# Vulnerabilities published in 2016


- [CVE-2016-4444](https://insights.sbomify.com/CVE-2016-4444/): Command injection in redhat:enterprise linux desktop (high 7.0)
- [CVE-2016-4443](https://insights.sbomify.com/CVE-2016-4443/): Information disclosure in redhat:enterprise virtualization (medium 5.5)
- [CVE-2016-4442](https://insights.sbomify.com/CVE-2016-4442/): rack-mini-profiler allows remote attackers to obtain sensitive information about allocated strings and objects (medium 5.3)
- [CVE-2016-4441](https://insights.sbomify.com/CVE-2016-4441/): Memory corruption in canonical:ubuntu linux (medium 6.0)
- [CVE-2016-4440](https://insights.sbomify.com/CVE-2016-4440/): Privilege escalation in linux:linux kernel (high 7.8)
- [CVE-2016-4439](https://insights.sbomify.com/CVE-2016-4439/): Memory corruption in canonical:ubuntu linux (medium 6.7)
- [CVE-2016-4438](https://insights.sbomify.com/CVE-2016-4438/): Arbitrary code execution in Apache Struts 2 (critical 9.8)
- [CVE-2016-4437](https://insights.sbomify.com/CVE-2016-4437/): Apache Shiro Code Execution (critical 9.8, exploited in the wild)
- [CVE-2016-4436](https://insights.sbomify.com/CVE-2016-4436/): Apache Struts improper action name cleanup (critical 9.8)
- [CVE-2016-4435](https://insights.sbomify.com/CVE-2016-4435/): Missing authorization in Cloud Foundry (critical 9.0)
- [CVE-2016-4434](https://insights.sbomify.com/CVE-2016-4434/): Apache Tika does not properly initialize the XML parser or choose handlers (high 7.8)
- [CVE-2016-4433](https://insights.sbomify.com/CVE-2016-4433/): Apache Struts Open Redirect (high 7.5)
- [CVE-2016-4432](https://insights.sbomify.com/CVE-2016-4432/): AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication (critical 9.1)
- [CVE-2016-4431](https://insights.sbomify.com/CVE-2016-4431/): Apache Struts Access Control Redirect (high 7.5)
- [CVE-2016-4430](https://insights.sbomify.com/CVE-2016-4430/): Apache Struts CSRF Vulnerability (high 8.8)
- [CVE-2016-4429](https://insights.sbomify.com/CVE-2016-4429/): Memory corruption in canonical:ubuntu linux (medium 5.9)
- [CVE-2016-4428](https://insights.sbomify.com/CVE-2016-4428/): OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability (medium 5.4)
- [CVE-2016-4427](https://insights.sbomify.com/CVE-2016-4427/): Missing authorization in zulip (high 7.5)
- [CVE-2016-4426](https://insights.sbomify.com/CVE-2016-4426/): Information disclosure in zulip (medium 4.3)
- [CVE-2016-4425](https://insights.sbomify.com/CVE-2016-4425/): Denial of service in jansson project:jansson (medium 6.5)
- [CVE-2016-4423](https://insights.sbomify.com/CVE-2016-4423/): Symphony Denial of Service Via Overlong Usernames (high 7.5)
- [CVE-2016-4422](https://insights.sbomify.com/CVE-2016-4422/): Auth bypass in debian:debian linux (critical 9.8)
- [CVE-2016-4421](https://insights.sbomify.com/CVE-2016-4421/): Denial of service in wireshark:wireshark (medium 5.9)
- [CVE-2016-4420](https://insights.sbomify.com/CVE-2016-4420/): Denial of service in wireshark:wireshark (medium 5.9)
- [CVE-2016-4419](https://insights.sbomify.com/CVE-2016-4419/): Denial of service in wireshark:wireshark (medium 5.9)
- [CVE-2016-4418](https://insights.sbomify.com/CVE-2016-4418/): Memory corruption in wireshark:wireshark (medium 5.9)
- [CVE-2016-4417](https://insights.sbomify.com/CVE-2016-4417/): Memory corruption in wireshark:wireshark (medium 5.9)
- [CVE-2016-4416](https://insights.sbomify.com/CVE-2016-4416/): Memory corruption in wireshark:wireshark (medium 5.9)
- [CVE-2016-4415](https://insights.sbomify.com/CVE-2016-4415/): Memory corruption in wireshark:wireshark (medium 5.9)
- [CVE-2016-4414](https://insights.sbomify.com/CVE-2016-4414/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2016-4412](https://insights.sbomify.com/CVE-2016-4412/): Open redirect in phpmyadmin:phpmyadmin (medium 4.4)
- [CVE-2016-4407](https://insights.sbomify.com/CVE-2016-4407/): Weak cryptography in sap:sapcryptolib (medium 6.5)
- [CVE-2016-4406](https://insights.sbomify.com/CVE-2016-4406/): Cross-site scripting in HP Integrated Lights-Out 3 (iLO 3), HPE Integrated Lights-Out 4 (iLO 4) (medium 6.1)
