# Vulnerabilities published in 2016


- [CVE-2016-4877](https://insights.sbomify.com/CVE-2016-4877/): Cross-site scripting in baserCMS plugin Mail (medium 5.4)
- [CVE-2016-4876](https://insights.sbomify.com/CVE-2016-4876/): Cross-site request forgery in baserCMS (high 8.8)
- [CVE-2016-4875](https://insights.sbomify.com/CVE-2016-4875/): Cross-site scripting in assist project:assist plugin (medium 6.1)
- [CVE-2016-4874](https://insights.sbomify.com/CVE-2016-4874/): Other in cybozu:office (low 3.5)
- [CVE-2016-4873](https://insights.sbomify.com/CVE-2016-4873/): Missing authorization in cybozu:office (medium 4.3)
- [CVE-2016-4872](https://insights.sbomify.com/CVE-2016-4872/): Missing authorization in cybozu:office (medium 4.3)
- [CVE-2016-4871](https://insights.sbomify.com/CVE-2016-4871/): Denial of service in cybozu:office (medium 6.5)
- [CVE-2016-4870](https://insights.sbomify.com/CVE-2016-4870/): Cross-site scripting in cybozu:office (medium 5.4)
- [CVE-2016-4869](https://insights.sbomify.com/CVE-2016-4869/): Information disclosure in cybozu:office (medium 6.5)
- [CVE-2016-4868](https://insights.sbomify.com/CVE-2016-4868/): Other in cybozu:office (medium 4.3)
- [CVE-2016-4867](https://insights.sbomify.com/CVE-2016-4867/): Missing authorization in cybozu:office (medium 4.3)
- [CVE-2016-4866](https://insights.sbomify.com/CVE-2016-4866/): Cross-site scripting in cybozu:office (medium 4.8)
- [CVE-2016-4865](https://insights.sbomify.com/CVE-2016-4865/): Cross-site scripting in cybozu:office (medium 4.8)
- [CVE-2016-4864](https://insights.sbomify.com/CVE-2016-4864/): Denial of service in H2O (high 7.5)
- [CVE-2016-4863](https://insights.sbomify.com/CVE-2016-4863/): Auth bypass in FlashAir Class 6 model (medium 4.3)
- [CVE-2016-4862](https://insights.sbomify.com/CVE-2016-4862/): Code injection in cs-cart:cs-cart (high 8.8)
- [CVE-2016-4861](https://insights.sbomify.com/CVE-2016-4861/): Zend Framework Allows SQL Injection (critical 9.8)
- [CVE-2016-4860](https://insights.sbomify.com/CVE-2016-4860/): Auth bypass in yokogawa:stardom fcn\/fcj (high 7.3)
- [CVE-2016-4859](https://insights.sbomify.com/CVE-2016-4859/): Open redirect in Splunk Enterprise (medium 6.1)
- [CVE-2016-4858](https://insights.sbomify.com/CVE-2016-4858/): Cross-site scripting in Splunk Enterprise (medium 4.8)
- [CVE-2016-4857](https://insights.sbomify.com/CVE-2016-4857/): Open redirect in Splunk Enterprise (medium 6.1)
- [CVE-2016-4856](https://insights.sbomify.com/CVE-2016-4856/): Cross-site scripting in Splunk Enterprise (medium 4.8)
- [CVE-2016-4855](https://insights.sbomify.com/CVE-2016-4855/): ADOdb Cross-site scripting vulnerability in old test script (medium 6.1)
- [CVE-2016-4854](https://insights.sbomify.com/CVE-2016-4854/): Cross-site request forgery in L-04D (high 8.8)
- [CVE-2016-4853](https://insights.sbomify.com/CVE-2016-4853/): Command injection in akabei soft2:happy wardrobe (high 7.8)
- [CVE-2016-4852](https://insights.sbomify.com/CVE-2016-4852/): Denial of service in aki-null:yorufukurou (medium 6.5)
- [CVE-2016-4851](https://insights.sbomify.com/CVE-2016-4851/): Cross-site scripting in let\'s php\!:simple chat (medium 6.1)
- [CVE-2016-4850](https://insights.sbomify.com/CVE-2016-4850/): Other in linecorp:line (high 8.1)
- [CVE-2016-4849](https://insights.sbomify.com/CVE-2016-4849/): Cross-site scripting in geeklog project:geeklog (medium 6.1)
- [CVE-2016-4848](https://insights.sbomify.com/CVE-2016-4848/): Cross-site scripting in clip-bucket:clipbucket (medium 6.1)
- [CVE-2016-4847](https://insights.sbomify.com/CVE-2016-4847/): Cross-site scripting in ossec:web ui (medium 6.1)
- [CVE-2016-4846](https://insights.sbomify.com/CVE-2016-4846/): Other in securebrain:phishwall client (high 7.8)
- [CVE-2016-4845](https://insights.sbomify.com/CVE-2016-4845/): Cross-site request forgery in iodata:hvl-a2.0 firmware (high 8.8)
- [CVE-2016-4844](https://insights.sbomify.com/CVE-2016-4844/): Other in cybozu:mailwise (medium 4.3)
