# Vulnerabilities published in 2016


- [CVE-2016-9599](https://insights.sbomify.com/CVE-2016-9599/): Missing authorization in puppet-tripleo (high 7.1)
- [CVE-2016-9598](https://insights.sbomify.com/CVE-2016-9598/): Denial of service in n/a (medium 6.5)
- [CVE-2016-9597](https://insights.sbomify.com/CVE-2016-9597/): Denial of service in libxml2 (high 7.5)
- [CVE-2016-9596](https://insights.sbomify.com/CVE-2016-9596/): Denial of service in n/a (medium 6.5)
- [CVE-2016-9595](https://insights.sbomify.com/CVE-2016-9595/): Path traversal in katello-debug (high 7.3)
- [CVE-2016-9594](https://insights.sbomify.com/CVE-2016-9594/): Weak cryptography in curl (medium 6.5)
- [CVE-2016-9593](https://insights.sbomify.com/CVE-2016-9593/): Information disclosure in foreman-debug (medium 4.7)
- [CVE-2016-9592](https://insights.sbomify.com/CVE-2016-9592/): Denial of service in openshift (medium 4.3)
- [CVE-2016-9591](https://insights.sbomify.com/CVE-2016-9591/): Use after free in jasper (medium 5.5)
- [CVE-2016-9590](https://insights.sbomify.com/CVE-2016-9590/): Information disclosure in puppet-swift (medium 6.5)
- [CVE-2016-9589](https://insights.sbomify.com/CVE-2016-9589/): Red Hat Wildfly DoS (high 7.5)
- [CVE-2016-9588](https://insights.sbomify.com/CVE-2016-9588/): Denial of service in n/a (medium 5.5)
- [CVE-2016-9587](https://insights.sbomify.com/CVE-2016-9587/): Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems (medium 6.6)
- [CVE-2016-9586](https://insights.sbomify.com/CVE-2016-9586/): Memory corruption in curl (medium 5.9)
- [CVE-2016-9585](https://insights.sbomify.com/CVE-2016-9585/): Deserialization in EAP-5 (medium 5.3)
- [CVE-2016-9584](https://insights.sbomify.com/CVE-2016-9584/): Use after free in n/a (critical 9.1)
- [CVE-2016-9583](https://insights.sbomify.com/CVE-2016-9583/): Memory corruption in jasper (medium 5.5)
- [CVE-2016-9581](https://insights.sbomify.com/CVE-2016-9581/): Memory corruption in openjpeg2 (low 3.3)
- [CVE-2016-9580](https://insights.sbomify.com/CVE-2016-9580/): Integer overflow in openjpeg2 (low 3.3)
- [CVE-2016-9579](https://insights.sbomify.com/CVE-2016-9579/): Denial of service in ceph (medium 6.5)
- [CVE-2016-9578](https://insights.sbomify.com/CVE-2016-9578/): Denial of service in spice (high 7.5)
- [CVE-2016-9577](https://insights.sbomify.com/CVE-2016-9577/): Memory corruption in spice (high 7.5)
- [CVE-2016-9576](https://insights.sbomify.com/CVE-2016-9576/): Use after free in n/a (high 7.8)
- [CVE-2016-9575](https://insights.sbomify.com/CVE-2016-9575/): Missing authorization in ipa (medium 6.3)
- [CVE-2016-9574](https://insights.sbomify.com/CVE-2016-9574/): Denial of service in nss (medium 5.9)
- [CVE-2016-9573](https://insights.sbomify.com/CVE-2016-9573/): Information disclosure in openjpeg (medium 6.5)
- [CVE-2016-9572](https://insights.sbomify.com/CVE-2016-9572/): Null dereference in openjpeg (medium 5.9)
- [CVE-2016-9570](https://insights.sbomify.com/CVE-2016-9570/): Null dereference in n/a (high 7.5)
- [CVE-2016-9569](https://insights.sbomify.com/CVE-2016-9569/): Denial of service in n/a (medium 4.4)
- [CVE-2016-9568](https://insights.sbomify.com/CVE-2016-9568/): Missing authorization in n/a (critical 9.8)
- [CVE-2016-9567](https://insights.sbomify.com/CVE-2016-9567/): Missing authorization in n/a (medium 5.5)
- [CVE-2016-9566](https://insights.sbomify.com/CVE-2016-9566/): Path traversal in n/a (high 7.8)
- [CVE-2016-9565](https://insights.sbomify.com/CVE-2016-9565/): Path traversal in n/a (critical 9.8)
- [CVE-2016-9564](https://insights.sbomify.com/CVE-2016-9564/): Denial of service in n/a (high 7.5)
- [CVE-2016-9563](https://insights.sbomify.com/CVE-2016-9563/): SAP NetWeaver XML External Entity (XXE) (medium 6.5, exploited in the wild)
- [CVE-2016-9562](https://insights.sbomify.com/CVE-2016-9562/): Null dereference in n/a (high 7.5)
- [CVE-2016-9561](https://insights.sbomify.com/CVE-2016-9561/): Denial of service in n/a (medium 5.5)
- [CVE-2016-9560](https://insights.sbomify.com/CVE-2016-9560/): Memory corruption in n/a (high 7.8)
