# Vulnerabilities published in 2016


- [CVE-2016-5000](https://insights.sbomify.com/CVE-2016-5000/): Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability (medium 5.5)
- [CVE-2016-4999](https://insights.sbomify.com/CVE-2016-4999/): SQL injection in redhat:dashbuilder (critical 9.8)
- [CVE-2016-4998](https://insights.sbomify.com/CVE-2016-4998/): Memory corruption in canonical:ubuntu linux (high 7.1)
- [CVE-2016-4997](https://insights.sbomify.com/CVE-2016-4997/): Memory corruption in canonical:ubuntu linux (high 7.8)
- [CVE-2016-4996](https://insights.sbomify.com/CVE-2016-4996/): Information disclosure in redhat:satellite (high 7.0)
- [CVE-2016-4995](https://insights.sbomify.com/CVE-2016-4995/): Missing authorization in theforeman:foreman (medium 5.3)
- [CVE-2016-4994](https://insights.sbomify.com/CVE-2016-4994/): Use after free in gimp:gimp (high 7.8)
- [CVE-2016-4993](https://insights.sbomify.com/CVE-2016-4993/): Improper Neutralization of CRLF Sequences in Wildfly Undertow (medium 6.1)
- [CVE-2016-4992](https://insights.sbomify.com/CVE-2016-4992/): Information disclosure in redhat:enterprise linux desktop (high 7.5)
- [CVE-2016-4991](https://insights.sbomify.com/CVE-2016-4991/): Command injection in nodepdf (critical 9.8)
- [CVE-2016-4989](https://insights.sbomify.com/CVE-2016-4989/): Command injection in redhat:enterprise linux desktop (high 7.0)
- [CVE-2016-4988](https://insights.sbomify.com/CVE-2016-4988/): Cross-site Scripting in Jenkins Build Failure Analyzer plugin (medium 6.1)
- [CVE-2016-4987](https://insights.sbomify.com/CVE-2016-4987/): Jenkins Image Gallery Plugin allows Path Traversal (medium 6.5)
- [CVE-2016-4986](https://insights.sbomify.com/CVE-2016-4986/): Jenkins TAP Plugin allows Path Traversal (high 7.5)
- [CVE-2016-4985](https://insights.sbomify.com/CVE-2016-4985/): OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2016-4984](https://insights.sbomify.com/CVE-2016-4984/): Race condition in openldap:openldap-servers (medium 4.7)
- [CVE-2016-4983](https://insights.sbomify.com/CVE-2016-4983/): Misconfiguration in dovecot22 (low 3.3)
- [CVE-2016-4982](https://insights.sbomify.com/CVE-2016-4982/): Race condition in teether:authd (medium 4.7)
- [CVE-2016-4980](https://insights.sbomify.com/CVE-2016-4980/): Weak cryptography in xguest (low 2.5)
- [CVE-2016-4979](https://insights.sbomify.com/CVE-2016-4979/): Security feature bypass in apache:http server (high 7.5)
- [CVE-2016-4978](https://insights.sbomify.com/CVE-2016-4978/): Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain (high 7.2)
- [CVE-2016-4977](https://insights.sbomify.com/CVE-2016-4977/): Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views (high 8.8)
- [CVE-2016-4976](https://insights.sbomify.com/CVE-2016-4976/): Apache Ambari reveals administrator passwords (medium 5.5)
- [CVE-2016-4975](https://insights.sbomify.com/CVE-2016-4975/): mod_userdir CRLF injection (medium 6.1)
- [CVE-2016-4974](https://insights.sbomify.com/CVE-2016-4974/): Improper Input Validation in Apache Qpid AMQP 0-x JMS (high 7.5)
- [CVE-2016-4973](https://insights.sbomify.com/CVE-2016-4973/): Memory corruption in gnu:libssp (high 7.8)
- [CVE-2016-4972](https://insights.sbomify.com/CVE-2016-4972/): OpenStack Murano Code Execution (critical 9.8)
- [CVE-2016-4971](https://insights.sbomify.com/CVE-2016-4971/): Path traversal in canonical:ubuntu linux (high 8.8)
- [CVE-2016-4970](https://insights.sbomify.com/CVE-2016-4970/): Loop with Unreachable Exit Condition in Netty (high 7.5)
- [CVE-2016-4969](https://insights.sbomify.com/CVE-2016-4969/): Cross-site scripting in fortinet:fortiwan (medium 6.1)
- [CVE-2016-4968](https://insights.sbomify.com/CVE-2016-4968/): Information disclosure in fortinet:fortiwan (medium 6.5)
- [CVE-2016-4967](https://insights.sbomify.com/CVE-2016-4967/): Information disclosure in fortinet:fortiwan (medium 6.5)
- [CVE-2016-4966](https://insights.sbomify.com/CVE-2016-4966/): Auth bypass in fortinet:fortiwan (medium 6.5)
- [CVE-2016-4965](https://insights.sbomify.com/CVE-2016-4965/): Command injection in fortinet:fortiwan (high 8.8)
