# Vulnerabilities published in 2016


- [CVE-2016-1561](https://insights.sbomify.com/CVE-2016-1561/): Hardcoded credentials in exagrid:ex10000e firmware (high 7.5)
- [CVE-2016-1560](https://insights.sbomify.com/CVE-2016-1560/): Hardcoded credentials in exagrid:ex10000e firmware (critical 9.8)
- [CVE-2016-1559](https://insights.sbomify.com/CVE-2016-1559/): Information disclosure in d-link:dap-1353 h\/w b1 firmware (high 8.1)
- [CVE-2016-1558](https://insights.sbomify.com/CVE-2016-1558/): Memory corruption in dlink:dap-2230 firmware (critical 9.8)
- [CVE-2016-1557](https://insights.sbomify.com/CVE-2016-1557/): Information disclosure in netgear:wnap320 firmware (critical 9.8)
- [CVE-2016-1556](https://insights.sbomify.com/CVE-2016-1556/): Information disclosure in netgear:wn604 firmware (high 7.5)
- [CVE-2016-1555](https://insights.sbomify.com/CVE-2016-1555/): NETGEAR Multiple WAP Devices Command Injection (critical 9.8, exploited in the wild)
- [CVE-2016-1551](https://insights.sbomify.com/CVE-2016-1551/): Security feature bypass in NTP (low 3.7)
- [CVE-2016-1550](https://insights.sbomify.com/CVE-2016-1550/): Weak cryptography in NTP (medium 5.3)
- [CVE-2016-1549](https://insights.sbomify.com/CVE-2016-1549/): Business logic in NTP (medium 6.5)
- [CVE-2016-1548](https://insights.sbomify.com/CVE-2016-1548/): Security feature bypass in NTP (high 7.2)
- [CVE-2016-1547](https://insights.sbomify.com/CVE-2016-1547/): Denial of service in NTP (medium 5.3)
- [CVE-2016-1546](https://insights.sbomify.com/CVE-2016-1546/): Denial of service in apache:http server (medium 5.9)
- [CVE-2016-1544](https://insights.sbomify.com/CVE-2016-1544/): Denial of service in nghttp2 (low 3.3)
- [CVE-2016-1543](https://insights.sbomify.com/CVE-2016-1543/): Auth bypass in bmc:bladelogic server automation console (high 7.5)
- [CVE-2016-1542](https://insights.sbomify.com/CVE-2016-1542/): Auth bypass in bmc:bladelogic server automation console (high 7.5)
- [CVE-2016-1541](https://insights.sbomify.com/CVE-2016-1541/): Memory corruption in libarchive:libarchive (high 8.8)
- [CVE-2016-1531](https://insights.sbomify.com/CVE-2016-1531/): Privilege escalation in exim:exim (high 7.0)
- [CVE-2016-1526](https://insights.sbomify.com/CVE-2016-1526/): Memory corruption in debian:debian linux (high 8.1)
- [CVE-2016-1525](https://insights.sbomify.com/CVE-2016-1525/): Path traversal in netgear:prosafe network management software 300 (high 8.6)
- [CVE-2016-1524](https://insights.sbomify.com/CVE-2016-1524/): File upload in netgear:prosafe network management software 300 (critical 9.6)
- [CVE-2016-1523](https://insights.sbomify.com/CVE-2016-1523/): Null dereference in debian:debian linux (medium 6.5)
- [CVE-2016-1522](https://insights.sbomify.com/CVE-2016-1522/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2016-1521](https://insights.sbomify.com/CVE-2016-1521/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2016-1520](https://insights.sbomify.com/CVE-2016-1520/): Weak cryptography in grandstream:wave (high 7.8)
- [CVE-2016-1519](https://insights.sbomify.com/CVE-2016-1519/): Security feature bypass in grandstream:wave (medium 5.9)
- [CVE-2016-1518](https://insights.sbomify.com/CVE-2016-1518/): Weak cryptography in grandstream:wave (high 8.1)
