# Vulnerabilities published in 2016


- [CVE-2016-10595](https://insights.sbomify.com/CVE-2016-10595/): jdf-sass downloads Resources over HTTP (high 8.1)
- [CVE-2016-10594](https://insights.sbomify.com/CVE-2016-10594/): ipip downloads Resources over HTTP (high 8.1)
- [CVE-2016-10593](https://insights.sbomify.com/CVE-2016-10593/): ibapi downloads Resources over HTTP (high 8.1)
- [CVE-2016-10592](https://insights.sbomify.com/CVE-2016-10592/): Downloads Resources over HTTP in jser-stat (high 8.1)
- [CVE-2016-10591](https://insights.sbomify.com/CVE-2016-10591/): Downloads Resources over HTTP in prince (high 8.1)
- [CVE-2016-10590](https://insights.sbomify.com/CVE-2016-10590/): Downloads Resources over HTTP in cue-sdk-node (high 8.1)
- [CVE-2016-1059](https://insights.sbomify.com/CVE-2016-1059/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10589](https://insights.sbomify.com/CVE-2016-10589/): selenium-binaries downloads resources over HTTP (high 8.1)
- [CVE-2016-10588](https://insights.sbomify.com/CVE-2016-10588/): Downloads Resources over HTTP in nw (high 8.1)
- [CVE-2016-10587](https://insights.sbomify.com/CVE-2016-10587/): Downloads Resources over HTTP in wasdk (high 8.1)
- [CVE-2016-10586](https://insights.sbomify.com/CVE-2016-10586/): Downloads Resources over HTTP in macaca-chromedriver (high 8.1)
- [CVE-2016-10585](https://insights.sbomify.com/CVE-2016-10585/): Downloads Resources over HTTP in libxl (high 8.1)
- [CVE-2016-10584](https://insights.sbomify.com/CVE-2016-10584/): Downloads Resources over HTTP in dalek-browser-chrome-canary (high 8.1)
- [CVE-2016-10583](https://insights.sbomify.com/CVE-2016-10583/): closure-util downloads Resources over HTTP (high 8.1)
- [CVE-2016-10582](https://insights.sbomify.com/CVE-2016-10582/): closurecompiler downloads Resources over HTTP (high 8.1)
- [CVE-2016-10581](https://insights.sbomify.com/CVE-2016-10581/): steroids downloads resources over HTTP (high 8.1)
- [CVE-2016-10580](https://insights.sbomify.com/CVE-2016-10580/): Downloads Resources over HTTP in nodewebkit (high 8.1)
- [CVE-2016-1058](https://insights.sbomify.com/CVE-2016-1058/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10579](https://insights.sbomify.com/CVE-2016-10579/): chromedriver Downloads Resources over HTTP (high 8.1)
- [CVE-2016-10578](https://insights.sbomify.com/CVE-2016-10578/): Downloads Resources over HTTP in unicode (high 8.1)
- [CVE-2016-10577](https://insights.sbomify.com/CVE-2016-10577/): ibm_db downloads Resources over HTTP (high 8.1)
- [CVE-2016-10576](https://insights.sbomify.com/CVE-2016-10576/): fuseki downloads Resources over HTTP (high 8.1)
- [CVE-2016-10575](https://insights.sbomify.com/CVE-2016-10575/): Downloads Resources over HTTP in kindlegen (high 8.1)
- [CVE-2016-10574](https://insights.sbomify.com/CVE-2016-10574/): Downloads Resources over HTTP in apk-parser3 (high 8.1)
- [CVE-2016-10573](https://insights.sbomify.com/CVE-2016-10573/): Downloads Resources over HTTP in baryton-saxophone (high 8.1)
- [CVE-2016-10572](https://insights.sbomify.com/CVE-2016-10572/): Downloads Resources over HTTP in mongodb-instance (high 8.1)
- [CVE-2016-10571](https://insights.sbomify.com/CVE-2016-10571/): Downloads Resources over HTTP in bkjs-wand (high 8.1)
- [CVE-2016-10570](https://insights.sbomify.com/CVE-2016-10570/): pngcrush-installer downloads Resources over HTTP (high 8.1)
- [CVE-2016-1057](https://insights.sbomify.com/CVE-2016-1057/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10569](https://insights.sbomify.com/CVE-2016-10569/): Downloads Resources over HTTP in embedza (high 8.1)
- [CVE-2016-10568](https://insights.sbomify.com/CVE-2016-10568/): Downloads Resources over HTTP in geoip-lite-country (high 8.1)
- [CVE-2016-10567](https://insights.sbomify.com/CVE-2016-10567/): Downloads Resources over HTTP in product-monitor (high 8.1)
- [CVE-2016-10566](https://insights.sbomify.com/CVE-2016-10566/): install-nw downloads Resources over HTTP (high 8.1)
