CVE-2016-10xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
969 records · Page 2 of 10
The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.
UpdatedThe total-security plugin before 3.4.1 for WordPress has XSS.
Updated- CVE-2016-10897: The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues. Unscored
The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.
Updated The seo-redirection plugin before 4.3 for WordPress has stored XSS.
UpdatedThe option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.
Updatedxtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (and thus control) various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks (by depressing the touchpad once and then clicking with a different finger).
UpdatedThe crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
UpdatedThe chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.
UpdatedThe aryo-activity-log plugin before 2.3.3 for WordPress has XSS.
UpdatedThe aryo-activity-log plugin before 2.3.2 for WordPress has XSS.
UpdatedThe nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
UpdatedThe wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.
UpdatedThe wp-editor plugin before 1.2.6 for WordPress has CSRF.
Updated- CVE-2016-10884: The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues. Unscored
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.
Updated The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.
UpdatedThe google-document-embedder plugin before 2.6.2 for WordPress has CSRF.
UpdatedThe google-document-embedder plugin before 2.6.2 for WordPress has XSS.
UpdatedThe google-document-embedder plugin before 2.6.1 for WordPress has XSS.
UpdatedThe wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.
UpdatedThe wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.
UpdatedThe wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.
UpdatedThe wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
UpdatedThe wp-database-backup plugin before 4.3.1 for WordPress has XSS.
UpdatedThe wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
UpdatedThe wp-database-backup plugin before 4.3.3 for WordPress has XSS.
Updated- CVE-2016-10872: The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form. Unscored
The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.
Updated The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.
UpdatedThe google-language-translator plugin before 5.0.06 for WordPress has XSS.
UpdatedThe contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.
UpdatedThe all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.
UpdatedThe Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery (CSRF) via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS.
UpdatedNETGEAR EX7000 V1.0.0.42_1.0.94 devices allow XSS via the SSID.
UpdatedEdimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.
UpdatedNeet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configuration page.
UpdatedNeet AirStream NAS1.1 devices allow CSRF attacks that cause the settings binary to change the AP name and password.
UpdatedcPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).
UpdatedcPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).
UpdatedcPanel before 11.54.0.0 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-64).
Updated- CVE-2016-10857: cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60). Unscored
cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).
Updated cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).
UpdatedcPanel before 11.54.0.4 allows unauthenticated arbitrary code execution via cpsrvd (SEC-91).
Updated- CVE-2016-10854: cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87). Unscored
cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface (SEC-87).
Updated cPanel before 11.54.0.4 allows stored XSS in the WHM Feature Manager interface (SEC-86).
Updated- CVE-2016-10852: cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85). Unscored
cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).
Updated cPanel before 11.54.0.4 allows self XSS in the WHM PHP Configuration editor interface (SEC-84).
UpdatedcPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).
UpdatedcPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
UpdatedcPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).
UpdatedcPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).
UpdatedcPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79).
UpdatedcPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).
Updated- CVE-2016-10844: The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77). Unscored
The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).
Updated cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
UpdatedcPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).
UpdatedThe bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes (SEC-73).
UpdatedcPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).
Updated- CVE-2016-10839: cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). Unscored
cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).
Updated cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).
UpdatedcPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).
UpdatedcPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).
UpdatedcPanel before 55.9999.141 allows a POP/IMAP cPHulk bypass via account name munging (SEC-107).
Updated- CVE-2016-10834: cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105). Unscored
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105).
Updated cPanel before 55.9999.141 mishandles username-based blocking for PRE requests in cPHulkd (SEC-104).
UpdatedcPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).
UpdatedcPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).
UpdatedcPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100).
UpdatedcPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).
UpdatedcPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).
UpdatedcPanel before 55.9999.141 allows self stored XSS in WHM Edit System Mail Preferences (SEC-96).
UpdatedcPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93).
UpdatedcPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).
UpdatedcPanel before 55.9999.141 allows unauthenticated arbitrary code execution via DNS NS entry poisoning (SEC-90).
UpdatedcPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89).
Updated- CVE-2016-10822: cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88). Unscored
cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images (SEC-88).
Updated In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).
Updated- CVE-2016-10820: cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31). Unscored
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31).
Updated In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
UpdatedcPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).
UpdatedcPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).
UpdatedcPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).
UpdatedcPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).
Updated- CVE-2016-10814: cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119). Unscored
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).
Updated cPanel before 57.9999.54 allows self XSS during ftp account creation under addon domains (SEC-118).
Updated- CVE-2016-10812: In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117). Unscored
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).
Updated - CVE-2016-10811: In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116). Unscored
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).
Updated In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).
UpdatedIn cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).
UpdatedIn cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).
UpdatedcPanel before 57.9999.54 allows certain denial-of-service outcomes via /scripts/killpvhost (SEC-112).
UpdatedcPanel before 57.9999.54 allows self XSS on the Paper Lantern Landing Page (SEC-110).
UpdatedcPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).
UpdatedThe SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58).
Updated- CVE-2016-10803: cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923). Unscored
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
Updated cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).
Updated- CVE-2016-10801: cPanel before 58.0.4 has improper session handling for shared users (SEC-139). Unscored
cPanel before 58.0.4 has improper session handling for shared users (SEC-139).
Updated cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls (SEC-138).
Updated