- [CVE-2016-4964](https://insights.sbomify.com/CVE-2016-4964/): Denial of service in qemu:qemu (medium 6.0)
- [CVE-2016-4963](https://insights.sbomify.com/CVE-2016-4963/): Denial of service in xen:xen (medium 4.7)
- [CVE-2016-4962](https://insights.sbomify.com/CVE-2016-4962/): Privilege escalation in oracle:vm server (medium 6.7)
- [CVE-2016-4961](https://insights.sbomify.com/CVE-2016-4961/): Denial of service in Quadro, NVS, GeForce (all versions) (medium 5.5)
- [CVE-2016-4960](https://insights.sbomify.com/CVE-2016-4960/): Privilege escalation in Quadro, NVS, GeForce (all versions) (high 7.3)
- [CVE-2016-4959](https://insights.sbomify.com/CVE-2016-4959/): Null dereference in Quadro, NVS, GeForce (all versions) (high 7.5)
- [CVE-2016-4957](https://insights.sbomify.com/CVE-2016-4957/): Null dereference in novell:suse manager (high 7.5)
- [CVE-2016-4956](https://insights.sbomify.com/CVE-2016-4956/): Denial of service in novell:suse manager (medium 5.3)
- [CVE-2016-4955](https://insights.sbomify.com/CVE-2016-4955/): Race condition in novell:suse manager (medium 5.9)
- [CVE-2016-4954](https://insights.sbomify.com/CVE-2016-4954/): Race condition in ntp:ntp (high 7.5)
- [CVE-2016-4953](https://insights.sbomify.com/CVE-2016-4953/): Auth bypass in ntp:ntp (high 7.5)
- [CVE-2016-4952](https://insights.sbomify.com/CVE-2016-4952/): Memory corruption in canonical:ubuntu linux (medium 6.0)
- [CVE-2016-4951](https://insights.sbomify.com/CVE-2016-4951/): Null dereference in canonical:ubuntu linux (high 7.8)
- [CVE-2016-4950](https://insights.sbomify.com/CVE-2016-4950/): Information disclosure in cloudera:manager (high 7.5)
- [CVE-2016-4949](https://insights.sbomify.com/CVE-2016-4949/): Information disclosure in cloudera:manager (high 7.5)
- [CVE-2016-4948](https://insights.sbomify.com/CVE-2016-4948/): Cross-site scripting in cloudera:manager (medium 6.1)
- [CVE-2016-4947](https://insights.sbomify.com/CVE-2016-4947/): Cloudera HUE Account Enumeration (medium 5.3)
- [CVE-2016-4946](https://insights.sbomify.com/CVE-2016-4946/): Cross-site scripting in cloudera:hue (medium 6.1)
- [CVE-2016-4945](https://insights.sbomify.com/CVE-2016-4945/): Cross-site scripting in citrix:netscaler gateway 11.0 firmware (medium 6.1)
- [CVE-2016-4931](https://insights.sbomify.com/CVE-2016-4931/): XML external entity in juniper:junos space (medium 6.5)
- [CVE-2016-4930](https://insights.sbomify.com/CVE-2016-4930/): Cross-site scripting in juniper:junos space (medium 6.1)
- [CVE-2016-4929](https://insights.sbomify.com/CVE-2016-4929/): Command injection in juniper:junos space (high 8.8)
- [CVE-2016-4928](https://insights.sbomify.com/CVE-2016-4928/): Cross-site request forgery in juniper:junos space (high 8.8)
- [CVE-2016-4927](https://insights.sbomify.com/CVE-2016-4927/): Security feature bypass in juniper:junos space (high 8.1)
- [CVE-2016-4926](https://insights.sbomify.com/CVE-2016-4926/): Auth bypass in juniper:junos space (critical 9.8)
- [CVE-2016-4925](https://insights.sbomify.com/CVE-2016-4925/): JUNOSe: Line Card Reset: processor exception 0x68616c74 (halt) task: scheduler, upon receipt of crafted IPv6 packet (high 7.5)
- [CVE-2016-4924](https://insights.sbomify.com/CVE-2016-4924/): vMX: Information leak vulnerability (high 8.4)
- [CVE-2016-4923](https://insights.sbomify.com/CVE-2016-4923/): Junos J-Web: Cross Site Scripting Vulnerability (high 8.0)
- [CVE-2016-4922](https://insights.sbomify.com/CVE-2016-4922/): Junos: Privilege escalation vulnerabilities in Junos CLI (high 8.4)
- [CVE-2016-4921](https://insights.sbomify.com/CVE-2016-4921/): Junos: IPv6 denial of service vulnerability due to resource exhaustion (CVE-2016-4921) (high 7.5)
- [CVE-2016-4913](https://insights.sbomify.com/CVE-2016-4913/): Information disclosure in canonical:ubuntu linux (high 7.8)
- [CVE-2016-4912](https://insights.sbomify.com/CVE-2016-4912/): Null dereference in openslp:openslp (high 7.5)
- [CVE-2016-4911](https://insights.sbomify.com/CVE-2016-4911/): OpenStack Identity Keystone Improper Access Control (medium 4.3)
