CVE-2016-6903

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Apr 24, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-69048.1Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could alCVE-2016-69056.5The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of serCVE-2016-69065.5The read_image_tga function in gd_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of serCVE-2016-69086.1Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, dueCVE-2016-69099.8Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch befoCVE-2016-69105.5The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devicCVE-2016-69115.5The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of-CVE-2016-69129.8Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have CVE-2016-69135.4Cross-site scripting (XSS) vulnerability in AlienVault OSSIM before 5.3 and USM before 5.3 allows remote attackers to inject arbitrary web sCVE-2016-69147.8Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM CVE-2016-69157.8Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, aCVE-2016-69167.8Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield T
CVE-2016-6903: Critical severity, CVSS 9.9 | Vulnix