# Vulnerabilities published in 2016


- [CVE-2016-20083](https://insights.sbomify.com/CVE-2016-20083/): WordPress More Fields Plugin 2.1 Cross-Site Request Forgery (medium 6.9)
- [CVE-2016-20082](https://insights.sbomify.com/CVE-2016-20082/): WordPress Plugin Abtest Local File Inclusion via abtest_admin.php (medium 6.9)
- [CVE-2016-20081](https://insights.sbomify.com/CVE-2016-20081/): WordPress Plugin HB Audio Gallery Lite 1.0.0 Path Traversal File Download (high 8.7)
- [CVE-2016-20080](https://insights.sbomify.com/CVE-2016-20080/): WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php (medium 6.9)
- [CVE-2016-2008](https://insights.sbomify.com/CVE-2016-2008/): Other in hp:data protector (critical 9.8)
- [CVE-2016-20079](https://insights.sbomify.com/CVE-2016-20079/): WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php (medium 6.9)
- [CVE-2016-20078](https://insights.sbomify.com/CVE-2016-20078/): WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php (medium 6.9)
- [CVE-2016-20077](https://insights.sbomify.com/CVE-2016-20077/): WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php (medium 6.9)
- [CVE-2016-20076](https://insights.sbomify.com/CVE-2016-20076/): WordPress Simple-Backup 2.7.11 Arbitrary File Deletion and Download (high 8.7)
- [CVE-2016-20075](https://insights.sbomify.com/CVE-2016-20075/): WordPress Ultimate Product Catalog 3.8.6 Arbitrary File Upload RCE (high 8.7)
- [CVE-2016-20074](https://insights.sbomify.com/CVE-2016-20074/): WordPress Lazy Content Slider Plugin 3.4 CSRF (medium 5.3)
- [CVE-2016-20073](https://insights.sbomify.com/CVE-2016-20073/): Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php (high 8.8)
- [CVE-2016-20072](https://insights.sbomify.com/CVE-2016-20072/): BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid (high 8.8)
- [CVE-2016-20071](https://insights.sbomify.com/CVE-2016-20071/): WordPress 404 Redirection Manager Plugin 1.0 SQL Injection (high 8.8)
- [CVE-2016-20070](https://insights.sbomify.com/CVE-2016-20070/): WordPress Booking Calendar Contact Form 1.0.23 Privilege Escalation Stored XSS (medium 5.1)
- [CVE-2016-2007](https://insights.sbomify.com/CVE-2016-2007/): Other in hp:data protector (critical 9.8)
- [CVE-2016-20069](https://insights.sbomify.com/CVE-2016-20069/): WordPress Booking Calendar Contact Form 1.0.23 SQL Injection (high 8.8)
- [CVE-2016-20068](https://insights.sbomify.com/CVE-2016-20068/): WordPress Booking Calendar Contact Form 1.0.23 SQL Injection (high 8.8)
- [CVE-2016-20067](https://insights.sbomify.com/CVE-2016-20067/): WordPress CP Polls 1.0.8 Cross-Site Request Forgery (medium 5.3)
- [CVE-2016-20066](https://insights.sbomify.com/CVE-2016-20066/): WordPress CP Polls 1.0.8 Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2016-20065](https://insights.sbomify.com/CVE-2016-20065/): Product Catalog 8 1.2 Plugin WordPress SQL Injection (high 8.8)
- [CVE-2016-20064](https://insights.sbomify.com/CVE-2016-20064/): WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter (medium 6.9)
- [CVE-2016-20063](https://insights.sbomify.com/CVE-2016-20063/): Single Personal Message 1.0.3 WordPress Plugin SQL Injection (high 7.1)
- [CVE-2016-20062](https://insights.sbomify.com/CVE-2016-20062/): Simply Poll 1.4.1 Plugin for WordPress SQL Injection (high 8.8)
- [CVE-2016-20061](https://insights.sbomify.com/CVE-2016-20061/): sheed AntiVirus 2.3 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20060](https://insights.sbomify.com/CVE-2016-20060/): Hotspot Shield 6.0.3 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-2006](https://insights.sbomify.com/CVE-2016-2006/): Other in hp:data protector (critical 9.8)
- [CVE-2016-20059](https://insights.sbomify.com/CVE-2016-20059/): IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20058](https://insights.sbomify.com/CVE-2016-20058/): Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20057](https://insights.sbomify.com/CVE-2016-20057/): NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20056](https://insights.sbomify.com/CVE-2016-20056/): Spy Emergency build 23.0.205 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20055](https://insights.sbomify.com/CVE-2016-20055/): IObit Advanced SystemCare 10.0.2 Unquoted Service Path Privilege Escalation (high 8.5)
- [CVE-2016-20054](https://insights.sbomify.com/CVE-2016-20054/): Nodcms Cross Site Request Forgery via admin endpoints (medium 5.3)
