CVE-2016-4428

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

• CWE-79

• http://www.debian.org/security/2016/dsa-3617Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/06/17/4Mailing List, Patch, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1268Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1269Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1270Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1271Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1272Third Party Advisory
• https://bugs.launchpad.net/horizon/+bug/1567673Issue Tracking, Third Party Advisory
• https://review.openstack.org/329996Patch, Vendor Advisory
• https://review.openstack.org/329997Patch, Vendor Advisory
• https://review.openstack.org/329998Patch, Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-010.htmlPatch, Vendor Advisory
• http://www.debian.org/security/2016/dsa-3617Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/06/17/4Mailing List, Patch, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1268Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1269Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1270Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1271Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1272Third Party Advisory
• https://bugs.launchpad.net/horizon/+bug/1567673Issue Tracking, Third Party Advisory
• https://review.openstack.org/329996Patch, Vendor Advisory
• https://review.openstack.org/329997Patch, Vendor Advisory
• https://review.openstack.org/329998Patch, Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-010.htmlPatch, Vendor Advisory

Published

Jul 12, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-4421epan/dissectors/packet-ber.c in the ASN.1 BER dissector in W…
• CVE-2016-4422The pam_sm_authenticate function in pam_sshauth.c in libpam-…9.8
• CVE-2016-4423The attemptAuthentication function in Component/Security/Htt…
• CVE-2016-4425Jansson 2.7 and earlier allows context-dependent attackers t…6.5
• CVE-2016-4426In zulip before 1.3.12, bot API keys were accessible to othe…4.3
• CVE-2016-4427In zulip before 1.3.12, deactivated users could access messa…7.5
• CVE-2016-4429Stack-based buffer overflow in the clntudp_call function in …5.9
• CVE-2016-4430Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token val…
• CVE-2016-4431Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attack…
• CVE-2016-4432The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apa…9.1
• CVE-2016-4433Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attack…
• CVE-2016-4434Apache Tika before 1.13 does not properly initialize the XML…