CVEs published April 11, 2016
40 CVEs were published on April 11, 2016: 0 critical, 0 high.
- Published
- 40
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- org.apache.portals.jetspeed-2:jetspeed
- 3
- org.apache.ranger:ranger
- 3
- org.apache.openmeetings:openmeetings-parent
- 2
- github.com/kubernetes/kubernetes
- 1
- org.apache.directory.studio:org.apache.directory.studio.lda…
- 1
- org.apache.openmeetings:openmeetings-install
- 1
- org.apache.portals.jetspeed-2:jetspeed-commons
- 1
- tripleo-heat-templates
- 1
Medium, low and unrated 40
- CVE-2014-9759Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attacker
- CVE-2015-5233Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with t
- CVE-2015-5303The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack tripleo-heat-templates
- CVE-2015-5313Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine
- CVE-2015-5329The TripleO Heat templates (tripleo-heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 7.0, do not properly use the con
- CVE-2015-5349The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow aorg.apache.directory.studio:org.apache.directory.studio.lda…
- CVE-2015-7330Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet co
- CVE-2015-7502Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the
- CVE-2015-7528Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.github.com/kubernetes/kubernetes
- CVE-2015-8398Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitrary web script or HTM
- CVE-2015-8399Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spac
- CVE-2015-8604SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users
- CVE-2015-8614Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws M
- CVE-2015-8708Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified imp
- CVE-2015-8710The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of
- CVE-2015-0265Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary org.apache.ranger:ranger
- CVE-2015-0266The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct acceorg.apache.ranger:ranger
- CVE-2016-0735Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraginorg.apache.ranger:ranger
- CVE-2012-6698The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds write) via a craft
- CVE-2012-6699The decode_search function in dhcp.c in dhcpcd 3.x allows remote DHCP servers to cause a denial of service (out-of-bounds read) via a crafte
- CVE-2012-6700The decode_search function in dhcp.c in dhcpcd 3.x does not properly free allocated memory, which allows remote DHCP servers to cause a deni
- CVE-2016-1235The oarsh script in OAR before 2.5.7 allows remote authenticated users of a cluster to obtain sensitive information and possibly gain privil
- CVE-2016-2193PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass i
- CVE-2016-2385Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5
- CVE-2016-3065The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows atta
- CVE-2016-3659SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the h
- CVE-2016-3675SQL injection vulnerability in Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to execute arbi
- CVE-2016-3676Huawei E3276s USB modems with software before E3276s-150TCPU-V200R002B436D09SP00C00 allow man-in-the-middle attackers to intercept, spoof, o
- CVE-2016-3678Huawei Quidway S9700, S5700, S5300, S9300, and S7700 switches with software before V200R003SPH012 allow remote attackers to cause a denial o
- CVE-2015-8240The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1
- CVE-2016-0709Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote autorg.apache.portals.jetspeed-2:jetspeed
- CVE-2016-0710Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitraorg.apache.portals.jetspeed-2:jetspeed
- CVE-2016-0711Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script ororg.apache.portals.jetspeed-2:jetspeed-commons
- CVE-2016-0712Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via org.apache.portals.jetspeed-2:jetspeed
- CVE-2016-0783The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remot
- CVE-2016-0784Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenorg.apache.openmeetings:openmeetings-install
- CVE-2016-2163Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML org.apache.openmeetings:openmeetings-parent
- CVE-2016-2164The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperlorg.apache.openmeetings:openmeetings-parent
- CVE-2016-2171The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote atta
- CVE-2016-2393Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, whi