- [CVE-2016-10565](https://insights.sbomify.com/CVE-2016-10565/): Downloads Resources over HTTP in operadriver (high 8.1)
- [CVE-2016-10564](https://insights.sbomify.com/CVE-2016-10564/): Downloads Resources over HTTP in apk-parser (high 8.1)
- [CVE-2016-10563](https://insights.sbomify.com/CVE-2016-10563/): Downloads Resources over HTTP in go-ipfs-dep (high 8.1)
- [CVE-2016-10562](https://insights.sbomify.com/CVE-2016-10562/): Downloads Resources over HTTP in iedriver (high 8.1)
- [CVE-2016-10561](https://insights.sbomify.com/CVE-2016-10561/): Directory Traversal in bitty (medium 5.3)
- [CVE-2016-10560](https://insights.sbomify.com/CVE-2016-10560/): Downloads Resources over HTTP in galenframework-cli (high 8.1)
- [CVE-2016-1056](https://insights.sbomify.com/CVE-2016-1056/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10559](https://insights.sbomify.com/CVE-2016-10559/): Downloads Resources over HTTP in selenium-download (high 8.1)
- [CVE-2016-10558](https://insights.sbomify.com/CVE-2016-10558/): Downloads Resources over HTTP in aerospike (high 8.1)
- [CVE-2016-10557](https://insights.sbomify.com/CVE-2016-10557/): appium-chromedriver downloads Resources over HTTP (high 8.1)
- [CVE-2016-10556](https://insights.sbomify.com/CVE-2016-10556/): SQL Injection in sequelize (high 7.5)
- [CVE-2016-10555](https://insights.sbomify.com/CVE-2016-10555/): Forgeable Public/Private Tokens in jwt-simple (medium 6.5)
- [CVE-2016-10554](https://insights.sbomify.com/CVE-2016-10554/): SQL Injection in sequelize (critical 9.8)
- [CVE-2016-10553](https://insights.sbomify.com/CVE-2016-10553/): Potential SQL Injection in sequelize (critical 9.8)
- [CVE-2016-10552](https://insights.sbomify.com/CVE-2016-10552/): Resources Downloaded over Insecure Protocol in igniteui (high 7.4)
- [CVE-2016-10551](https://insights.sbomify.com/CVE-2016-10551/): SQL Injection in waterline-sequel (critical 9.8)
- [CVE-2016-10550](https://insights.sbomify.com/CVE-2016-10550/): SQL Injection in sequelize (critical 9.8)
- [CVE-2016-1055](https://insights.sbomify.com/CVE-2016-1055/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10549](https://insights.sbomify.com/CVE-2016-10549/): Sails before 0.12.7 vulnerable to Broken CORS (medium 4.4)
- [CVE-2016-10548](https://insights.sbomify.com/CVE-2016-10548/): Arbitrary Code Injection in reduce-css-calc (medium 6.1)
- [CVE-2016-10547](https://insights.sbomify.com/CVE-2016-10547/): Cross-Site Scripting in nunjucks (medium 6.1)
- [CVE-2016-10546](https://insights.sbomify.com/CVE-2016-10546/): Arbitrary Code Injection in pouchdb (critical 9.8)
- [CVE-2016-10544](https://insights.sbomify.com/CVE-2016-10544/): Denial of Service in uws (medium 5.9)
- [CVE-2016-10543](https://insights.sbomify.com/CVE-2016-10543/): Route Validation Bypass in call (medium 5.3)
- [CVE-2016-10542](https://insights.sbomify.com/CVE-2016-10542/): DoS due to excessively large websocket message in ws (high 7.5)
- [CVE-2016-10541](https://insights.sbomify.com/CVE-2016-10541/): Potential Command Injection in shell-quote (critical 9.8)
- [CVE-2016-10540](https://insights.sbomify.com/CVE-2016-10540/): Regular Expression Denial of Service in minimatch (high 7.5)
- [CVE-2016-1054](https://insights.sbomify.com/CVE-2016-1054/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10539](https://insights.sbomify.com/CVE-2016-10539/): Regular Expression Denial of Service in negotiator (high 7.5)
- [CVE-2016-10538](https://insights.sbomify.com/CVE-2016-10538/): Arbitrary File Write in cli (low 3.5)
- [CVE-2016-10537](https://insights.sbomify.com/CVE-2016-10537/): Cross-Site Scripting in backbone (medium 5.4)
- [CVE-2016-10536](https://insights.sbomify.com/CVE-2016-10536/): Insecure Defaults Allow MITM Over TLS in engine.io-client (medium 5.9)
- [CVE-2016-10535](https://insights.sbomify.com/CVE-2016-10535/): Timing Attack in csrf-lite (medium 5.9)
- [CVE-2016-10534](https://insights.sbomify.com/CVE-2016-10534/): SSL Validation Defaults to False in electron-packager (medium 5.9)