- [CVE-2016-1517](https://insights.sbomify.com/CVE-2016-1517/): Improper Input Validation in OpenCV (medium 5.5)
- [CVE-2016-1516](https://insights.sbomify.com/CVE-2016-1516/): Double Free in OpenCV (high 8.8)
- [CVE-2016-1513](https://insights.sbomify.com/CVE-2016-1513/): Memory corruption in apache:openoffice (high 7.8)
- [CVE-2016-15060](https://insights.sbomify.com/CVE-2016-15060/): PCMan FTP Server PORT buffer overflow (medium 6.9)
- [CVE-2016-15059](https://insights.sbomify.com/CVE-2016-15059/): Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode. (critical 9.8)
- [CVE-2016-15058](https://insights.sbomify.com/CVE-2016-15058/): Hirschmann HiLCOS Classic Platform Password Exposure via SNMP (high 8.6)
- [CVE-2016-15057](https://insights.sbomify.com/CVE-2016-15057/): Apache Continuum: Command injection leading to RCE (critical 9.9)
- [CVE-2016-15056](https://insights.sbomify.com/CVE-2016-15056/): Ubee EVW3226 Unauthenticated Backup File Disclosure (high 8.7)
- [CVE-2016-15055](https://insights.sbomify.com/CVE-2016-15055/): JVC VN-T IP-Camera Directory Traversal via check.cgi (high 8.7)
- [CVE-2016-15053](https://insights.sbomify.com/CVE-2016-15053/): Nagios XI < 5.2.4 XSS via “My Reports” Listing (medium 5.1)
- [CVE-2016-15052](https://insights.sbomify.com/CVE-2016-15052/): Nagios XI < 5.2.4 XSS via Menu System (medium 5.1)
- [CVE-2016-15051](https://insights.sbomify.com/CVE-2016-15051/): Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields (medium 5.1)
- [CVE-2016-15050](https://insights.sbomify.com/CVE-2016-15050/): Nagios XI < 5.2.4 SQL Injection in Notification Search (high 8.7)
- [CVE-2016-1505](https://insights.sbomify.com/CVE-2016-1505/): Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component (critical 10.0)
- [CVE-2016-15049](https://insights.sbomify.com/CVE-2016-15049/): Nagios Log Server < 1.4.2 Dashboards Logs Table XSS (medium 5.1)
- [CVE-2016-15048](https://insights.sbomify.com/CVE-2016-15048/): AMTT HiBOS Command Injection RCE via server_ping.php (critical 10.0)
- [CVE-2016-15047](https://insights.sbomify.com/CVE-2016-15047/): AVTECH CloudSetup.cgi Authenticated Command Injection (high 8.7)
- [CVE-2016-15046](https://insights.sbomify.com/CVE-2016-15046/): Hanwha Techwin SSM 1.32 & 1.4 ActiveMQ File Upload RCE (high 8.6)
- [CVE-2016-15045](https://insights.sbomify.com/CVE-2016-15045/): Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation (high 8.5)
- [CVE-2016-15044](https://insights.sbomify.com/CVE-2016-15044/): Kaltura < 11.1.0-2 PHP Object Injection RCE (critical 9.3)
- [CVE-2016-15043](https://insights.sbomify.com/CVE-2016-15043/): WP Mobile Detector <= 3.5 - Arbitrary File Upload (critical 9.8)
- [CVE-2016-15042](https://insights.sbomify.com/CVE-2016-15042/): Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload (critical 9.8)
- [CVE-2016-15041](https://insights.sbomify.com/CVE-2016-15041/): Cross-site scripting in MainWP Dashboard: Self-hosted WordPress Management for Agencies (high 7.2)
- [CVE-2016-15040](https://insights.sbomify.com/CVE-2016-15040/): Kento Post View Counter <= 2.8 - SQL Injection (critical 9.8)
- [CVE-2016-1504](https://insights.sbomify.com/CVE-2016-1504/): Memory corruption in dhcpcd project:dhcpcd (high 7.5)
