# Vulnerabilities published in 2016 - [CVE-2016-1000340](https://insights.sbomify.com/CVE-2016-1000340/): The Bouncy Castle JCE Provider carry a propagation bug (high 7.5) - [CVE-2016-1000339](https://insights.sbomify.com/CVE-2016-1000339/): Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15 (medium 5.3) - [CVE-2016-1000338](https://insights.sbomify.com/CVE-2016-1000338/): In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate (high 7.5) - [CVE-2016-1000307](https://insights.sbomify.com/CVE-2016-1000307/): Cross-site scripting in clip-bucket:clipbucket (medium 6.1) - [CVE-2016-10003](https://insights.sbomify.com/CVE-2016-10003/): Security feature bypass in squid-cache:squid (high 7.5) - [CVE-2016-1000282](https://insights.sbomify.com/CVE-2016-1000282/): Critical severity vulnerability that affects Haraka (critical 9.8) - [CVE-2016-1000271](https://insights.sbomify.com/CVE-2016-1000271/): SQL injection in dthdevelopment:dt register (critical 9.8) - [CVE-2016-1000237](https://insights.sbomify.com/CVE-2016-1000237/): Cross-Site Scripting in sanitize-html (medium 6.1) - [CVE-2016-1000236](https://insights.sbomify.com/CVE-2016-1000236/): cookie-signature Timing Attack (medium 4.4) - [CVE-2016-1000232](https://insights.sbomify.com/CVE-2016-1000232/): ReDoS via long string of semicolons in tough-cookie (medium 5.3) - [CVE-2016-1000229](https://insights.sbomify.com/CVE-2016-1000229/): Improper Neutralization of Input During Web Page Generation in swagger-ui (medium 6.1) - [CVE-2016-1000222](https://insights.sbomify.com/CVE-2016-1000222/): Code injection in elastic:logstash (high 7.5) - [CVE-2016-1000221](https://insights.sbomify.com/CVE-2016-1000221/): Logstash Logs Sensitive Information (high 7.5) - [CVE-2016-1000220](https://insights.sbomify.com/CVE-2016-1000220/): Cross-site scripting in elastic:kibana (medium 6.1) - [CVE-2016-1000219](https://insights.sbomify.com/CVE-2016-1000219/): Information disclosure in elastic:kibana (high 7.5) - [CVE-2016-1000218](https://insights.sbomify.com/CVE-2016-1000218/): Cross-site request forgery in elastic:kibana reporting (high 8.8) - [CVE-2016-1000217](https://insights.sbomify.com/CVE-2016-1000217/): SQL injection in zotpress project:zotpress (critical 9.8) - [CVE-2016-1000216](https://insights.sbomify.com/CVE-2016-1000216/): Command injection in ruckus:wireless h500 (high 8.8) - [CVE-2016-1000215](https://insights.sbomify.com/CVE-2016-1000215/): Denial of service in ruckus:wireless h500 (high 7.5) - [CVE-2016-1000214](https://insights.sbomify.com/CVE-2016-1000214/): Auth bypass in ruckus:wireless h500 (medium 5.3) - [CVE-2016-1000213](https://insights.sbomify.com/CVE-2016-1000213/): Cross-site request forgery in ruckus:wireless h500 (high 8.8) - [CVE-2016-10002](https://insights.sbomify.com/CVE-2016-10002/): Information disclosure in debian:debian linux (high 7.5) - [CVE-2016-1000156](https://insights.sbomify.com/CVE-2016-1000156/): File upload in mailcwp project:mailcwp (critical 9.8) - [CVE-2016-1000155](https://insights.sbomify.com/CVE-2016-1000155/): Cross-site scripting in wpsolr:wpsolr-search-engine (medium 6.1) - [CVE-2016-1000154](https://insights.sbomify.com/CVE-2016-1000154/): Cross-site scripting in