# Vulnerabilities published in 2016


- [CVE-2016-1181](https://insights.sbomify.com/CVE-2016-1181/): Improper Input Validation in Apache Struts (high 8.1)
- [CVE-2016-1180](https://insights.sbomify.com/CVE-2016-1180/): Cross-site scripting in cyber-will:social-button premium (medium 6.1)
- [CVE-2016-1179](https://insights.sbomify.com/CVE-2016-1179/): Cross-site scripting in appleple:a-blog cms (medium 6.1)
- [CVE-2016-1178](https://insights.sbomify.com/CVE-2016-1178/): Auth bypass in appleple:a-blog cms (medium 6.5)
- [CVE-2016-1177](https://insights.sbomify.com/CVE-2016-1177/): Other in falconsc:wisepoint (medium 6.1)
- [CVE-2016-1176](https://insights.sbomify.com/CVE-2016-1176/): Memory corruption in sharp:eva animator (medium 6.3)
- [CVE-2016-1175](https://insights.sbomify.com/CVE-2016-1175/): Cross-site request forgery in sharp:aquos hn-pp150 firmware (medium 4.3)
- [CVE-2016-1174](https://insights.sbomify.com/CVE-2016-1174/): Cross-site request forgery in hiniarata:casebook plugin (high 8.8)
- [CVE-2016-1173](https://insights.sbomify.com/CVE-2016-1173/): Cross-site scripting in hiniarata:casebook plugin (medium 6.1)
- [CVE-2016-1172](https://insights.sbomify.com/CVE-2016-1172/): Cross-site request forgery in hiniarata:casebook plugin (high 8.8)
- [CVE-2016-1171](https://insights.sbomify.com/CVE-2016-1171/): Cross-site scripting in hiniarata:casebook plugin (medium 6.1)
- [CVE-2016-1170](https://insights.sbomify.com/CVE-2016-1170/): Cross-site request forgery in hiniarata:casebook plugin (high 8.8)
- [CVE-2016-1169](https://insights.sbomify.com/CVE-2016-1169/): Cross-site scripting in hiniarata:casebook plugin (medium 6.1)
- [CVE-2016-1168](https://insights.sbomify.com/CVE-2016-1168/): Cross-site request forgery in aterm:wf800hp firmware (high 8.8)
- [CVE-2016-1167](https://insights.sbomify.com/CVE-2016-1167/): Cross-site request forgery in aterm:wg300hp firmware (high 8.8)
- [CVE-2016-1161](https://insights.sbomify.com/CVE-2016-1161/): Cross-site request forgery in zohocorp:password manager pro (high 8.0)
- [CVE-2016-1160](https://insights.sbomify.com/CVE-2016-1160/): Cross-site scripting in wp favorite posts project:wp favorite posts (medium 6.1)
- [CVE-2016-1159](https://insights.sbomify.com/CVE-2016-1159/): Information disclosure in Password Manager Pro (PMP) (medium 6.5)
- [CVE-2016-1158](https://insights.sbomify.com/CVE-2016-1158/): Cross-site request forgery in corega:cg-wlbargmh firmware (high 8.8)
- [CVE-2016-1157](https://insights.sbomify.com/CVE-2016-1157/): Cross-site scripting in log-chat project:log-chat (medium 6.1)
- [CVE-2016-1156](https://insights.sbomify.com/CVE-2016-1156/): Denial of service in linecorp:line (medium 5.7)
- [CVE-2016-1155](https://insights.sbomify.com/CVE-2016-1155/): Code injection in google:android (critical 9.8)
- [CVE-2016-1154](https://insights.sbomify.com/CVE-2016-1154/): SQL injection in cuore:ec-cube help plugin (critical 9.1)
- [CVE-2016-1153](https://insights.sbomify.com/CVE-2016-1153/): Denial of service in cybozu:office (medium 6.5)
- [CVE-2016-1152](https://insights.sbomify.com/CVE-2016-1152/): Missing authorization in cybozu:office (medium 5.4)
- [CVE-2016-1151](https://insights.sbomify.com/CVE-2016-1151/): Cross-site request forgery in cybozu:office (high 8.8)
- [CVE-2016-1150](https://insights.sbomify.com/CVE-2016-1150/): Cross-site scripting in cybozu:office (medium 6.1)
- [CVE-2016-1149](https://insights.sbomify.com/CVE-2016-1149/): Cross-site scripting in cybozu:office (medium 6.1)
- [CVE-2016-1148](https://insights.sbomify.com/CVE-2016-1148/): Weak cryptography in photosynth:akerun (high 8.1)
- [CVE-2016-1145](https://insights.sbomify.com/CVE-2016-1145/): Path traversal in nec:expresscluster x (high 7.5)
- [CVE-2016-1144](https://insights.sbomify.com/CVE-2016-1144/): Cross-site scripting in websquare:job-cube (medium 5.4)
- [CVE-2016-1143](https://insights.sbomify.com/CVE-2016-1143/): Cross-site scripting in vine mv project:vine mv (medium 6.1)
- [CVE-2016-1142](https://insights.sbomify.com/CVE-2016-1142/): Command injection in seeds:acmailer (critical 9.1)
- [CVE-2016-1141](https://insights.sbomify.com/CVE-2016-1141/): Command injection in kddi:home spot cube firmware (medium 4.7)
