# Vulnerabilities published in 2016


- [CVE-2016-6556](https://insights.sbomify.com/CVE-2016-6556/): OpenNMS Stored XSS via SNMP Agent Data (high 7.1)
- [CVE-2016-6555](https://insights.sbomify.com/CVE-2016-6555/): OpenNMS Stored XSS via SNMP Trap Alerts (high 7.1)
- [CVE-2016-6554](https://insights.sbomify.com/CVE-2016-6554/): Synology NAS servers DS107, DS116, and DS213, use default credentials (critical 9.8)
- [CVE-2016-6553](https://insights.sbomify.com/CVE-2016-6553/): Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials (critical 9.8)
- [CVE-2016-6552](https://insights.sbomify.com/CVE-2016-6552/): Green Packet DX-350 uses default credentials (critical 9.8)
- [CVE-2016-6551](https://insights.sbomify.com/CVE-2016-6551/): Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials (critical 9.8)
- [CVE-2016-6550](https://insights.sbomify.com/CVE-2016-6550/): Weak cryptography in n/a (medium 5.4)
- [CVE-2016-6549](https://insights.sbomify.com/CVE-2016-6549/): Zizai Tech Nut allows for unauthenticated Bluetooth pairing (medium 4.3)
- [CVE-2016-6548](https://insights.sbomify.com/CVE-2016-6548/): Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token (critical 9.8)
- [CVE-2016-6547](https://insights.sbomify.com/CVE-2016-6547/): Zizai Tech Nut stores the account password in cleartext (high 7.8)
- [CVE-2016-6546](https://insights.sbomify.com/CVE-2016-6546/): iTrack Easy mobile application stores the user password in base-64 encoding/cleartext (high 7.8)
- [CVE-2016-6545](https://insights.sbomify.com/CVE-2016-6545/): iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request (critical 9.8)
- [CVE-2016-6544](https://insights.sbomify.com/CVE-2016-6544/): iTrack Easy's getgps data can be modified without authentication (high 7.5)
- [CVE-2016-6543](https://insights.sbomify.com/CVE-2016-6543/): Missing authorization in Easy (medium 5.9)
- [CVE-2016-6542](https://insights.sbomify.com/CVE-2016-6542/): The MAC address/device tracking ID of an iTrack Easy can be obtained within range of the device (low 3.7)
- [CVE-2016-6541](https://insights.sbomify.com/CVE-2016-6541/): Auth bypass in Bravo Mobile Application (high 8.8)
- [CVE-2016-6540](https://insights.sbomify.com/CVE-2016-6540/): Missing authorization in Bravo Mobile Application (medium 6.5)
- [CVE-2016-6539](https://insights.sbomify.com/CVE-2016-6539/): TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID (low 3.5)
- [CVE-2016-6538](https://insights.sbomify.com/CVE-2016-6538/): TrackR Bravo mobile application stores account passwords in cleartext (high 8.8)
- [CVE-2016-6537](https://insights.sbomify.com/CVE-2016-6537/): Information disclosure in n/a (high 7.5)
- [CVE-2016-6536](https://insights.sbomify.com/CVE-2016-6536/): Auth bypass in n/a (critical 9.8)
- [CVE-2016-6535](https://insights.sbomify.com/CVE-2016-6535/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2016-6534](https://insights.sbomify.com/CVE-2016-6534/): Command injection in Opmantek NMIS before 8.5.12G (high 7.5)
- [CVE-2016-6532](https://insights.sbomify.com/CVE-2016-6532/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2016-6531](https://insights.sbomify.com/CVE-2016-6531/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2016-6530](https://insights.sbomify.com/CVE-2016-6530/): Hardcoded credentials in n/a (critical 9.8)
- [CVE-2016-6527](https://insights.sbomify.com/CVE-2016-6527/): Deserialization in n/a (high 7.8)
- [CVE-2016-6526](https://insights.sbomify.com/CVE-2016-6526/): Deserialization in n/a (high 7.8)
- [CVE-2016-6525](https://insights.sbomify.com/CVE-2016-6525/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-6523](https://insights.sbomify.com/CVE-2016-6523/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6522](https://insights.sbomify.com/CVE-2016-6522/): Integer overflow in n/a (medium 5.5)
- [CVE-2016-6521](https://insights.sbomify.com/CVE-2016-6521/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2016-6520](https://insights.sbomify.com/CVE-2016-6520/): Memory corruption in n/a (critical 9.1)
- [CVE-2016-6519](https://insights.sbomify.com/CVE-2016-6519/): Openstack Manila Persistent XSS in Metadata field (medium 5.4)