browserweb:whizz (medium 6.1) - [CVE-2016-1000153](https://insights.sbomify.com/CVE-2016-1000153/): Cross-site scripting in tidio-gallery project:tidio-gallery (medium 6.1) - [CVE-2016-1000152](https://insights.sbomify.com/CVE-2016-1000152/): Cross-site scripting in tidio-form project:tidio-form (medium 6.1) - [CVE-2016-1000151](https://insights.sbomify.com/CVE-2016-1000151/): Cross-site scripting in tera-charts project:tera-charts (medium 6.1) - [CVE-2016-1000150](https://insights.sbomify.com/CVE-2016-1000150/): Cross-site scripting in oxil:simplified-content (medium 6.1) - [CVE-2016-1000149](https://insights.sbomify.com/CVE-2016-1000149/): Cross-site scripting in simpel-reserveren project:simpel-reserveren (medium 6.1) - [CVE-2016-1000148](https://insights.sbomify.com/CVE-2016-1000148/): Cross-site scripting in s3-video project:s3-video (medium 6.1) - [CVE-2016-1000147](https://insights.sbomify.com/CVE-2016-1000147/): Cross-site scripting in recipes-writer project:recipes-writer (medium 6.1) - [CVE-2016-1000146](https://insights.sbomify.com/CVE-2016-1000146/): Cross-site scripting in pondol-formmail project:pondol-formmail (medium 6.1) - [CVE-2016-1000145](https://insights.sbomify.com/CVE-2016-1000145/): Cross-site scripting in pondol-carousel project:pondol-carousel (medium 6.1) - [CVE-2016-1000144](https://insights.sbomify.com/CVE-2016-1000144/): Cross-site scripting in photoxhibit project:photoxhibit (medium 6.1) - [CVE-2016-1000143](https://insights.sbomify.com/CVE-2016-1000143/): Cross-site scripting in photoxhibit project:photoxhibit (medium 6.1) - [CVE-2016-1000142](https://insights.sbomify.com/CVE-2016-1000142/): Cross-site scripting in parsi-font project:parsi-font (medium 6.1) - [CVE-2016-1000141](https://insights.sbomify.com/CVE-2016-1000141/): Cross-site scripting in page-layout-builder project:page-layout-builder (medium 6.1) - [CVE-2016-1000140](https://insights.sbomify.com/CVE-2016-1000140/): Cross-site scripting in new-year-firework project:new-year-firework (medium 6.1) - [CVE-2016-1000139](https://insights.sbomify.com/CVE-2016-1000139/): Cross-site scripting in infusionsoft project:infusionsoft (medium 6.1) - [CVE-2016-1000138](https://insights.sbomify.com/CVE-2016-1000138/): Cross-site scripting in indexisto project:indexisto (medium 6.1) - [CVE-2016-1000137](https://insights.sbomify.com/CVE-2016-1000137/): Cross-site scripting in hero-maps-pro project:hero-maps-pro (medium 6.1) - [CVE-2016-1000136](https://insights.sbomify.com/CVE-2016-1000136/): Cross-site scripting in heat-trackr project:heat-trackr (medium 6.1) - [CVE-2016-1000135](https://insights.sbomify.com/CVE-2016-1000135/): Cross-site scripting in hdw-tube project:hdw-tube (medium 6.1) - [CVE-2016-1000134](https://insights.sbomify.com/CVE-2016-1000134/): Cross-site scripting in hdw-tube project:hdw-tube (medium 6.1) - [CVE-2016-1000133](https://insights.sbomify.com/CVE-2016-1000133/): Cross-site scripting in designsandcode:forget about shortcode buttons (medium 6.1) - [CVE-2016-1000132](https://insights.sbomify.com/CVE-2016-1000132/): Cross-site scripting in cminds:tooltip glossary (medium 6.1) - [CVE-2016-1000131](https://insights.sbomify.com/CVE-2016-1000131/): Cross-site