# CVEs published 2016-05-22

40 CVEs were published on May 22, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2151](https://cve.now/CVE-2016-2151.md): user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants… (no CVSS, moodle/moodle)
- [CVE-2016-2152](https://cve.now/CVE-2016-2152.md): Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before… (no CVSS, moodle/moodle)
- [CVE-2016-2153](https://cve.now/CVE-2016-2153.md): Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod\_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x… (no CVSS, moodle/moodle)
- [CVE-2016-2154](https://cve.now/CVE-2016-2154.md): admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider… (no CVSS, moodle/moodle)
- [CVE-2016-2155](https://cve.now/CVE-2016-2155.md): The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does… (no CVSS, moodle/moodle)
- [CVE-2016-2156](https://cve.now/CVE-2016-2156.md): calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3… (no CVSS, moodle/moodle)
- [CVE-2016-2157](https://cve.now/CVE-2016-2157.md): Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x… (no CVSS, moodle/moodle)
- [CVE-2016-2158](https://cve.now/CVE-2016-2158.md): lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3… (no CVSS, moodle/moodle)
- [CVE-2016-2159](https://cve.now/CVE-2016-2159.md): The save\_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x… (no CVSS, moodle/moodle)
- [CVE-2016-2190](https://cve.now/CVE-2016-2190.md): Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict… (no CVSS, moodle/moodle)
- [CVE-2014-9767](https://cve.now/CVE-2014-9767.md): Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php\_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29… (no CVSS)
- [CVE-2015-5714](https://cve.now/CVE-2015-5714.md): Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by… (no CVSS)
- [CVE-2015-5715](https://cve.now/CVE-2015-5715.md): The mw\_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote… (no CVSS)
- [CVE-2015-7989](https://cve.now/CVE-2015-7989.md): Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject… (no CVSS)
- [CVE-2015-8834](https://cve.now/CVE-2015-8834.md): Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary… (no CVSS)
- [CVE-2015-8866](https://cve.now/CVE-2015-8866.md): ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from… (no CVSS)
- [CVE-2015-8867](https://cve.now/CVE-2015-8867.md): The openssl\_random\_pseudo\_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12… (no CVSS)
- [CVE-2015-8876](https://cve.now/CVE-2015-8876.md): Zend/zend\_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects… (no CVSS)
- [CVE-2015-8877](https://cve.now/CVE-2015-8877.md): The gdImageScaleTwoPass function in gd\_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12… (no CVSS)
- [CVE-2015-8878](https://cve.now/CVE-2015-8878.md): main/php\_open\_temporary\_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers… (no CVSS)
- [CVE-2015-8879](https://cve.now/CVE-2015-8879.md): The odbc\_bindcols function in ext/odbc/php\_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL\_WVARCHAR columns, which allows… (no CVSS)
- [CVE-2015-8880](https://cve.now/CVE-2015-8880.md): Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by… (no CVSS)
- [CVE-2016-1564](https://cve.now/CVE-2016-1564.md): Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to… (no CVSS)
- [CVE-2016-2221](https://cve.now/CVE-2016-2221.md): Open redirect vulnerability in the wp\_validate\_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote… (no CVSS)
- [CVE-2016-2222](https://cve.now/CVE-2016-2222.md): The wp\_http\_validate\_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request… (no CVSS)
- [CVE-2016-4342](https://cve.now/CVE-2016-4342.md): ext/phar/phar\_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which… (no CVSS)
- [CVE-2016-4343](https://cve.now/CVE-2016-4343.md): The phar\_make\_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink… (no CVSS)
- [CVE-2016-4344](https://cve.now/CVE-2016-4344.md): Integer overflow in the xml\_utf8\_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-4345](https://cve.now/CVE-2016-4345.md): Integer overflow in the php\_filter\_encode\_url function in ext/filter/sanitizing\_filters.c in PHP before 7.0.4 allows remote attackers to… (no CVSS)
- [CVE-2016-4346](https://cve.now/CVE-2016-4346.md): Integer overflow in the str\_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-4537](https://cve.now/CVE-2016-4537.md): The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer… (no CVSS)
- [CVE-2016-4538](https://cve.now/CVE-2016-4538.md): The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data… (no CVSS)
- [CVE-2016-4539](https://cve.now/CVE-2016-4539.md): The xml\_parse\_into\_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote… (no CVSS)
- [CVE-2016-4540](https://cve.now/CVE-2016-4540.md): The grapheme\_stripos function in ext/intl/grapheme/grapheme\_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6… (no CVSS)
- [CVE-2016-4541](https://cve.now/CVE-2016-4541.md): The grapheme\_strpos function in ext/intl/grapheme/grapheme\_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows… (no CVSS)
- [CVE-2016-4542](https://cve.now/CVE-2016-4542.md): The exif\_process\_IFD\_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly… (no CVSS)
- [CVE-2016-4543](https://cve.now/CVE-2016-4543.md): The exif\_process\_IFD\_in\_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate… (no CVSS)
- [CVE-2016-4544](https://cve.now/CVE-2016-4544.md): The exif\_process\_TIFF\_in\_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not… (no CVSS)
- [CVE-2016-4566](https://cve.now/CVE-2016-4566.md): Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote… (no CVSS)
- [CVE-2016-4567](https://cve.now/CVE-2016-4567.md): Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before… (no CVSS, mediaelement · contao-components/mediaelement +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.