- [CVE-2016-4843](https://insights.sbomify.com/CVE-2016-4843/): Information disclosure in cybozu:mailwise (medium 6.5)
- [CVE-2016-4842](https://insights.sbomify.com/CVE-2016-4842/): Information disclosure in cybozu:mailwise (medium 4.3)
- [CVE-2016-4841](https://insights.sbomify.com/CVE-2016-4841/): Other in cybozu:mailwise (medium 4.3)
- [CVE-2016-4840](https://insights.sbomify.com/CVE-2016-4840/): Security feature bypass in toshiba:coordinate plus (medium 5.9)
- [CVE-2016-4839](https://insights.sbomify.com/CVE-2016-4839/): Information disclosure in Money Forward (medium 5.5)
- [CVE-2016-4838](https://insights.sbomify.com/CVE-2016-4838/): Other in Money Forward (high 7.8)
- [CVE-2016-4837](https://insights.sbomify.com/CVE-2016-4837/): SQL injection in ec-cube:discount coupon (critical 9.8)
- [CVE-2016-4834](https://insights.sbomify.com/CVE-2016-4834/): Missing authorization in vtiger:vtiger crm (high 8.1)
- [CVE-2016-4833](https://insights.sbomify.com/CVE-2016-4833/): Cross-site scripting in nofollow links project:nofollow links (medium 6.1)
- [CVE-2016-4832](https://insights.sbomify.com/CVE-2016-4832/): Security feature bypass in aeon:waon (medium 5.9)
- [CVE-2016-4831](https://insights.sbomify.com/CVE-2016-4831/): Privilege escalation in linecorp:line (high 7.8)
- [CVE-2016-4830](https://insights.sbomify.com/CVE-2016-4830/): Security feature bypass in akindo-sushiro:sushiro (medium 5.9)
- [CVE-2016-4829](https://insights.sbomify.com/CVE-2016-4829/): Security feature bypass in dmm:ppv play player (medium 5.9)
- [CVE-2016-4828](https://insights.sbomify.com/CVE-2016-4828/): Auth bypass in welcart:welcart e-commerce (medium 6.5)
- [CVE-2016-4827](https://insights.sbomify.com/CVE-2016-4827/): Cross-site scripting in welcart:welcart e-commerce (medium 6.1)
- [CVE-2016-4826](https://insights.sbomify.com/CVE-2016-4826/): Cross-site scripting in welcart:welcart e-commerce (medium 6.1)
- [CVE-2016-4825](https://insights.sbomify.com/CVE-2016-4825/): Deserialization in welcart:welcart e-commerce (medium 5.6)
- [CVE-2016-4824](https://insights.sbomify.com/CVE-2016-4824/): Auth bypass in corega:cg-wlr300gnv-w firmware (medium 5.3)
- [CVE-2016-4823](https://insights.sbomify.com/CVE-2016-4823/): Denial of service in corega:cg-wlbaragm firmware (high 7.5)
- [CVE-2016-4822](https://insights.sbomify.com/CVE-2016-4822/): Command injection in corega:cg-wlbargl firmware (high 8.0)
- [CVE-2016-4821](https://insights.sbomify.com/CVE-2016-4821/): Denial of service in iodata:etx-r firmware (medium 5.3)
- [CVE-2016-4820](https://insights.sbomify.com/CVE-2016-4820/): Cross-site request forgery in iodata:etx-r firmware (high 8.8)
- [CVE-2016-4819](https://insights.sbomify.com/CVE-2016-4819/): Memory corruption in dx library project:dx library (critical 9.8)
- [CVE-2016-4818](https://insights.sbomify.com/CVE-2016-4818/): Security feature bypass in dmm:dmmfx demo trade (medium 5.9)
- [CVE-2016-4817](https://insights.sbomify.com/CVE-2016-4817/): Use after free in dena:h2o (high 7.5)
- [CVE-2016-4816](https://insights.sbomify.com/CVE-2016-4816/): Information disclosure in buffalo:bhr-4grv firmware (medium 6.5)
- [CVE-2016-4815](https://insights.sbomify.com/CVE-2016-4815/): Path traversal in buffalo:wzr-600dhp2 firmware (high 7.5)
- [CVE-2016-4814](https://insights.sbomify.com/CVE-2016-4814/): Path traversal in gsi:old gsi maps (high 7.5)
- [CVE-2016-4813](https://insights.sbomify.com/CVE-2016-4813/): Privilege escalation in netcommons:netcommons (high 8.8)
- [CVE-2016-4812](https://insights.sbomify.com/CVE-2016-4812/): Cross-site scripting in markdown on saved improved project:markdown on saved improved (medium 6.1)
- [CVE-2016-4811](https://insights.sbomify.com/CVE-2016-4811/): Security feature bypass in ntt-bp:japan connected-free wi-fi (medium 5.6)
- [CVE-2016-4810](https://insights.sbomify.com/CVE-2016-4810/): Missing authorization in citrix:xenapp (high 7.5)