- [CVE-2016-20053](https://insights.sbomify.com/CVE-2016-20053/): Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint (medium 6.9)
- [CVE-2016-20052](https://insights.sbomify.com/CVE-2016-20052/): Snews CMS 1.7 Unrestricted File Upload via snews_files (critical 9.3)
- [CVE-2016-20051](https://insights.sbomify.com/CVE-2016-20051/): Snews CMS 1.7 Cross-Site Request Forgery via changeup (medium 6.9)
- [CVE-2016-20050](https://insights.sbomify.com/CVE-2016-20050/): NetSchedScan 1.0 Buffer Overflow Denial of Service (medium 6.9)
- [CVE-2016-2005](https://insights.sbomify.com/CVE-2016-2005/): Other in hp:data protector (critical 9.8)
- [CVE-2016-20049](https://insights.sbomify.com/CVE-2016-20049/): JAD 1.5.8e-1kali1 Stack-Based Buffer Overflow Remote Code Execution (critical 9.3)
- [CVE-2016-20048](https://insights.sbomify.com/CVE-2016-20048/): iSelect 1.4.0-2+b1 Local Buffer Overflow via key parameter (high 8.6)
- [CVE-2016-20047](https://insights.sbomify.com/CVE-2016-20047/): EKG Gadu 1.9 Local Buffer Overflow via Username Parameter (high 8.6)
- [CVE-2016-20046](https://insights.sbomify.com/CVE-2016-20046/): zFTP Client 20061220+dfsg3-4.1 Local Buffer Overflow (high 8.6)
- [CVE-2016-20045](https://insights.sbomify.com/CVE-2016-20045/): HNB Organizer 1.9.18-10 Local Buffer Overflow via -rc Parameter (high 8.6)
- [CVE-2016-20044](https://insights.sbomify.com/CVE-2016-20044/): PInfo 0.6.9-5.1 Local Buffer Overflow via -m Parameter (high 8.6)
- [CVE-2016-20043](https://insights.sbomify.com/CVE-2016-20043/): NRSS RSS Reader 0.3.9-1 Stack Buffer Overflow (high 8.6)
- [CVE-2016-20042](https://insights.sbomify.com/CVE-2016-20042/): TRN 3.6-23 Stack Buffer Overflow Local Code Execution (high 8.6)
- [CVE-2016-20041](https://insights.sbomify.com/CVE-2016-20041/): Yasr 0.6.9-5 Buffer Overflow via Command-line Parameter (high 8.6)
- [CVE-2016-20040](https://insights.sbomify.com/CVE-2016-20040/): TiEmu 3.03-nogdb+dfsg-3 Buffer Overflow via ROM Parameter (high 8.6)
- [CVE-2016-2004](https://insights.sbomify.com/CVE-2016-2004/): Auth bypass in hp:data protector (critical 9.8)
- [CVE-2016-20039](https://insights.sbomify.com/CVE-2016-20039/): Multi Emulator Super System 0.154-3.1 Buffer Overflow (high 8.6)
- [CVE-2016-20038](https://insights.sbomify.com/CVE-2016-20038/): yTree 1.94-1.1 Stack-Based Buffer Overflow (high 8.6)
- [CVE-2016-20037](https://insights.sbomify.com/CVE-2016-20037/): xwpe 1.5.30a-2.1 Stack-based Buffer Overflow (high 8.6)
- [CVE-2016-20036](https://insights.sbomify.com/CVE-2016-20036/): Wowza Streaming Engine 4.5.0 Multiple Cross-Site Scripting Vulnerabilities (medium 5.1)
- [CVE-2016-20035](https://insights.sbomify.com/CVE-2016-20035/): Wowza Streaming Engine 4.5.0 CSRF via user edit endpoint (medium 6.9)
- [CVE-2016-20034](https://insights.sbomify.com/CVE-2016-20034/): Wowza Streaming Engine 4.5.0 Privilege Escalation via user edit (high 8.7)
- [CVE-2016-20033](https://insights.sbomify.com/CVE-2016-20033/): Wowza Streaming Engine 4.5.0 Local Privilege Escalation via nssm_x64.exe (high 8.5)
- [CVE-2016-20032](https://insights.sbomify.com/CVE-2016-20032/): ZKTeco ZKAccess Security System 5.3.1 Stored XSS (medium 5.1)
- [CVE-2016-20031](https://insights.sbomify.com/CVE-2016-20031/): ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp (medium 6.8)
- [CVE-2016-20030](https://insights.sbomify.com/CVE-2016-20030/): ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction (critical 9.3)
- [CVE-2016-2003](https://insights.sbomify.com/CVE-2016-2003/): Deserialization in hp:p9000 command view advanced edition software (critical 9.8)
- [CVE-2016-20029](https://insights.sbomify.com/CVE-2016-20029/): ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability (medium 6.9)
- [CVE-2016-20028](https://insights.sbomify.com/CVE-2016-20028/): ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin (medium 5.3)
- [CVE-2016-20027](https://insights.sbomify.com/CVE-2016-20027/): ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities (medium 5.1)
- [CVE-2016-20026](https://insights.sbomify.com/CVE-2016-20026/): ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution (critical 9.3)
- [CVE-2016-20025](https://insights.sbomify.com/CVE-2016-20025/): ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions (high 8.7)
- [CVE-2016-20024](https://insights.sbomify.com/CVE-2016-20024/): ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation (critical 9.3)