- [CVE-2016-4405](https://insights.sbomify.com/CVE-2016-4405/): Deserialization in HP Business Service Manager (high 8.8)
- [CVE-2016-4404](https://insights.sbomify.com/CVE-2016-4404/): Memory corruption in HP Keyview (critical 9.8)
- [CVE-2016-4403](https://insights.sbomify.com/CVE-2016-4403/): Memory corruption in HP Keyview (critical 9.8)
- [CVE-2016-4402](https://insights.sbomify.com/CVE-2016-4402/): Memory corruption in HP Keyview (critical 9.8)
- [CVE-2016-4401](https://insights.sbomify.com/CVE-2016-4401/): Information disclosure in arubanetworks:clearpass (critical 9.8)
- [CVE-2016-4400](https://insights.sbomify.com/CVE-2016-4400/): Cross-site scripting in HP Network Node Manager (NNMi) (medium 5.4)
- [CVE-2016-4399](https://insights.sbomify.com/CVE-2016-4399/): Cross-site scripting in HP Network Node Manager (NNMi) (medium 5.4)
- [CVE-2016-4398](https://insights.sbomify.com/CVE-2016-4398/): Deserialization in HP Network Node Manager (NNMi) (high 8.8)
- [CVE-2016-4397](https://insights.sbomify.com/CVE-2016-4397/): Code injection in HP Network Node Manager (NNMi) (high 7.8)
- [CVE-2016-4396](https://insights.sbomify.com/CVE-2016-4396/): Memory corruption in HPE System Management Homepage before v7.6 (high 7.5)
- [CVE-2016-4395](https://insights.sbomify.com/CVE-2016-4395/): Memory corruption in HPE System Management Homepage before v7.6 (high 7.5)
- [CVE-2016-4394](https://insights.sbomify.com/CVE-2016-4394/): Information disclosure in HPE System Management Homepage before v7.6 (medium 6.5)
- [CVE-2016-4393](https://insights.sbomify.com/CVE-2016-4393/): Cross-site scripting in HPE System Management Homepage before v7.6 (medium 5.4)
- [CVE-2016-4392](https://insights.sbomify.com/CVE-2016-4392/): Cross-site scripting in HP Business Service Manager (medium 5.4)
- [CVE-2016-4391](https://insights.sbomify.com/CVE-2016-4391/): Code injection in HP ArcSight WINC Connector (critical 9.8)
- [CVE-2016-4390](https://insights.sbomify.com/CVE-2016-4390/): Other in hp:keyview (high 8.1)
- [CVE-2016-4389](https://insights.sbomify.com/CVE-2016-4389/): Other in hp:keyview (high 8.1)
- [CVE-2016-4388](https://insights.sbomify.com/CVE-2016-4388/): Other in hp:keyview (high 8.1)
- [CVE-2016-4387](https://insights.sbomify.com/CVE-2016-4387/): Other in hp:keyview (high 8.1)
- [CVE-2016-4386](https://insights.sbomify.com/CVE-2016-4386/): Other in hp:network automation (high 7.8)
- [CVE-2016-4385](https://insights.sbomify.com/CVE-2016-4385/): Deserialization in hp:network automation (high 7.3)
- [CVE-2016-4384](https://insights.sbomify.com/CVE-2016-4384/): Denial of service in hp:loadrunner (high 8.6)
- [CVE-2016-4383](https://insights.sbomify.com/CVE-2016-4383/): Business logic in hp:helion openstack glance (high 8.4)
- [CVE-2016-4382](https://insights.sbomify.com/CVE-2016-4382/): Auth bypass in hp:performance center (high 8.3)
- [CVE-2016-4381](https://insights.sbomify.com/CVE-2016-4381/): Security feature bypass in hp:xp7 command view (medium 4.5)
- [CVE-2016-4380](https://insights.sbomify.com/CVE-2016-4380/): Cross-site scripting in hp:operations manager (medium 5.4)
- [CVE-2016-4379](https://insights.sbomify.com/CVE-2016-4379/): Weak cryptography in hp:integrated lights-out 3 firmware (low 3.7)
- [CVE-2016-4378](https://insights.sbomify.com/CVE-2016-4378/): Information disclosure in hp:xp7 command view (high 7.5)
- [CVE-2016-4377](https://insights.sbomify.com/CVE-2016-4377/): Other in hp:converged infrastructure solution sizer suite (high 8.1)
- [CVE-2016-4376](https://insights.sbomify.com/CVE-2016-4376/): Information disclosure in broadcom:fabric operating system (medium 6.5)
- [CVE-2016-4375](https://insights.sbomify.com/CVE-2016-4375/): Other in hp:integrated lights-out 3 firmware (critical 9.8)
- [CVE-2016-4374](https://insights.sbomify.com/CVE-2016-4374/): Server-side request forgery in hp:release control (high 7.7)
- [CVE-2016-4373](https://insights.sbomify.com/CVE-2016-4373/): Deserialization in hp:operations manager (critical 9.8)