- [CVE-2016-6518](https://insights.sbomify.com/CVE-2016-6518/): Denial of service in n/a (high 7.5)
- [CVE-2016-6517](https://insights.sbomify.com/CVE-2016-6517/): Path traversal in n/a (critical 9.8)
- [CVE-2016-6516](https://insights.sbomify.com/CVE-2016-6516/): Race condition in n/a (high 7.4)
- [CVE-2016-6515](https://insights.sbomify.com/CVE-2016-6515/): Denial of service in n/a (high 7.5)
- [CVE-2016-6513](https://insights.sbomify.com/CVE-2016-6513/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6512](https://insights.sbomify.com/CVE-2016-6512/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6511](https://insights.sbomify.com/CVE-2016-6511/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6510](https://insights.sbomify.com/CVE-2016-6510/): Memory corruption in n/a (medium 5.9)
- [CVE-2016-6509](https://insights.sbomify.com/CVE-2016-6509/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6508](https://insights.sbomify.com/CVE-2016-6508/): Integer overflow in n/a (medium 5.9)
- [CVE-2016-6507](https://insights.sbomify.com/CVE-2016-6507/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6506](https://insights.sbomify.com/CVE-2016-6506/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6505](https://insights.sbomify.com/CVE-2016-6505/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6504](https://insights.sbomify.com/CVE-2016-6504/): Null dereference in n/a (medium 5.9)
- [CVE-2016-6503](https://insights.sbomify.com/CVE-2016-6503/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6501](https://insights.sbomify.com/CVE-2016-6501/): Deserialization in n/a (critical 9.8)
- [CVE-2016-6500](https://insights.sbomify.com/CVE-2016-6500/): Deserialization in n/a (high 8.1)
- [CVE-2016-6497](https://insights.sbomify.com/CVE-2016-6497/): Other in n/a (high 7.5)
- [CVE-2016-6496](https://insights.sbomify.com/CVE-2016-6496/): Deserialization in n/a (critical 9.8)
- [CVE-2016-6495](https://insights.sbomify.com/CVE-2016-6495/): Information disclosure in n/a (medium 5.9)
- [CVE-2016-6494](https://insights.sbomify.com/CVE-2016-6494/): Information disclosure in n/a (medium 5.5)
- [CVE-2016-6493](https://insights.sbomify.com/CVE-2016-6493/): Security feature bypass in n/a (critical 9.8)
- [CVE-2016-6492](https://insights.sbomify.com/CVE-2016-6492/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6491](https://insights.sbomify.com/CVE-2016-6491/): Memory corruption in n/a (high 8.8)
- [CVE-2016-6490](https://insights.sbomify.com/CVE-2016-6490/): Denial of service in n/a (medium 4.4)
- [CVE-2016-6489](https://insights.sbomify.com/CVE-2016-6489/): Information disclosure in n/a (high 7.5)
- [CVE-2016-6486](https://insights.sbomify.com/CVE-2016-6486/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6485](https://insights.sbomify.com/CVE-2016-6485/): Unauthenticated crypto and weak IV in Magento\Framework\Encryption (high 7.5)
- [CVE-2016-6484](https://insights.sbomify.com/CVE-2016-6484/): Other in n/a (medium 6.1)
- [CVE-2016-6483](https://insights.sbomify.com/CVE-2016-6483/): Server-side request forgery in n/a (high 8.6)
- [CVE-2016-6480](https://insights.sbomify.com/CVE-2016-6480/): Race condition in n/a (medium 5.1)
- [CVE-2016-6474](https://insights.sbomify.com/CVE-2016-6474/): Auth bypass in Cisco IOS (high 7.3)
- [CVE-2016-6473](https://insights.sbomify.com/CVE-2016-6473/): Denial of service in Cisco IOS (medium 6.5)
- [CVE-2016-6472](https://insights.sbomify.com/CVE-2016-6472/): Cross-site scripting in Cisco Unified Communication Manager 11.5(1.2) (medium 6.1)
- [CVE-2016-6471](https://insights.sbomify.com/CVE-2016-6471/): Information disclosure in Cisco Firepower Management Center (medium 6.5)
- [CVE-2016-6470](https://insights.sbomify.com/CVE-2016-6470/): Privilege escalation in Cisco Hybrid Media Service (high 7.8)
- [CVE-2016-6469](https://insights.sbomify.com/CVE-2016-6469/): Denial of service in Cisco Web Security Appliance (WSA) (high 7.5)
- [CVE-2016-6468](https://insights.sbomify.com/CVE-2016-6468/): Cross-site request forgery in Cisco Emergency Responder (high 8.8)
- [CVE-2016-6467](https://insights.sbomify.com/CVE-2016-6467/): Denial of service in Cisco Aggregation Services Router (ASR) 5000 Series Switch (high 7.5)
