# CVEs published 2016-05-22

40 CVEs were published on May 22, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2151](https://cve.now/CVE-2016-2151.md): user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessi (no CVSS, moodle/moodle)
- [CVE-2016-2152](https://cve.now/CVE-2016-2152.md): Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, (no CVSS, moodle/moodle)
- [CVE-2016-2153](https://cve.now/CVE-2016-2153.md): Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod\_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x bef (no CVSS, moodle/moodle)
- [CVE-2016-2154](https://cve.now/CVE-2016-2154.md): admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the (no CVSS, moodle/moodle)
- [CVE-2016-2155](https://cve.now/CVE-2016-2155.md): The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does n (no CVSS, moodle/moodle)
- [CVE-2016-2156](https://cve.now/CVE-2016-2156.md): calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 prov (no CVSS, moodle/moodle)
- [CVE-2016-2157](https://cve.now/CVE-2016-2157.md): Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x be (no CVSS, moodle/moodle)
- [CVE-2016-2158](https://cve.now/CVE-2016-2158.md): lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, wh (no CVSS, moodle/moodle)
- [CVE-2016-2159](https://cve.now/CVE-2016-2159.md): The save\_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before (no CVSS, moodle/moodle)
- [CVE-2016-2190](https://cve.now/CVE-2016-2190.md): Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links (no CVSS, moodle/moodle)
- [CVE-2014-9767](https://cve.now/CVE-2014-9767.md): Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php\_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and (no CVSS)
- [CVE-2015-5714](https://cve.now/CVE-2015-5714.md): Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leverag (no CVSS)
- [CVE-2015-5715](https://cve.now/CVE-2015-5715.md): The mw\_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authentic (no CVSS)
- [CVE-2015-7989](https://cve.now/CVE-2015-7989.md): Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitr (no CVSS)
- [CVE-2015-8834](https://cve.now/CVE-2015-8834.md): Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2015-8866](https://cve.now/CVE-2015-8866.md): ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml\_disable\_enti (no CVSS)
- [CVE-2015-8867](https://cve.now/CVE-2015-8867.md): The openssl\_random\_pseudo\_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorre (no CVSS)
- [CVE-2015-8876](https://cve.now/CVE-2015-8876.md): Zend/zend\_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which (no CVSS)
- [CVE-2015-8877](https://cve.now/CVE-2015-8877.md): The gdImageScaleTwoPass function in gd\_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, us (no CVSS)
- [CVE-2015-8878](https://cve.now/CVE-2015-8878.md): main/php\_open\_temporary\_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to (no CVSS)
- [CVE-2015-8879](https://cve.now/CVE-2015-8879.md): The odbc\_bindcols function in ext/odbc/php\_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL\_WVARCHAR columns, which allows rem (no CVSS)
- [CVE-2015-8880](https://cve.now/CVE-2015-8880.md): Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering (no CVSS)
- [CVE-2016-1564](https://cve.now/CVE-2016-1564.md): Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to in (no CVSS)
- [CVE-2016-2221](https://cve.now/CVE-2016-2221.md): Open redirect vulnerability in the wp\_validate\_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attack (no CVSS)
- [CVE-2016-2222](https://cve.now/CVE-2016-2222.md): The wp\_http\_validate\_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request f (no CVSS)
- [CVE-2016-4342](https://cve.now/CVE-2016-4342.md): ext/phar/phar\_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allow (no CVSS)
- [CVE-2016-4343](https://cve.now/CVE-2016-4343.md): The phar\_make\_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, (no CVSS)
- [CVE-2016-4344](https://cve.now/CVE-2016-4344.md): Integer overflow in the xml\_utf8\_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service o (no CVSS)
- [CVE-2016-4345](https://cve.now/CVE-2016-4345.md): Integer overflow in the php\_filter\_encode\_url function in ext/filter/sanitizing\_filters.c in PHP before 7.0.4 allows remote attackers to cau (no CVSS)
- [CVE-2016-4346](https://cve.now/CVE-2016-4346.md): Integer overflow in the str\_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service o (no CVSS)
- [CVE-2016-4537](https://cve.now/CVE-2016-4537.md): The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for (no CVSS)
- [CVE-2016-4538](https://cve.now/CVE-2016-4538.md): The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structure (no CVSS)
- [CVE-2016-4539](https://cve.now/CVE-2016-4539.md): The xml\_parse\_into\_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers (no CVSS)
- [CVE-2016-4540](https://cve.now/CVE-2016-4540.md): The grapheme\_stripos function in ext/intl/grapheme/grapheme\_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows (no CVSS)
- [CVE-2016-4541](https://cve.now/CVE-2016-4541.md): The grapheme\_strpos function in ext/intl/grapheme/grapheme\_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows r (no CVSS)
- [CVE-2016-4542](https://cve.now/CVE-2016-4542.md): The exif\_process\_IFD\_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly const (no CVSS)
- [CVE-2016-4543](https://cve.now/CVE-2016-4543.md): The exif\_process\_IFD\_in\_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate I (no CVSS)
- [CVE-2016-4544](https://cve.now/CVE-2016-4544.md): The exif\_process\_TIFF\_in\_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate (no CVSS)
- [CVE-2016-4566](https://cve.now/CVE-2016-4566.md): Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote at (no CVSS)
- [CVE-2016-4567](https://cve.now/CVE-2016-4567.md): Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, (no CVSS, mediaelement · contao-components/mediaelement +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-05-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.