Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8710 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2016-2875 1 Ibm 1 Qradar Security Information And Event Manager 2024-11-21 N/A
IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors.
CVE-2016-2397 1 Sonicwall 4 Analyzer, Global Management System, Uma Em5000 and 1 more 2024-11-21 N/A
The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
CVE-2016-2396 1 Sonicwall 4 Analyzer, Global Management System, Uma Em5000 and 1 more 2024-11-21 N/A
The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.
CVE-2016-2332 1 Systech 2 Syslink Sl-1000 Modular Gateway, Syslink Sl-1000 Modular Gateway Firmware 2024-11-21 N/A
flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users to execute arbitrary commands via the 5066 (aka dnsmasq) parameter.
CVE-2016-2179 3 Openssl, Oracle, Redhat 3 Openssl, Linux, Enterprise Linux 2024-11-21 N/A
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.
CVE-2016-2056 2 Debian, Xymon 2 Debian Linux, Xymon 2024-11-21 N/A
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
CVE-2016-2002 1 Hp 1 Vertica 2024-11-21 N/A
The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allows remote attackers to execute arbitrary commands via the mcPort parameter, aka ZDI-CAN-3417.
CVE-2016-20017 1 Dlink 2 Dsl-2750b, Dsl-2750b Firmware 2024-11-21 9.8 Critical
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through 2022.
CVE-2016-20013 2 Sha256crypt Project, Sha512crypt Project 2 Sha256crypt, Sha512crypt 2024-11-21 7.5 High
sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.
CVE-2016-1555 1 Netgear 14 Wn604, Wn604 Firmware, Wn802tv2 and 11 more 2024-11-21 N/A
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.
CVE-2016-1388 1 Cisco 3 Network Analysis Module, Prime Network Analysis Module Software, Prime Virtual Network Analysis Module Software 2024-11-21 N/A
Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882.
CVE-2016-10849 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).
CVE-2016-10843 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).
CVE-2016-10762 1 Automattic 1 Camptix Event Ticketing 2024-11-21 N/A
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.
CVE-2016-10760 1 Seowonintech 8 Swr-300a, Swr-300a Firmware, Swr-300b and 5 more 2024-11-21 N/A
On Seowon Intech routers, there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.
CVE-2016-10729 3 Debian, Redhat, Zmanda 3 Debian Linux, Enterprise Linux, Amanda 2024-11-21 N/A
An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The "runtar" setuid root binary does not check for additional arguments supplied after --create, allowing users to manipulate commands and perform command injection as root.
CVE-2016-10541 1 Shell-quote Project 1 Shell-quote 2024-11-21 9.8 Critical
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
CVE-2016-10329 1 Synology 1 Photo Station 2024-11-21 N/A
Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.
CVE-2016-10322 1 Synology 1 Photo Station 2024-11-21 N/A
Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php.
CVE-2016-10312 1 Jensenofscandinavia 6 Al3g, Al3g Firmware, Al5000ac and 3 more 2024-11-21 N/A
Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) devices allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.