Total
398591 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-8642 | 1 Moodle | 1 Moodle | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. | |||||
| CVE-2016-8641 | 1 Nagios | 1 Nagios | 2026-06-17 | 7.2 HIGH | 6.7 MEDIUM |
| A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change. | |||||
| CVE-2016-8640 | 1 Pycsw | 1 Pycsw | 2026-06-17 | 7.5 HIGH | 9.1 CRITICAL |
| A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to. | |||||
| CVE-2016-8639 | 2 Redhat, Theforeman | 3 Satellite, Satellite Capsule, Foreman | 2026-06-17 | 3.5 LOW | 6.1 MEDIUM |
| It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface. | |||||
| CVE-2016-8638 | 1 Ipsilon Project | 1 Ipsilon | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability." | |||||
| CVE-2016-8637 | 1 Dracut Project | 1 Dracut | 2026-06-17 | 2.1 LOW | 5.0 MEDIUM |
| A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. | |||||
| CVE-2016-8636 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology. | |||||
| CVE-2016-8635 | 2 Mozilla, Redhat | 7 Network Security Services, Enterprise Linux Desktop, Enterprise Linux Server and 4 more | 2026-06-17 | 4.3 MEDIUM | 5.3 MEDIUM |
| It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group. | |||||
| CVE-2016-8634 | 1 Theforeman | 1 Foreman | 2026-06-17 | 3.5 LOW | 6.1 MEDIUM |
| A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL. | |||||
| CVE-2016-8633 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 6.2 MEDIUM | 6.8 MEDIUM |
| drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets. | |||||
| CVE-2016-8632 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. | |||||
| CVE-2016-8631 | 1 Redhat | 1 Openshift | 2026-06-17 | 4.0 MEDIUM | 6.3 MEDIUM |
| The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site. | |||||
| CVE-2016-8630 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 4.9 MEDIUM | 5.5 MEDIUM |
| The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction. | |||||
| CVE-2016-8629 | 1 Redhat | 3 Enterprise Linux Server, Keycloak, Single Sign On | 2026-06-17 | 5.5 MEDIUM | 6.5 MEDIUM |
| Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. | |||||
| CVE-2016-8628 | 1 Redhat | 1 Ansible | 2026-06-17 | 9.0 HIGH | 7.6 HIGH |
| Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. | |||||
| CVE-2016-8627 | 1 Redhat | 2 Jboss Enterprise Application Platform, Keycloak | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. | |||||
| CVE-2016-8626 | 1 Redhat | 4 Ceph, Enterprise Linux Desktop, Enterprise Linux Server and 1 more | 2026-06-17 | 6.8 MEDIUM | 6.5 MEDIUM |
| A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests. | |||||
| CVE-2016-8625 | 1 Haxx | 1 Curl | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. | |||||
| CVE-2016-8624 | 1 Haxx | 1 Curl | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. | |||||
| CVE-2016-8623 | 1 Haxx | 1 Curl | 2026-06-17 | 5.0 MEDIUM | 3.3 LOW |
| A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. | |||||