- [CVE-2016-15039](https://insights.sbomify.com/CVE-2016-15039/): mhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smuggling (medium 5.3)
- [CVE-2016-15038](https://insights.sbomify.com/CVE-2016-15038/): NUUO NVRmini 2 deletefile.php path traversal (medium 6.5)
- [CVE-2016-15037](https://insights.sbomify.com/CVE-2016-15037/): go4rayyan Scumblr Task cross site scripting (low 2.4)
- [CVE-2016-15036](https://insights.sbomify.com/CVE-2016-15036/): Deis Workflow Manager race condition (medium 4.6)
- [CVE-2016-15035](https://insights.sbomify.com/CVE-2016-15035/): Doc2k RE-Chat re_chat.js cross site scripting (low 3.5)
- [CVE-2016-15034](https://insights.sbomify.com/CVE-2016-15034/): Dynacase Webdesk freedomrss_search.php freedomrss_search sql injection (medium 5.5)
- [CVE-2016-15033](https://insights.sbomify.com/CVE-2016-15033/): Delete All Comments <= 2.0 - Arbitrary File Upload (critical 9.8)
- [CVE-2016-15032](https://insights.sbomify.com/CVE-2016-15032/): mback2k mh_httpbl Extension class.tx_mhhttpbl.php stopOutput cross site scripting (low 3.5)
- [CVE-2016-15031](https://insights.sbomify.com/CVE-2016-15031/): PHP-Login POST Parameter class.loginscript.php checkLogin sql injection (high 7.3)
- [CVE-2016-15030](https://insights.sbomify.com/CVE-2016-15030/): Arno0x TwoFactorAuth login.php redirect (low 3.5)
- [CVE-2016-1503](https://insights.sbomify.com/CVE-2016-1503/): Memory corruption in dhcpcd project:dhcpcd (critical 9.8)
- [CVE-2016-15029](https://insights.sbomify.com/CVE-2016-15029/): Ydalb mapicoin stats.php cross site scripting (low 3.5)
- [CVE-2016-15028](https://insights.sbomify.com/CVE-2016-15028/): ICEPAY REST-API-NET Checksum Validation RestClient.cs RestClient integrity check (medium 4.8)
- [CVE-2016-15027](https://insights.sbomify.com/CVE-2016-15027/): meta4creations Post Duplicator Plugin notices.php mtphr_post_duplicator_notice cross site scripting (low 3.5)
- [CVE-2016-15026](https://insights.sbomify.com/CVE-2016-15026/): 3breadt dd-plist xml external entity reference (medium 5.3)
- [CVE-2016-15025](https://insights.sbomify.com/CVE-2016-15025/): generator-hottowel 404 Error _app.js cross site scripting (low 3.5)
- [CVE-2016-15024](https://insights.sbomify.com/CVE-2016-15024/): doomsider shadow denial of service (low 2.5)
- [CVE-2016-15023](https://insights.sbomify.com/CVE-2016-15023/): SiteFusion Application Server Extension getextension.php path traversal (low 3.5)
- [CVE-2016-15022](https://insights.sbomify.com/CVE-2016-15022/): mosbth cimage check_system.php cross site scripting (low 2.0)
- [CVE-2016-15021](https://insights.sbomify.com/CVE-2016-15021/): nickzren alsdb sql injection (medium 5.5)
- [CVE-2016-15020](https://insights.sbomify.com/CVE-2016-15020/): liftkit database Query.php processOrderBy sql injection (medium 5.5)
- [CVE-2016-1502](https://insights.sbomify.com/CVE-2016-1502/): Auth bypass in netapp:snapcenter server (high 7.3)
- [CVE-2016-15019](https://insights.sbomify.com/CVE-2016-15019/): tombh jekbox server.rb exposure of information through directory listing (medium 4.3)
- [CVE-2016-15018](https://insights.sbomify.com/CVE-2016-15018/): krail-jpa sql injection (medium 5.5)