scripting in e-search project:esearch (medium 6.1) - [CVE-2016-1000130](https://insights.sbomify.com/CVE-2016-1000130/): Cross-site scripting in e-search project:e-search (medium 6.1) - [CVE-2016-1000129](https://insights.sbomify.com/CVE-2016-1000129/): Cross-site scripting in defa-online-image-protector project:defa-online-image-protector (medium 6.1) - [CVE-2016-1000128](https://insights.sbomify.com/CVE-2016-1000128/): Cross-site scripting in anti-plagiarism project:anti-plagiarism (medium 6.1) - [CVE-2016-1000127](https://insights.sbomify.com/CVE-2016-1000127/): Cross-site scripting in ajax-random-post project:ajax-random-post (medium 6.1) - [CVE-2016-1000126](https://insights.sbomify.com/CVE-2016-1000126/): Cross-site scripting in admin-font-editor project:admin-font-editor (medium 6.1) - [CVE-2016-1000125](https://insights.sbomify.com/CVE-2016-1000125/): SQL injection in huge-it:huge-it catalog (critical 9.8) - [CVE-2016-1000124](https://insights.sbomify.com/CVE-2016-1000124/): SQL injection in huge-it:portfolio gallery (critical 9.8) - [CVE-2016-1000123](https://insights.sbomify.com/CVE-2016-1000123/): SQL injection in huge-it:video gallery (critical 9.8) - [CVE-2016-1000122](https://insights.sbomify.com/CVE-2016-1000122/): SQL injection in huge-it:slider (high 7.2) - [CVE-2016-1000121](https://insights.sbomify.com/CVE-2016-1000121/): Cross-site scripting in huge-it:slider (medium 4.8) - [CVE-2016-1000120](https://insights.sbomify.com/CVE-2016-1000120/): SQL injection in huge-it:catalog (high 7.2) - [CVE-2016-1000119](https://insights.sbomify.com/CVE-2016-1000119/): SQL injection in huge-it:catalog (high 7.2) - [CVE-2016-1000118](https://insights.sbomify.com/CVE-2016-1000118/): XSS & SQLi in HugeIT slideshow v1.0.4 (high 7.2) - [CVE-2016-1000117](https://insights.sbomify.com/CVE-2016-1000117/): XSS & SQLi in HugeIT slideshow v1.0.4 (high 7.2) - [CVE-2016-1000116](https://insights.sbomify.com/CVE-2016-1000116/): SQL injection in huge-it:portfolio gallery manager (high 7.2) - [CVE-2016-1000115](https://insights.sbomify.com/CVE-2016-1000115/): SQL injection in huge-it:portfolio gallery manager (high 7.2) - [CVE-2016-1000114](https://insights.sbomify.com/CVE-2016-1000114/): XSS in huge IT gallery v1.1.5 for Joomla (medium 6.1) - [CVE-2016-1000113](https://insights.sbomify.com/CVE-2016-1000113/): SQL injection in huge-it:gallery (critical 9.8) - [CVE-2016-1000112](https://insights.sbomify.com/CVE-2016-1000112/): File upload in contussupport:contus-video-comments (critical 9.1) - [CVE-2016-1000111](https://insights.sbomify.com/CVE-2016-1000111/): Forced Browsing in Twisted (medium 5.3) - [CVE-2016-1000110](https://insights.sbomify.com/CVE-2016-1000110/): Open redirect in debian:debian linux (medium 6.1) - [CVE-2016-1000109](https://insights.sbomify.com/CVE-2016-1000109/): Other in facebook:hhvm (medium 5.3) - [CVE-2016-1000108](https://insights.sbomify.com/CVE-2016-1000108/): Open redirect in debian:debian linux (medium 6.1) - [CVE-2016-1000107](https://insights.sbomify.com/CVE-2016-1000107/): Open redirect in erlang:erlang\/otp (medium 6.1) - [CVE-2016-1000104](https://insights.sbomify.com/CVE-2016-1000104/): Security feature bypass in apache:mod fcgid (high 