CVE-2016-4976

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a process listing.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Mar 29, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_tCVE-2016-49787.2The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in CVE-2016-49797.5The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requiCVE-2016-49802.5A password generation weakness exists in xquest through 2016-06-13.CVE-2016-49824.7authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creatiCVE-2016-49833.3A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.CVE-2016-49844.7/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users toCVE-2016-49857.5The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive CVE-2016-49867.5Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecifieCVE-2016-49876.5Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories anCVE-2016-49886.1Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arbCVE-2016-49897.0setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an S
CVE-2016-4976: Medium severity, CVSS 5.5 | Vulnix