- [CVE-2016-1140](https://insights.sbomify.com/CVE-2016-1140/): Other in kddi:home spot cube firmware (medium 6.1)
- [CVE-2016-1139](https://insights.sbomify.com/CVE-2016-1139/): Cross-site request forgery in kddi:home spot cube firmware (high 7.5)
- [CVE-2016-1138](https://insights.sbomify.com/CVE-2016-1138/): Other in kddi:home spot cube firmware (medium 4.7)
- [CVE-2016-1137](https://insights.sbomify.com/CVE-2016-1137/): Open redirect in kddi:home spot cube firmware (high 7.4)
- [CVE-2016-1136](https://insights.sbomify.com/CVE-2016-1136/): Cross-site scripting in kddi:home spot cube firmware (medium 5.4)
- [CVE-2016-1135](https://insights.sbomify.com/CVE-2016-1135/): Cross-site scripting in buffalotech:bhr-4grv2 firmware (medium 6.1)
- [CVE-2016-1134](https://insights.sbomify.com/CVE-2016-1134/): Cross-site request forgery in buffalotech:bhr-4grv2 firmware (high 8.8)
- [CVE-2016-1133](https://insights.sbomify.com/CVE-2016-1133/): Other in dena:h2o (low 3.7)
- [CVE-2016-1132](https://insights.sbomify.com/CVE-2016-1132/): Security feature bypass in docomo:shoplat (high 7.5)
- [CVE-2016-1131](https://insights.sbomify.com/CVE-2016-1131/): Memory corruption in dx library project:dx library (high 7.8)
- [CVE-2016-1130](https://insights.sbomify.com/CVE-2016-1130/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1129](https://insights.sbomify.com/CVE-2016-1129/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1128](https://insights.sbomify.com/CVE-2016-1128/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1127](https://insights.sbomify.com/CVE-2016-1127/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1126](https://insights.sbomify.com/CVE-2016-1126/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1125](https://insights.sbomify.com/CVE-2016-1125/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1124](https://insights.sbomify.com/CVE-2016-1124/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1123](https://insights.sbomify.com/CVE-2016-1123/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1122](https://insights.sbomify.com/CVE-2016-1122/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-1121](https://insights.sbomify.com/CVE-2016-1121/): Use after free in adobe:acrobat dc (critical 9.8)
- [CVE-2016-1120](https://insights.sbomify.com/CVE-2016-1120/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1119](https://insights.sbomify.com/CVE-2016-1119/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1118](https://insights.sbomify.com/CVE-2016-1118/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1117](https://insights.sbomify.com/CVE-2016-1117/): Security feature bypass in adobe:acrobat (critical 9.8)
- [CVE-2016-1116](https://insights.sbomify.com/CVE-2016-1116/): Memory corruption in adobe:acrobat (critical 9.8)
- [CVE-2016-1115](https://insights.sbomify.com/CVE-2016-1115/): Security feature bypass in adobe:coldfusion (medium 5.9)
- [CVE-2016-1114](https://insights.sbomify.com/CVE-2016-1114/): Deserialization in adobe:coldfusion (critical 9.8)
- [CVE-2016-1113](https://insights.sbomify.com/CVE-2016-1113/): Cross-site scripting in adobe:coldfusion (medium 6.1)
- [CVE-2016-1112](https://insights.sbomify.com/CVE-2016-1112/): Information disclosure in adobe:acrobat (critical 9.8)
- [CVE-2016-1111](https://insights.sbomify.com/CVE-2016-1111/): Memory corruption in adobe:acrobat (high 8.8)
- [CVE-2016-1110](https://insights.sbomify.com/CVE-2016-1110/): Other in adobe:flash player (high 7.5)
- [CVE-2016-1109](https://insights.sbomify.com/CVE-2016-1109/): Other in adobe:flash player (high 7.5)
- [CVE-2016-11086](https://insights.sbomify.com/CVE-2016-11086/): Improper Certificate Validation in oauth ruby gem (high 7.4)
- [CVE-2016-11085](https://insights.sbomify.com/CVE-2016-11085/): Cross-site request forgery in expresstech:quiz and survey master (medium 6.5)
- [CVE-2016-11084](https://insights.sbomify.com/CVE-2016-11084/): Mattermost Server allows XSS via CSRF (medium 6.1)
- [CVE-2016-11083](https://insights.sbomify.com/CVE-2016-11083/): Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution (medium 6.1)