- [CVE-2016-15017](https://insights.sbomify.com/CVE-2016-15017/): fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal (medium 5.5)
- [CVE-2016-15016](https://insights.sbomify.com/CVE-2016-15016/): mrtnmtth joomla_mod_einsatz_stats helper.php getStatsByType sql injection (medium 5.5)
- [CVE-2016-15015](https://insights.sbomify.com/CVE-2016-15015/): viafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancy (low 2.6)
- [CVE-2016-15014](https://insights.sbomify.com/CVE-2016-15014/): CESNET theme-cesnet resetpassword.php insufficiently protected credentials (low 3.3)
- [CVE-2016-15013](https://insights.sbomify.com/CVE-2016-15013/): ForumHulp searchresults listener.php list_keywords sql injection (medium 5.5)
- [CVE-2016-15012](https://insights.sbomify.com/CVE-2016-15012/): forcedotcom SalesforceMobileSDK-Windows QuerySpec.cs ComputeCountSql sql injection (medium 5.5)
- [CVE-2016-15011](https://insights.sbomify.com/CVE-2016-15011/): e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity reference (medium 5.5)
- [CVE-2016-15010](https://insights.sbomify.com/CVE-2016-15010/): University of Cambridge django-ucamlookup Lookup cross site scripting (low 3.5)
- [CVE-2016-1501](https://insights.sbomify.com/CVE-2016-1501/): Information disclosure in owncloud:owncloud (medium 4.3)
- [CVE-2016-15009](https://insights.sbomify.com/CVE-2016-15009/): OpenACS bug-tracker Search nav-bar.adp cross-site request forgery (low 3.5)
- [CVE-2016-15008](https://insights.sbomify.com/CVE-2016-15008/): oxguy3 coebot-www channel.js showChannelBoir cross site scripting (low 3.5)
- [CVE-2016-15007](https://insights.sbomify.com/CVE-2016-15007/): Centralized-Salesforce-Dev-Framework SOQL SObjectService.cls SObjectService injection (medium 5.5)
- [CVE-2016-15006](https://insights.sbomify.com/CVE-2016-15006/): enigmaX Scrambling Table main.c getSeed prng seed (low 3.7)
- [CVE-2016-15005](https://insights.sbomify.com/CVE-2016-15005/): Cryptographically weak random number generation in github.com/dinever/golf (high 8.8)
- [CVE-2016-15004](https://insights.sbomify.com/CVE-2016-15004/): InfiniteWP Client Plugin injection (high 7.3)
- [CVE-2016-15003](https://insights.sbomify.com/CVE-2016-15003/): FileZilla Client Installer uninstall.exe unquoted search path (medium 6.3)
- [CVE-2016-15002](https://insights.sbomify.com/CVE-2016-15002/): MONyog Ultimate Cookie privileges management (high 7.3)
- [CVE-2016-1500](https://insights.sbomify.com/CVE-2016-1500/): Information disclosure in owncloud:owncloud (low 3.1)
- [CVE-2016-1499](https://insights.sbomify.com/CVE-2016-1499/): Information disclosure in owncloud:owncloud (high 8.5)
- [CVE-2016-1498](https://insights.sbomify.com/CVE-2016-1498/): Cross-site scripting in owncloud:owncloud (medium 6.1)
- [CVE-2016-1497](https://insights.sbomify.com/CVE-2016-1497/): Information disclosure in f5:big-ip access policy manager (medium 4.9)
- [CVE-2016-1496](https://insights.sbomify.com/CVE-2016-1496/): Denial of service in huawei:p8 firmware (medium 5.5)
- [CVE-2016-1495](https://insights.sbomify.com/CVE-2016-1495/): Integer overflow in huawei:mate s firmware (high 7.8)
- [CVE-2016-1494](https://insights.sbomify.com/CVE-2016-1494/): Python RSA allows attackers to spoof signatures (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/69/