- [CVE-2016-10533](https://insights.sbomify.com/CVE-2016-10533/): Private Data Disclosure in express-restify-mongoose (high 8.8)
- [CVE-2016-10532](https://insights.sbomify.com/CVE-2016-10532/): Authentication Bypass in console-io (critical 9.8)
- [CVE-2016-10531](https://insights.sbomify.com/CVE-2016-10531/): Sanitization bypass using HTML Entities in marked (medium 6.1)
- [CVE-2016-10530](https://insights.sbomify.com/CVE-2016-10530/): Insecure Default Configuration in airbrake (medium 5.9)
- [CVE-2016-1053](https://insights.sbomify.com/CVE-2016-1053/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10529](https://insights.sbomify.com/CVE-2016-10529/): No CSRF Validation in droppy (high 8.8)
- [CVE-2016-10528](https://insights.sbomify.com/CVE-2016-10528/): Directory Traversal in restafary (medium 4.9)
- [CVE-2016-10527](https://insights.sbomify.com/CVE-2016-10527/): Regular Expression Denial of Service in riot-compiler (high 7.5)
- [CVE-2016-10526](https://insights.sbomify.com/CVE-2016-10526/): grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file (high 8.6)
- [CVE-2016-10525](https://insights.sbomify.com/CVE-2016-10525/): Authentication Bypass in hapi-auth-jwt2 (critical 9.8)
- [CVE-2016-10524](https://insights.sbomify.com/CVE-2016-10524/): Denial of Service and Content Injection in i18n-node-angular (high 8.2)
- [CVE-2016-10523](https://insights.sbomify.com/CVE-2016-10523/): Denial of Service in mqtt-packet (high 7.5)
- [CVE-2016-10522](https://insights.sbomify.com/CVE-2016-10522/): Cross-site request forgery in rails_admin (high 8.8)
- [CVE-2016-10521](https://insights.sbomify.com/CVE-2016-10521/): Regular Expression Denial of Service in jshamcrest (high 7.5)
- [CVE-2016-10520](https://insights.sbomify.com/CVE-2016-10520/): Regular Expression Denial of Service in jadedown (high 7.5)
- [CVE-2016-1052](https://insights.sbomify.com/CVE-2016-1052/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10519](https://insights.sbomify.com/CVE-2016-10519/): Remote Memory Disclosure in bittorrent-dht (high 7.5)
- [CVE-2016-10518](https://insights.sbomify.com/CVE-2016-10518/): Remote Memory Disclosure in ws (high 7.5)
- [CVE-2016-10517](https://insights.sbomify.com/CVE-2016-10517/): Other in redislabs:redis (high 7.4)
- [CVE-2016-10516](https://insights.sbomify.com/CVE-2016-10516/): Pallets Werkzeug cross-site scripting vulnerability (medium 6.1)
- [CVE-2016-10515](https://insights.sbomify.com/CVE-2016-10515/): Cross-site scripting in redmine:redmine (medium 6.1)
- [CVE-2016-10514](https://insights.sbomify.com/CVE-2016-10514/): Security feature bypass in piwigo:piwigo (medium 6.5)
- [CVE-2016-10513](https://insights.sbomify.com/CVE-2016-10513/): Cross-site scripting in piwigo:piwigo (medium 6.1)
- [CVE-2016-10512](https://insights.sbomify.com/CVE-2016-10512/): Information disclosure in multitech:faxfinder (critical 9.8)
- [CVE-2016-10511](https://insights.sbomify.com/CVE-2016-10511/): Security feature bypass in twitter:twitter (medium 5.9)
- [CVE-2016-10510](https://insights.sbomify.com/CVE-2016-10510/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2016-1051](https://insights.sbomify.com/CVE-2016-1051/): Use after free in adobe:acrobat (critical 9.8)
- [CVE-2016-10509](https://insights.sbomify.com/CVE-2016-10509/): SQL injection in opencart:opencart (high 7.2)
- [CVE-2016-10508](https://insights.sbomify.com/CVE-2016-10508/): Cross-site scripting in phpthumb project:phpthumb (medium 6.1)
- [CVE-2016-10507](https://insights.sbomify.com/CVE-2016-10507/): Integer overflow in uclouvain:openjpeg (medium 6.5)
- [CVE-2016-10506](https://insights.sbomify.com/CVE-2016-10506/): Denial of service in uclouvain:openjpeg (medium 6.5)
- [CVE-2016-10505](https://insights.sbomify.com/CVE-2016-10505/): Null dereference in uclouvain:openjpeg (medium 6.5)
- [CVE-2016-10504](https://insights.sbomify.com/CVE-2016-10504/): Memory corruption in uclouvain:openjpeg (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/79/