- [CVE-2016-4372](https://insights.sbomify.com/CVE-2016-4372/): Deserialization in hp:intelligent management center application performance manager (critical 9.8)
- [CVE-2016-4371](https://insights.sbomify.com/CVE-2016-4371/): Cross-site request forgery in hp:service manager (high 8.0)
- [CVE-2016-4370](https://insights.sbomify.com/CVE-2016-4370/): Command injection in hpe:project and portfolio management center (high 8.8)
- [CVE-2016-4369](https://insights.sbomify.com/CVE-2016-4369/): Deserialization in hp:discovery and dependency mapping inventory (high 8.8)
- [CVE-2016-4368](https://insights.sbomify.com/CVE-2016-4368/): Deserialization in hp:universal cmbd configuration manager (critical 9.8)
- [CVE-2016-4367](https://insights.sbomify.com/CVE-2016-4367/): Information disclosure in hp:universal cmbd foundation (high 7.5)
- [CVE-2016-4366](https://insights.sbomify.com/CVE-2016-4366/): Other in hp:systems insight manager (critical 9.8)
- [CVE-2016-4365](https://insights.sbomify.com/CVE-2016-4365/): Information disclosure in hp:insight control server deployment (high 7.5)
- [CVE-2016-4364](https://insights.sbomify.com/CVE-2016-4364/): Privilege escalation in hp:insight control server deployment (high 8.4)
- [CVE-2016-4363](https://insights.sbomify.com/CVE-2016-4363/): Cross-site scripting in hp:insight control server deployment (medium 6.1)
- [CVE-2016-4362](https://insights.sbomify.com/CVE-2016-4362/): Other in hp:insight control server deployment (high 8.1)
- [CVE-2016-4361](https://insights.sbomify.com/CVE-2016-4361/): Denial of service in hp:loadrunner (high 7.5)
- [CVE-2016-4360](https://insights.sbomify.com/CVE-2016-4360/): Path traversal in hp:loadrunner (critical 9.1)
- [CVE-2016-4359](https://insights.sbomify.com/CVE-2016-4359/): Memory corruption in hp:loadrunner (critical 9.8)
- [CVE-2016-4358](https://insights.sbomify.com/CVE-2016-4358/): Other in hp:matrix operating environment (high 8.1)
- [CVE-2016-4357](https://insights.sbomify.com/CVE-2016-4357/): Other in hp:matrix operating environment (high 8.1)
- [CVE-2016-4356](https://insights.sbomify.com/CVE-2016-4356/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2016-4355](https://insights.sbomify.com/CVE-2016-4355/): Integer overflow in canonical:ubuntu linux (high 7.5)
- [CVE-2016-4354](https://insights.sbomify.com/CVE-2016-4354/): Integer overflow in canonical:ubuntu linux (high 7.5)
- [CVE-2016-4353](https://insights.sbomify.com/CVE-2016-4353/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2016-4352](https://insights.sbomify.com/CVE-2016-4352/): Integer overflow in libavformat project:libavformat (medium 5.5)
- [CVE-2016-4351](https://insights.sbomify.com/CVE-2016-4351/): SQL injection in trendmicro:email encryption gateway (critical 9.8)
- [CVE-2016-4350](https://insights.sbomify.com/CVE-2016-4350/): SQL injection in solarwinds:storage resource monitor (critical 9.8)
- [CVE-2016-4349](https://insights.sbomify.com/CVE-2016-4349/): Other in cisco:webex productivity tools (high 7.8)
- [CVE-2016-4348](https://insights.sbomify.com/CVE-2016-4348/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2016-4346](https://insights.sbomify.com/CVE-2016-4346/): Integer overflow in opensuse:leap (critical 9.8)
- [CVE-2016-4345](https://insights.sbomify.com/CVE-2016-4345/): Integer overflow in php:php (critical 9.8)
- [CVE-2016-4344](https://insights.sbomify.com/CVE-2016-4344/): Integer overflow in php:php (critical 9.8)
- [CVE-2016-4343](https://insights.sbomify.com/CVE-2016-4343/): Memory corruption in opensuse:opensuse (high 8.8)
- [CVE-2016-4342](https://insights.sbomify.com/CVE-2016-4342/): Memory corruption in opensuse:leap (high 8.8)
- [CVE-2016-4341](https://insights.sbomify.com/CVE-2016-4341/): Information disclosure in netapp:clustered data ontap (high 7.5)
- [CVE-2016-4340](https://insights.sbomify.com/CVE-2016-4340/): Auth bypass in gitlab:gitlab (high 8.8)
- [CVE-2016-4338](https://insights.sbomify.com/CVE-2016-4338/): Command injection in zabbix:zabbix (high 8.1)
- [CVE-2016-4337](https://insights.sbomify.com/CVE-2016-4337/): SQL injection in ktools:photostore (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/44/