- [CVE-2016-20023](https://insights.sbomify.com/CVE-2016-20023/): Path traversal in CKFinder (medium 5.0)
- [CVE-2016-20022](https://insights.sbomify.com/CVE-2016-20022/): In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint descriptor. (high 8.4)
- [CVE-2016-20021](https://insights.sbomify.com/CVE-2016-20021/): Gentoo Portage missing PGP validation of executed code (critical 9.8)
- [CVE-2016-2002](https://insights.sbomify.com/CVE-2016-2002/): Command injection in opentext:vertica (critical 9.8)
- [CVE-2016-20018](https://insights.sbomify.com/CVE-2016-20018/): Knex.js has a limited SQL injection vulnerability (high 7.5)
- [CVE-2016-20017](https://insights.sbomify.com/CVE-2016-20017/): D-Link DSL-2750B Devices Command Injection (critical 9.8, exploited in the wild)
- [CVE-2016-20016](https://insights.sbomify.com/CVE-2016-20016/): Command injection in mvpower:tv-7104he firmware (critical 9.8)
- [CVE-2016-20015](https://insights.sbomify.com/CVE-2016-20015/): Race condition in smokeping:smokeping (high 7.5)
- [CVE-2016-20014](https://insights.sbomify.com/CVE-2016-20014/): Information disclosure in pam tacplus project:pam tacplus (critical 9.8)
- [CVE-2016-20013](https://insights.sbomify.com/CVE-2016-20013/): Denial of service in sha256crypt project:sha256crypt (high 7.5)
- [CVE-2016-20012](https://insights.sbomify.com/CVE-2016-20012/): Information disclosure in netapp:clustered data ontap (medium 5.3)
- [CVE-2016-20011](https://insights.sbomify.com/CVE-2016-20011/): Security feature bypass in gnome:libgrss (high 7.5)
- [CVE-2016-20010](https://insights.sbomify.com/CVE-2016-20010/): Code injection in ewww:image optimizer (critical 10.0)
- [CVE-2016-2001](https://insights.sbomify.com/CVE-2016-2001/): Information disclosure in hp:universal cmbd foundation (high 7.4)
- [CVE-2016-20009](https://insights.sbomify.com/CVE-2016-20009/): Memory corruption in siemens:sgt-100 firmware (critical 9.8)
- [CVE-2016-20008](https://insights.sbomify.com/CVE-2016-20008/): Information disclosure in rest\/json project:rest\/json (high 7.5)
- [CVE-2016-20007](https://insights.sbomify.com/CVE-2016-20007/): Auth bypass in rest\/json project:rest\/json (high 7.5)
- [CVE-2016-20006](https://insights.sbomify.com/CVE-2016-20006/): Denial of service in rest\/json project:rest\/json (high 7.5)
- [CVE-2016-20005](https://insights.sbomify.com/CVE-2016-20005/): Auth bypass in rest\/json project:rest\/json (critical 9.8)
- [CVE-2016-20004](https://insights.sbomify.com/CVE-2016-20004/): Security feature bypass in rest\/json project:rest\/json (critical 9.8)
- [CVE-2016-20003](https://insights.sbomify.com/CVE-2016-20003/): Information disclosure in rest\/json project:rest\/json (high 7.5)
- [CVE-2016-20002](https://insights.sbomify.com/CVE-2016-20002/): Missing authorization in rest\/json project:rest\/json (critical 9.8)
- [CVE-2016-20001](https://insights.sbomify.com/CVE-2016-20001/): Missing authorization in rest\/json project:rest\/json (critical 9.8)
- [CVE-2016-2000](https://insights.sbomify.com/CVE-2016-2000/): Deserialization in hp:asset manager (critical 9.8)
- [CVE-2016-1999](https://insights.sbomify.com/CVE-2016-1999/): Deserialization in hp:release control (critical 9.8)
- [CVE-2016-1998](https://insights.sbomify.com/CVE-2016-1998/): Deserialization in hp:service manager (critical 9.8)
- [CVE-2016-1997](https://insights.sbomify.com/CVE-2016-1997/): Deserialization in hp:operations orchestration (critical 9.8)
- [CVE-2016-1996](https://insights.sbomify.com/CVE-2016-1996/): Other in hp:system management homepage (high 7.7)
- [CVE-2016-1995](https://insights.sbomify.com/CVE-2016-1995/): Other in hp:system management homepage (critical 9.8)
- [CVE-2016-1994](https://insights.sbomify.com/CVE-2016-1994/): Information disclosure in hp:system management homepage (medium 6.5)
- [CVE-2016-1993](https://insights.sbomify.com/CVE-2016-1993/): Other in hp:system management homepage (high 8.1)
- [CVE-2016-1992](https://insights.sbomify.com/CVE-2016-1992/): Information disclosure in hp:enterprise security manager (medium 6.5)
- [CVE-2016-1991](https://insights.sbomify.com/CVE-2016-1991/): Other in microfocus:arcsight enterprise security manager (high 8.0)
- [CVE-2016-1990](https://insights.sbomify.com/CVE-2016-1990/): Privilege escalation in microfocus:arcsight enterprise security manager (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/64/