8.8) - [CVE-2016-1000037](https://insights.sbomify.com/CVE-2016-1000037/): Cross-site scripting in fedoraproject:fedora (medium 6.1) - [CVE-2016-1000033](https://insights.sbomify.com/CVE-2016-1000033/): Security feature bypass in gnome:shotwell (low 3.7) - [CVE-2016-1000032](https://insights.sbomify.com/CVE-2016-1000032/): Security feature bypass in python:tgcaptcha2 (high 7.5) - [CVE-2016-1000031](https://insights.sbomify.com/CVE-2016-1000031/): Improper Access Control in commons-fileupload (critical 9.8) - [CVE-2016-1000030](https://insights.sbomify.com/CVE-2016-1000030/): Memory corruption in pidgin:pidgin (critical 9.8) - [CVE-2016-1000029](https://insights.sbomify.com/CVE-2016-1000029/): Cross-site scripting in tenable:nessus (medium 4.8) - [CVE-2016-1000028](https://insights.sbomify.com/CVE-2016-1000028/): Cross-site scripting in tenable:nessus (medium 4.8) - [CVE-2016-1000027](https://insights.sbomify.com/CVE-2016-1000027/): Pivotal Spring Framework contains unsafe Java deserialization methods (critical 9.8) - [CVE-2016-1000009](https://insights.sbomify.com/CVE-2016-1000009/): Other in tp-link:tp-link (high 7.5) - [CVE-2016-1000007](https://insights.sbomify.com/CVE-2016-1000007/): Pagure 2.2.1 XSS in raw file endpoint (medium 6.1) - [CVE-2016-1000006](https://insights.sbomify.com/CVE-2016-1000006/): Use after free in facebook:hhvm (critical 9.8) - [CVE-2016-1000005](https://insights.sbomify.com/CVE-2016-1000005/): Memory corruption in facebook:hhvm (critical 9.8) - [CVE-2016-1000004](https://insights.sbomify.com/CVE-2016-1000004/): Memory corruption in facebook:hhvm (critical 9.8) - [CVE-2016-1000003](https://insights.sbomify.com/CVE-2016-1000003/): Code injection in mirror manager project:mirror manager (critical 9.8) - [CVE-2016-1000002](https://insights.sbomify.com/CVE-2016-1000002/): Information disclosure in debian:debian linux (low 2.4) - [CVE-2016-1000001](https://insights.sbomify.com/CVE-2016-1000001/): flask-oidc Open Redirect vulnerability (high 7.4) - [CVE-2016-1000000](https://insights.sbomify.com/CVE-2016-1000000/): SQL injection in progress:whatsup gold (high 8.8) - [CVE-2016-1000](https://insights.sbomify.com/CVE-2016-1000/): Use after free in adobe:air (high 8.8) - [CVE-2016-0999](https://insights.sbomify.com/CVE-2016-0999/): Use after free in adobe:air (high 8.8) - [CVE-2016-0998](https://insights.sbomify.com/CVE-2016-0998/): Use after free in adobe:air (high 8.8) - [CVE-2016-0997](https://insights.sbomify.com/CVE-2016-0997/): Use after free in adobe:air (high 8.8) - [CVE-2016-0996](https://insights.sbomify.com/CVE-2016-0996/): Use after free in adobe:air (high 8.8) - [CVE-2016-0995](https://insights.sbomify.com/CVE-2016-0995/): Use after free in adobe:air (high 8.8) - [CVE-2016-0994](https://insights.sbomify.com/CVE-2016-0994/): Use after free in adobe:air (high 8.8) - [CVE-2016-0993](https://insights.sbomify.com/CVE-2016-0993/): Integer overflow in adobe:air (high 8.8) - [CVE-2016-0992](https://insights.sbomify.com/CVE-2016-0992/): Memory corruption in adobe:air (high 8.8) - [CVE-2016-0991](https://insights.sbomify.com/CVE-2016-0991/): Use after free in adobe:air (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2016/page/85/