- [CVE-2016-9559](https://insights.sbomify.com/CVE-2016-9559/): Null dereference in n/a (medium 6.5)
- [CVE-2016-9558](https://insights.sbomify.com/CVE-2016-9558/): Integer overflow in n/a (critical 9.8)
- [CVE-2016-9557](https://insights.sbomify.com/CVE-2016-9557/): Integer overflow in n/a (medium 5.5)
- [CVE-2016-9556](https://insights.sbomify.com/CVE-2016-9556/): Memory corruption in n/a (medium 5.5)
- [CVE-2016-9555](https://insights.sbomify.com/CVE-2016-9555/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9554](https://insights.sbomify.com/CVE-2016-9554/): Command injection in n/a (high 7.2)
- [CVE-2016-9553](https://insights.sbomify.com/CVE-2016-9553/): Command injection in n/a (high 7.2)
- [CVE-2016-9540](https://insights.sbomify.com/CVE-2016-9540/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9539](https://insights.sbomify.com/CVE-2016-9539/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9538](https://insights.sbomify.com/CVE-2016-9538/): Integer overflow in n/a (critical 9.8)
- [CVE-2016-9537](https://insights.sbomify.com/CVE-2016-9537/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9536](https://insights.sbomify.com/CVE-2016-9536/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9535](https://insights.sbomify.com/CVE-2016-9535/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9534](https://insights.sbomify.com/CVE-2016-9534/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9533](https://insights.sbomify.com/CVE-2016-9533/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-9532](https://insights.sbomify.com/CVE-2016-9532/): Integer overflow in n/a (medium 5.5)
- [CVE-2016-9500](https://insights.sbomify.com/CVE-2016-9500/): The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to informaiton exposure (medium 6.1)
- [CVE-2016-9499](https://insights.sbomify.com/CVE-2016-9499/): The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting. (medium 5.3)
- [CVE-2016-9498](https://insights.sbomify.com/CVE-2016-9498/): ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects (critical 9.8)
- [CVE-2016-9497](https://insights.sbomify.com/CVE-2016-9497/): Auth bypass in DW7000 (high 8.8)
- [CVE-2016-9496](https://insights.sbomify.com/CVE-2016-9496/): Missing authorization in DW7000 (medium 6.5)
- [CVE-2016-9495](https://insights.sbomify.com/CVE-2016-9495/): Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials (high 8.8)
- [CVE-2016-9494](https://insights.sbomify.com/CVE-2016-9494/): Denial of service in DW7000 (medium 6.5)
- [CVE-2016-9493](https://insights.sbomify.com/CVE-2016-9493/): PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting (medium 6.1)
- [CVE-2016-9492](https://insights.sbomify.com/CVE-2016-9492/): PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types (critical 9.8)
- [CVE-2016-9491](https://insights.sbomify.com/CVE-2016-9491/): XML external entity in Applications Manager (medium 4.9)
- [CVE-2016-9490](https://insights.sbomify.com/CVE-2016-9490/): ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerability (medium 6.1)
- [CVE-2016-9489](https://insights.sbomify.com/CVE-2016-9489/): ManageEngine Applications Manager 12 and 13 is vulnerable to privilege escalation and authentication bypass (high 8.8)
- [CVE-2016-9488](https://insights.sbomify.com/CVE-2016-9488/): ManageEngine Applications Manager versions 12 and 13 suffer from remote SQL injection vulnerabilities (critical 9.8)
- [CVE-2016-9487](https://insights.sbomify.com/CVE-2016-9487/): EpubCheck 4.0.1 is vulnerable to external XML entity processing attacks (high 7.8)
- [CVE-2016-9486](https://insights.sbomify.com/CVE-2016-9486/): Privilege escalation in Windows SecureConnector agent (high 7.8)
- [CVE-2016-9485](https://insights.sbomify.com/CVE-2016-9485/): Privilege escalation in Windows SecureConnector agent (high 7.8)
- [CVE-2016-9484](https://insights.sbomify.com/CVE-2016-9484/): Path traversal in Generator (high 7.5)
- [CVE-2016-9483](https://insights.sbomify.com/CVE-2016-9483/): Deserialization in Generator (critical 9.8)
