07, 2017

CVE-2013-5653 5.5 MEDIUM EPSS 0.00

The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.

CWE-200 Mar 07, 2017