- [CVE-2016-6466](https://insights.sbomify.com/CVE-2016-6466/): Denial of service in Cisco StarOS 20.0.0 through 21.0.M0.64246 (high 7.5)
- [CVE-2016-6465](https://insights.sbomify.com/CVE-2016-6465/): Security feature bypass in Cisco AsyncOS (medium 4.3)
- [CVE-2016-6464](https://insights.sbomify.com/CVE-2016-6464/): Information disclosure in Cisco Unified Communications Manager (high 7.5)
- [CVE-2016-6463](https://insights.sbomify.com/CVE-2016-6463/): Security feature bypass in Cisco AsyncOS 9.7.1-066 through 10.0.0-082 (medium 5.3)
- [CVE-2016-6462](https://insights.sbomify.com/CVE-2016-6462/): Security feature bypass in Cisco AsyncOS 9.7.1-066 through 10.0.0-125 (medium 5.3)
- [CVE-2016-6461](https://insights.sbomify.com/CVE-2016-6461/): XML external entity in Cisco Adaptive Security Appliance (ASA) 9.1(6.10) (medium 5.9)
- [CVE-2016-6460](https://insights.sbomify.com/CVE-2016-6460/): Security feature bypass in Cisco Firepower System Software 5.4.0.2 through 6.2.0 (high 7.5)
- [CVE-2016-6459](https://insights.sbomify.com/CVE-2016-6459/): Command injection in Cisco TelePresence CE and TC 8.1.x (medium 5.5)
- [CVE-2016-6458](https://insights.sbomify.com/CVE-2016-6458/): Security feature bypass in Cisco AsyncOS 10.0.0-125 and 9.7.1-066 (high 7.5)
- [CVE-2016-6457](https://insights.sbomify.com/CVE-2016-6457/): Denial of service in Cisco Nexus 9000 Series Platform Leaf Switches for Application Centric Infrastructure (ACI) 11.2(2x) through 12.0(1x) (medium 6.5)
- [CVE-2016-6455](https://insights.sbomify.com/CVE-2016-6455/): Denial of service in Cisco StarOS 18.x through 21.x (high 7.5)
- [CVE-2016-6454](https://insights.sbomify.com/CVE-2016-6454/): Cross-site request forgery in Cisco Hosted Collaboration Mediation Fulfillment before 11.5(0.98000.216) (medium 6.5)
- [CVE-2016-6453](https://insights.sbomify.com/CVE-2016-6453/): SQL injection in Cisco Identity Services Engine 1.3(0.876) (high 7.3)
- [CVE-2016-6452](https://insights.sbomify.com/CVE-2016-6452/): Auth bypass in Cisco Prime Home before 6.0 (critical 9.8)
- [CVE-2016-6451](https://insights.sbomify.com/CVE-2016-6451/): Cross-site scripting in Cisco Prime Collaboration Provisioning 10.6 (medium 6.1)
- [CVE-2016-6450](https://insights.sbomify.com/CVE-2016-6450/): Path traversal in Cisco IOS XE 3.7(0) through Denali-16.3.1 (low 2.5)
- [CVE-2016-6449](https://insights.sbomify.com/CVE-2016-6449/): Security feature bypass in Cisco FireAMP Connector Endpoint software (high 7.8)
- [CVE-2016-6448](https://insights.sbomify.com/CVE-2016-6448/): Memory corruption in Cisco Meeting Server before 2.0.3 and Acano Server before 1.9.5 (critical 9.8)
- [CVE-2016-6447](https://insights.sbomify.com/CVE-2016-6447/): Memory corruption in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco Meeting App before 1.9.8, Acano Meeting Apps before 1.8.35 (critical 9.8)
- [CVE-2016-6446](https://insights.sbomify.com/CVE-2016-6446/): Information disclosure in Cisco Meeting Server 1.8, 1.9, 2.0 (high 7.5)
- [CVE-2016-6445](https://insights.sbomify.com/CVE-2016-6445/): Auth bypass in Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 (critical 9.1)
- [CVE-2016-6444](https://insights.sbomify.com/CVE-2016-6444/): Cross-site request forgery in Cisco Meeting Server 1.8, 1.9, 2.0 (high 8.8)
- [CVE-2016-6443](https://insights.sbomify.com/CVE-2016-6443/): SQL injection in Cisco Prime Infrastructure and Evolved Programmable Network Manager 3.1(0.128), 1.2(400), 2.0(1.0.34A) (high 8.8)
- [CVE-2016-6442](https://insights.sbomify.com/CVE-2016-6442/): Cross-site request forgery in Cisco Finesse 11.0(1) (high 8.8)
- [CVE-2016-6441](https://insights.sbomify.com/CVE-2016-6441/): Memory corruption in Cisco IOS XE 3.17 and 3.18 (critical 9.8)
- [CVE-2016-6440](https://insights.sbomify.com/CVE-2016-6440/): Other in Cisco Unified Communications Manager 11.0(1.10000.10), 11.5(1.10000.6), 11.5(0.99838.4) (medium 6.5)
- [CVE-2016-6439](https://insights.sbomify.com/CVE-2016-6439/): Denial of service in Cisco Firepower System Software before 6.0.1 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/26/