CVE-2016-4435

CRITICAL Year: 2016
CVSS v3 Score
9.0
Critical
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-264
View all →

Vulnerability Description

An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated clients to read or write blobs or cause a denial of service attack on the Director VM. This vulnerability requires that the unauthenticated clients guess or find a URL matching an existing GUID.

Related Vulnerabilities

CVE-2014-5415

CRITICAL
CVSS:9.1(Critical)

Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Too...

CWE-2642014

CVE-2015-8753

CRITICAL
CVSS:9.1(Critical)

SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related to "Insecure signature," aka SAP Security Note 2134905.

CWE-2642015

CVE-2016-3065

CRITICAL
CVSS:9.1(Critical)

The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequentl...

CWE-2642016

CVE-2016-6394

CRITICAL
CVSS:9.1(Critical)

Session fixation vulnerability in Cisco Firepower Management Center and Cisco FireSIGHT System Software through 6.1.0 allows remote attackers to hijack web sessions via a session identifier, aka Bug I...

CWE-2642016

CVE-2016-7435

CRITICAL
CVSS:9.1(Critical)

The (1) SCTC_REFRESH_EXPORT_TAB_COMP, (2) SCTC_REFRESH_CHECK_ENV, and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with cert...

CWE-2642016

CVE-2016-8649

CRITICAL
CVSS:9.1(Critical)

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /proc, to access the rest of the host's fi...

CWE-2642016