- [CVE-2016-9482](https://insights.sbomify.com/CVE-2016-9482/): Auth bypass in Generator (critical 9.8)
- [CVE-2016-9481](https://insights.sbomify.com/CVE-2016-9481/): SQL injection in n/a (critical 9.8)
- [CVE-2016-9480](https://insights.sbomify.com/CVE-2016-9480/): Information disclosure in n/a (critical 9.1)
- [CVE-2016-9479](https://insights.sbomify.com/CVE-2016-9479/): Auth bypass in n/a (high 7.5)
- [CVE-2016-9473](https://insights.sbomify.com/CVE-2016-9473/): Cross-site scripting in Brave Software Brave Browser iOS before 1.2.18 and Brave Browser Android 1.9.56 and earlier (medium 4.7)
- [CVE-2016-9472](https://insights.sbomify.com/CVE-2016-9472/): Cross-site scripting in Revive Adserver All versions before 3.2.5 and 4.0.0 (medium 5.4)
- [CVE-2016-9471](https://insights.sbomify.com/CVE-2016-9471/): Other in Revive Adserver All versions before 3.2.5 and 4.0.0 (low 3.1)
- [CVE-2016-9470](https://insights.sbomify.com/CVE-2016-9470/): Other in Revive Adserver All versions before 3.2.5 and 4.0.0 (critical 9.0)
- [CVE-2016-9469](https://insights.sbomify.com/CVE-2016-9469/): Missing authorization in GitLab Community Edition & GitLab Enterprise Edition 8.13.0, 8.13.0-ee, 8.13.1, 8.13.1-ee, 8.13.2, 8.13.2-ee, 8.13.3, 8.13.3-ee, 8.13.4, 8.13.4-ee, 8.13.5, 8.13.5-ee, 8.13.6, 8.13.6-ee, 8.13.7, 8.14.0, 8.14.0-ee, 8.14.1 (high 8.2)
- [CVE-2016-9468](https://insights.sbomify.com/CVE-2016-9468/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 (medium 5.3)
- [CVE-2016-9467](https://insights.sbomify.com/CVE-2016-9467/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 (medium 5.3)
- [CVE-2016-9466](https://insights.sbomify.com/CVE-2016-9466/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 (medium 6.1)
- [CVE-2016-9465](https://insights.sbomify.com/CVE-2016-9465/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 (medium 5.4)
- [CVE-2016-9464](https://insights.sbomify.com/CVE-2016-9464/): Missing authorization in Nextcloud Server Nextcloud Server before 9.0.54 and 10.0.0 (medium 4.3)
- [CVE-2016-9463](https://insights.sbomify.com/CVE-2016-9463/): Auth bypass in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 (high 8.1)
- [CVE-2016-9462](https://insights.sbomify.com/CVE-2016-9462/): Missing authorization in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 (medium 4.3)
- [CVE-2016-9461](https://insights.sbomify.com/CVE-2016-9461/): Missing authorization in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 (medium 4.3)
- [CVE-2016-9460](https://insights.sbomify.com/CVE-2016-9460/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 (medium 5.3)
- [CVE-2016-9459](https://insights.sbomify.com/CVE-2016-9459/): Cross-site scripting in Nextcloud Server & ownCloud Server Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 (medium 6.1)
- [CVE-2016-9457](https://insights.sbomify.com/CVE-2016-9457/): Cross-site scripting in Revive Adserver All versions before 3.2.3 (medium 5.4)
- [CVE-2016-9456](https://insights.sbomify.com/CVE-2016-9456/): Cross-site request forgery in Revive Adserver All versions before 3.2.3 (high 8.8)
- [CVE-2016-9455](https://insights.sbomify.com/CVE-2016-9455/): Cross-site request forgery in Revive Adserver All versions before 3.2.3 (high 8.8)
- [CVE-2016-9454](https://insights.sbomify.com/CVE-2016-9454/): Cross-site scripting in Revive Adserver All versions before 3.2.3 (medium 5.4)
- [CVE-2016-9453](https://insights.sbomify.com/CVE-2016-9453/): Memory corruption in n/a (high 7.8)
- [CVE-2016-9452](https://insights.sbomify.com/CVE-2016-9452/): Drupal Denial of service via transliterate mechanism (medium 6.5)
- [CVE-2016-9451](https://insights.sbomify.com/CVE-2016-9451/): Drupal Open Redirect (medium 6.8)
- [CVE-2016-9450](https://insights.sbomify.com/CVE-2016-9450/): Drupal Incorrect cache context on password reset page (high 7.5)
- [CVE-2016-9449](https://insights.sbomify.com/CVE-2016-9449/): Drupal sensitive information disclosure (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/4/