- [CVE-2016-11082](https://insights.sbomify.com/CVE-2016-11082/): Mattermost Server is vulnerable to XSS through crafted links (medium 6.1)
- [CVE-2016-11081](https://insights.sbomify.com/CVE-2016-11081/): Mattermost Server exposes information stored by a web browser (medium 4.3)
- [CVE-2016-11080](https://insights.sbomify.com/CVE-2016-11080/): Mattermost Server exposes account details to any Team Administrator (medium 4.3)
- [CVE-2016-1108](https://insights.sbomify.com/CVE-2016-1108/): Other in adobe:flash player (high 7.5)
- [CVE-2016-11079](https://insights.sbomify.com/CVE-2016-11079/): Mattermost Server allows XSS via redirect URL (medium 6.1)
- [CVE-2016-11078](https://insights.sbomify.com/CVE-2016-11078/): Mattermost Server exposes sensitive information via its System Console UI (medium 6.5)
- [CVE-2016-11077](https://insights.sbomify.com/CVE-2016-11077/): Mattermost Server allows System Admin to modify LDAP account names and email addresses (low 2.7)
- [CVE-2016-11076](https://insights.sbomify.com/CVE-2016-11076/): Mattermost Server does not check if cookies are used over SSL (medium 5.3)
- [CVE-2016-11075](https://insights.sbomify.com/CVE-2016-11075/): Mattermost Server exposes sensitive information about team URLs via an API (medium 5.3)
- [CVE-2016-11074](https://insights.sbomify.com/CVE-2016-11074/): Mattermost Server: Insufficient Password-Reset Link Invalidation (critical 9.8)
- [CVE-2016-11073](https://insights.sbomify.com/CVE-2016-11073/): Mattermost Server is vulnerable to XSS via a Legal or Support setting (medium 6.1)
- [CVE-2016-11072](https://insights.sbomify.com/CVE-2016-11072/): Mattermost Server's Session ID and Session Token are potentially compromised (medium 6.5)
- [CVE-2016-11071](https://insights.sbomify.com/CVE-2016-11071/): Mattermost Server is vulnerable to XSS through lack of link relationship attributes `noreferrer` and `noopener` (medium 6.1)
- [CVE-2016-11070](https://insights.sbomify.com/CVE-2016-11070/): Mattermost Server is vulnerable to XSS through customizable theme color-code values (medium 5.4)
- [CVE-2016-1107](https://insights.sbomify.com/CVE-2016-1107/): Other in adobe:flash player (high 7.5)
- [CVE-2016-11069](https://insights.sbomify.com/CVE-2016-11069/): Mattermost Server does not enforce rate limits on password change attempts (high 7.5)
- [CVE-2016-11068](https://insights.sbomify.com/CVE-2016-11068/): Mattermost Server is vulnerable to Code Injection through its LDAP fields (medium 5.3)
- [CVE-2016-11067](https://insights.sbomify.com/CVE-2016-11067/): Mattermost Server is vulnerable to Uncontrolled Resource Consumption (medium 5.3)
- [CVE-2016-11066](https://insights.sbomify.com/CVE-2016-11066/): Mattermost Server: initial_load API exposes unnecessary information (high 7.5)
- [CVE-2016-11065](https://insights.sbomify.com/CVE-2016-11065/): Missing authorization in mattermost:mattermost server (medium 4.3)
- [CVE-2016-11064](https://insights.sbomify.com/CVE-2016-11064/): Code injection in mattermost:mattermost desktop (critical 9.8)
- [CVE-2016-11063](https://insights.sbomify.com/CVE-2016-11063/): Mattermost Server vulnerable to Cross-site Scripting through file preview feature (medium 6.1)
- [CVE-2016-11062](https://insights.sbomify.com/CVE-2016-11062/): Security feature bypass in mattermost:mattermost server (medium 5.3)
- [CVE-2016-11061](https://insights.sbomify.com/CVE-2016-11061/): Command injection in xerox:workcentre 3655 firmware (critical 9.8)
- [CVE-2016-11060](https://insights.sbomify.com/CVE-2016-11060/): Weak cryptography in netgear:fvs318g firmware (high 7.5)
- [CVE-2016-1106](https://insights.sbomify.com/CVE-2016-1106/): Other in adobe:flash player (high 7.5)
- [CVE-2016-11059](https://insights.sbomify.com/CVE-2016-11059/): Information disclosure in netgear:ac1450 firmware (high 7.5)
- [CVE-2016-11058](https://insights.sbomify.com/CVE-2016-11058/): Hardcoded credentials in netgear:genie (high 7.5)
- [CVE-2016-11057](https://insights.sbomify.com/CVE-2016-11057/): Auth bypass in netgear:jnr1010 firmware (high 7.5)
- [CVE-2016-11056](https://insights.sbomify.com/CVE-2016-11056/): Auth bypass in netgear:readynas surveillance (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/73/