- [CVE-2016-4910](https://insights.sbomify.com/CVE-2016-4910/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2016-4909](https://insights.sbomify.com/CVE-2016-4909/): Cross-site request forgery in Cybozu Garoon (medium 4.3)
- [CVE-2016-4908](https://insights.sbomify.com/CVE-2016-4908/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2016-4907](https://insights.sbomify.com/CVE-2016-4907/): Cross-site request forgery in Cybozu Garoon (high 8.8)
- [CVE-2016-4906](https://insights.sbomify.com/CVE-2016-4906/): Cross-site scripting in Cybozu Garoon (medium 6.1)
- [CVE-2016-4905](https://insights.sbomify.com/CVE-2016-4905/): SQL injection in WP-OliveCart (critical 9.8)
- [CVE-2016-4904](https://insights.sbomify.com/CVE-2016-4904/): Cross-site request forgery in WP-OliveCart (high 8.8)
- [CVE-2016-4903](https://insights.sbomify.com/CVE-2016-4903/): Cross-site scripting in WP-OliveCart (medium 6.1)
- [CVE-2016-4902](https://insights.sbomify.com/CVE-2016-4902/): Other in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" (high 7.8)
- [CVE-2016-4901](https://insights.sbomify.com/CVE-2016-4901/): Other in The installer of e-Tax Software (high 7.8)
- [CVE-2016-4900](https://insights.sbomify.com/CVE-2016-4900/): Other in Evernote for Windows (high 7.8)
- [CVE-2016-4899](https://insights.sbomify.com/CVE-2016-4899/): Command injection in novastor:novabackup datacenter (critical 9.8)
- [CVE-2016-4898](https://insights.sbomify.com/CVE-2016-4898/): Command injection in novastor:novabackup datacenter (critical 9.8)
- [CVE-2016-4897](https://insights.sbomify.com/CVE-2016-4897/): Cross-site scripting in webmin:usermin (medium 6.1)
- [CVE-2016-4896](https://insights.sbomify.com/CVE-2016-4896/): Auth bypass in setucocms project:setucocms (medium 6.5)
- [CVE-2016-4895](https://insights.sbomify.com/CVE-2016-4895/): Code injection in setucocms project:setucocms (high 8.8)
- [CVE-2016-4894](https://insights.sbomify.com/CVE-2016-4894/): Denial of service in setucocms project:setucocms (medium 5.3)
- [CVE-2016-4893](https://insights.sbomify.com/CVE-2016-4893/): SQL injection in setucocms project:setucocms (high 8.8)
- [CVE-2016-4892](https://insights.sbomify.com/CVE-2016-4892/): Cross-site scripting in setucocms project:setucocms (medium 6.1)
- [CVE-2016-4891](https://insights.sbomify.com/CVE-2016-4891/): Cross-site request forgery in setucocms project:setucocms (high 8.8)
- [CVE-2016-4890](https://insights.sbomify.com/CVE-2016-4890/): Weak cryptography in zohocorp:servicedesk plus (medium 5.3)
- [CVE-2016-4889](https://insights.sbomify.com/CVE-2016-4889/): Missing authorization in zohocorp:servicedesk plus (high 8.8)
- [CVE-2016-4888](https://insights.sbomify.com/CVE-2016-4888/): Cross-site scripting in zohocorp:servicedesk plus (medium 5.4)
- [CVE-2016-4887](https://insights.sbomify.com/CVE-2016-4887/): Cross-site request forgery in baserCMS plugin Uploader (high 8.8)
- [CVE-2016-4886](https://insights.sbomify.com/CVE-2016-4886/): Cross-site request forgery in baserCMS plugin Mail (high 8.8)
- [CVE-2016-4885](https://insights.sbomify.com/CVE-2016-4885/): Cross-site request forgery in baserCMS plugin Feed (high 8.8)
- [CVE-2016-4884](https://insights.sbomify.com/CVE-2016-4884/): Cross-site request forgery in baserCMS plugin Blog (high 8.8)
- [CVE-2016-4883](https://insights.sbomify.com/CVE-2016-4883/): Cross-site scripting in baserCMS (medium 5.4)
- [CVE-2016-4882](https://insights.sbomify.com/CVE-2016-4882/): Cross-site request forgery in baserCMS (high 8.8)
- [CVE-2016-4881](https://insights.sbomify.com/CVE-2016-4881/): CSRF in baserCMS 3.0.10 and earlier (high 8.8)
- [CVE-2016-4880](https://insights.sbomify.com/CVE-2016-4880/): baserCMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2016-4879](https://insights.sbomify.com/CVE-2016-4879/): CSRF in baserCMS 3.0.10 and earlier (high 8.8)
- [CVE-2016-4878](https://insights.sbomify.com/CVE-2016-4878/): baserCMS Cross Site Request Forgery vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/39/