Total
398551 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2016-6899 | 1 Huawei | 14 Rh1288 V3 Server, Rh1288 V3 Server Firmware, Rh2288 V3 Server and 11 more | 2026-06-17 | 4.3 MEDIUM | 7.5 HIGH |
| The Intelligent Baseboard Management Controller (iBMC) in Huawei RH1288 V3 servers with software before V100R003C00SPC613, RH2288 V3 servers with software before V100R003C00SPC617, RH2288H V3 servers with software before V100R003C00SPC515, RH5885 V3 servers with software before V100R003C10SPC102, and XH620 V3, XH622 V3, and XH628 V3 servers with software before V100R003C00SPC610 might allow remote attackers to decrypt encrypted data and consequently obtain sensitive information by leveraging selection of an insecure SSL encryption algorithm. | |||||
| CVE-2016-6898 | 1 Huawei | 1 E9000 Chassis | 2026-06-17 | 4.9 MEDIUM | 6.6 MEDIUM |
| XML external entity (XXE) vulnerability in the Hyper Management Module (HMM) in Huawei E9000 rack servers with software before V100R001C00SPC296 allows remote authenticated users to read arbitrary files or cause a denial of service (web service outage) via a crafted XML document. | |||||
| CVE-2016-6897 | 1 Wordpress | 1 Wordpress | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. | |||||
| CVE-2016-6896 | 1 Wordpress | 1 Wordpress | 2026-06-17 | 5.5 MEDIUM | 7.1 HIGH |
| Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool. | |||||
| CVE-2016-6894 | 1 Arista | 6 Dcs-7050q, Dcs-7050q Eos Software, Dcs-7050s and 3 more | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a denial of service (device reboot) by sending crafted packets to the control plane. | |||||
| CVE-2016-6893 | 1 Gnu | 1 Mailman | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account. | |||||
| CVE-2016-6892 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509 certificate. | |||||
| CVE-2016-6891 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificate. | |||||
| CVE-2016-6890 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate. | |||||
| CVE-2016-6888 | 3 Debian, Qemu, Redhat | 5 Debian Linux, Qemu, Enterprise Linux and 2 more | 2026-06-17 | 2.1 LOW | 4.4 MEDIUM |
| Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU process crash) via the maximum fragmentation count, which triggers an unchecked multiplication and NULL pointer dereference. | |||||
| CVE-2016-6887 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| The pstm_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attackers to predict the secret key via a CRT attack. | |||||
| CVE-2016-6886 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modulus for the secret key during RSA key exchange. | |||||
| CVE-2016-6885 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation. | |||||
| CVE-2016-6884 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| TLS cipher suites with CBC mode in TLS 1.1 and 1.2 in MatrixSSL before 3.8.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted message. | |||||
| CVE-2016-6883 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| MatrixSSL before 3.8.3 configured with RSA Cipher Suites allows remote attackers to obtain sensitive information via a Bleichenbacher variant attack. | |||||
| CVE-2016-6882 | 1 Matrixssl | 1 Matrixssl | 2026-06-17 | 4.3 MEDIUM | 5.9 MEDIUM |
| MatrixSSL before 3.8.7, when the DHE_RSA based cipher suite is supported, makes it easier for remote attackers to obtain RSA private key information by conducting a Lenstra side-channel attack. | |||||
| CVE-2016-6881 | 1 Ffmpeg | 1 Ffmpeg | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file. | |||||
| CVE-2016-6879 | 1 Botan Project | 1 Botan | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value. | |||||
| CVE-2016-6878 | 1 Botan Project | 1 Botan | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to have unspecified impact via vectors related to undefined behavior, as demonstrated on 32-bit ARM systems compiled by Clang. | |||||
| CVE-2016-6877 | 1 Citrix | 1 Xenmobile Server | 2026-06-17 | 2.6 LOW | 5.3 MEDIUM |
| Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports "our internal analysis of this issue concluded that this was not a valid vulnerability" because an exploitation scenario would involve a man-in-the-middle attack against a TLS session | |||||