- [CVE-2016-4809](https://insights.sbomify.com/CVE-2016-4809/): Denial of service in libarchive:libarchive (high 7.5)
- [CVE-2016-4808](https://insights.sbomify.com/CVE-2016-4808/): Web2py Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2016-4807](https://insights.sbomify.com/CVE-2016-4807/): Web2py Reflected XSS vulnerability (medium 4.8)
- [CVE-2016-4806](https://insights.sbomify.com/CVE-2016-4806/): Path traversal in web2py:web2py (high 7.5)
- [CVE-2016-4805](https://insights.sbomify.com/CVE-2016-4805/): Use after free in canonical:ubuntu linux (high 7.8)
- [CVE-2016-4804](https://insights.sbomify.com/CVE-2016-4804/): Memory corruption in canonical:ubuntu linux (medium 6.2)
- [CVE-2016-4803](https://insights.sbomify.com/CVE-2016-4803/): Other in dotcms:dotcms (high 7.5)
- [CVE-2016-4802](https://insights.sbomify.com/CVE-2016-4802/): Other in haxx:curl (high 7.8)
- [CVE-2016-4800](https://insights.sbomify.com/CVE-2016-4800/): Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request (critical 9.8)
- [CVE-2016-4797](https://insights.sbomify.com/CVE-2016-4797/): Denial of service in fedoraproject:fedora (medium 5.5)
- [CVE-2016-4796](https://insights.sbomify.com/CVE-2016-4796/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2016-4794](https://insights.sbomify.com/CVE-2016-4794/): Use after free in canonical:ubuntu linux (high 7.8)
- [CVE-2016-4793](https://insights.sbomify.com/CVE-2016-4793/): CakePHP allows remote attackers to spoof their IP (high 7.5)
- [CVE-2016-4792](https://insights.sbomify.com/CVE-2016-4792/): Information disclosure in ivanti:connect secure (medium 5.3)
- [CVE-2016-4791](https://insights.sbomify.com/CVE-2016-4791/): Path traversal in ivanti:connect secure (high 8.6)
- [CVE-2016-4790](https://insights.sbomify.com/CVE-2016-4790/): Cross-site scripting in ivanti:connect secure (medium 5.5)
- [CVE-2016-4789](https://insights.sbomify.com/CVE-2016-4789/): Cross-site scripting in ivanti:connect secure (medium 6.1)
- [CVE-2016-4788](https://insights.sbomify.com/CVE-2016-4788/): Information disclosure in ivanti:connect secure (medium 5.8)
- [CVE-2016-4787](https://insights.sbomify.com/CVE-2016-4787/): Information disclosure in ivanti:connect secure (critical 10.0)
- [CVE-2016-4786](https://insights.sbomify.com/CVE-2016-4786/): Denial of service in ivanti:connect secure (high 7.5)
- [CVE-2016-4785](https://insights.sbomify.com/CVE-2016-4785/): Information disclosure in siemens:siprotec firmware (medium 5.3)
- [CVE-2016-4784](https://insights.sbomify.com/CVE-2016-4784/): Information disclosure in siemens:siprotec firmware (medium 5.3)
- [CVE-2016-4783](https://insights.sbomify.com/CVE-2016-4783/): Cross-site scripting in lenovo:shareit (medium 6.1)
- [CVE-2016-4782](https://insights.sbomify.com/CVE-2016-4782/): Other in lenovo:shareit (high 8.8)
- [CVE-2016-4781](https://insights.sbomify.com/CVE-2016-4781/): Security feature bypass in apple:iphone os (medium 6.8)
- [CVE-2016-4780](https://insights.sbomify.com/CVE-2016-4780/): Null dereference in apple:mac os x (high 7.8)
- [CVE-2016-4779](https://insights.sbomify.com/CVE-2016-4779/): Memory corruption in apple:mac os x (high 7.8)
- [CVE-2016-4778](https://insights.sbomify.com/CVE-2016-4778/): Memory corruption in apple:iphone os (high 7.8)
- [CVE-2016-4777](https://insights.sbomify.com/CVE-2016-4777/): Null dereference in apple:iphone os (high 7.8)
- [CVE-2016-4776](https://insights.sbomify.com/CVE-2016-4776/): Memory corruption in apple:iphone os (high 7.1)
- [CVE-2016-4775](https://insights.sbomify.com/CVE-2016-4775/): Memory corruption in apple:mac os x (high 7.8)
- [CVE-2016-4774](https://insights.sbomify.com/CVE-2016-4774/): Memory corruption in apple:iphone os (high 7.1)
- [CVE-2016-4773](https://insights.sbomify.com/CVE-2016-4773/): Memory corruption in apple:iphone os (high 7.1)
- [CVE-2016-4772](https://insights.sbomify.com/CVE-2016-4772/): Denial of service in apple:iphone os (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/40/