CVEs

8,966 total · page 170 of 180

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2016-1052	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1051	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1050	Adobe Inc. Acrobat	Cri	0.64	9.8	0.03		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1049	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1048	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1047	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1046	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1045	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1044	Adobe Inc. Acrobat	Cri	0.65	10.0	0.05		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1043	Adobe Inc. Acrobat	Cri	0.64	9.8	0.03		May 11, 2016	Integer overflow in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVE-2016-1042	Adobe Inc. Acrobat	Cri	0.64	9.8	0.01		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1041	Adobe Inc. Acrobat	Cri	0.65	10.0	0.01		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1040	Adobe Inc. Acrobat	Cri	0.64	9.8	0.01		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1039	Adobe Inc. Acrobat	Cri	0.64	9.8	0.01		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1038	Adobe Inc. Acrobat	Cri	0.65	10.0	0.05		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1037	Adobe Inc. Acrobat	Cri	0.64	9.8	0.02		May 11, 2016	Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
CVE-2016-4117	Adobe Inc. Flashplayer	Cri	0.86	9.8	0.93	KEV	May 11, 2016	Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2016-1114	Adobe Inc. Coldfusion	Cri	0.64	9.8	0.02		May 11, 2016	Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVE-2016-4350	SolarWinds Storage Resource Monitor	Cri	0.69	9.8	0.64		May 9, 2016	Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the…
CVE-2016-2429	Google Android	Cri	0.64	9.8	0.01		May 9, 2016	libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service…
CVE-2016-2428	Google Android	Cri	0.64	9.8	0.01		May 9, 2016	libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack…
CVE-2016-2351	Accellion File Transfer Appliance	Cri	0.64	9.8	0.01		May 7, 2016	SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
CVE-2015-6552	Symantec Netbackup	Cri	0.64	9.8	0.02		May 7, 2016	The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2…
CVE-2015-6550	Symantec Netbackup	Cri	0.64	9.8	0.03		May 7, 2016	bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary…
CVE-2013-7455	Littlecms Little CMS Color Engine	Cri	0.58	9.8	0.15		May 7, 2016	Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
CVE-2016-4422	Libpam Sshauth Project Libpam Sshauth	Cri	0.64	9.8	0.00		May 6, 2016	The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
CVE-2015-8863	Jqlang Jq	Cri	0.58	9.8	0.10		May 6, 2016	Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
CVE-2015-0857	Tardiff Project Tardiff	Cri	0.64	9.8	0.03		May 6, 2016	Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
CVE-2016-1387	Cisco Systems, Inc. Collaboration Endpoint (CE)	Cri	0.64	9.8	0.01		May 5, 2016	The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make…
CVE-2016-4351	Trend Micro Email Encryption Gateway	Cri	0.64	9.8	0.01		May 5, 2016	SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-2108	OpenSSL Project OpenSSL	Cri	0.60	9.8	0.37		May 5, 2016	The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
CVE-2016-1343	Cisco Systems, Inc. Information Server	Cri	0.65	10.0	0.01		Apr 30, 2016	The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE)…
CVE-2015-8812	Linux Kernel	Cri	0.57	9.8	0.04		Apr 27, 2016	drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
CVE-2016-4002	QEMU Qemu	Cri	0.64	9.8	0.08		Apr 26, 2016	Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger…
CVE-2016-3082	Apache Struts	Cri	0.66	9.8	0.25		Apr 26, 2016	XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
CVE-2016-3074	Libgd Libgd	Cri	0.72	9.8	0.60		Apr 26, 2016	Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.
CVE-2016-1601	SUSE S.A. Yast2	Cri	0.64	9.8	0.00		Apr 26, 2016	yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown…
CVE-2016-2331	Slink Slink	Cri	0.64	9.8	0.00		Apr 25, 2016	The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2016-3466	Oracle Corporation Field Service	Cri	0.59	9.1	0.00		Apr 21, 2016	Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless.
CVE-2016-3454	Oracle Corporation Database Server	Cri	0.59	9.0	0.01		Apr 21, 2016	Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2016-3443	Sun Corporation Java Se	Cri	0.63	9.6	0.02		Apr 21, 2016	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims…
CVE-2016-3427	Sun Corporation Java Se	Cri	0.76	9.8	0.93	KEV	Apr 21, 2016	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2016-2008	Microfocus Storage Data Protector	Cri	0.65	9.8	0.13		Apr 21, 2016	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-2007	Microfocus Storage Data Protector	Cri	0.67	9.8	0.47		Apr 21, 2016	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354.
CVE-2016-2006	Microfocus Storage Data Protector	Cri	0.67	9.8	0.47		Apr 21, 2016	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353.
CVE-2016-2005	Microfocus Storage Data Protector	Cri	0.67	9.8	0.47		Apr 21, 2016	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352.
CVE-2016-2004	Microfocus Storage Data Protector	Cri	0.74	9.8	0.93		Apr 21, 2016	HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
CVE-2016-1363	Cisco Systems, Inc. Wireless Lan Controller Software	Cri	0.65	9.8	0.12		Apr 21, 2016	Buffer overflow in the redirection functionality in Cisco Wireless LAN Controller (WLC) Software 7.2 through 7.4 before 7.4.140.0(MD) and 7.5 through 8.0 before 8.0.115.0(ED) allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCus25617.
CVE-2016-0699	Oracle Corporation Flexcube Direct Banking	Cri	0.59	9.1	0.01		Apr 21, 2016	Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to the Login sub-component.
CVE-2016-0693	Oracle Corporation Solaris	Cri	0.64	9.8	0.02		Apr 21, 2016	Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the PAM LDAP module.

CVE-2016-1052CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1051CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1050CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.03
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1049CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1048CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1047CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1046CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1045CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified…
CVE-2016-1044CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.65cvss 10.0epss 0.05
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1043CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.03
Integer overflow in Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVE-2016-1042CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.01
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1041CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.65cvss 10.0epss 0.01
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1040CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.01
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1039CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.01
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1038CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.65cvss 10.0epss 0.05
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a…
CVE-2016-1037CriMay 11, 2016
Adobe Inc.
Acrobat
risk 0.64cvss 9.8epss 0.02
Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…
CVE-2016-4117CriKEVMay 11, 2016
Adobe Inc.
Flashplayer
risk 0.86cvss 9.8epss 0.93
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CVE-2016-1114CriMay 11, 2016
Adobe Inc.
Coldfusion
risk 0.64cvss 9.8epss 0.02
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVE-2016-4350CriMay 9, 2016
SolarWinds
Storage Resource Monitor
risk 0.69cvss 9.8epss 0.64
Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the…
CVE-2016-2429CriMay 9, 2016
Google
Android
risk 0.64cvss 9.8epss 0.01
libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service…
CVE-2016-2428CriMay 9, 2016
Google
Android
risk 0.64cvss 9.8epss 0.01
libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack…
CVE-2016-2351CriMay 7, 2016
Accellion
File Transfer Appliance
risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
CVE-2015-6552CriMay 7, 2016
Symantec
Netbackup
risk 0.64cvss 9.8epss 0.02
The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2…
CVE-2015-6550CriMay 7, 2016
Symantec
Netbackup
risk 0.64cvss 9.8epss 0.03
bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary…
CVE-2013-7455CriMay 7, 2016
Littlecms
Little CMS Color Engine
risk 0.58cvss 9.8epss 0.15
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.
CVE-2016-4422CriMay 6, 2016
Libpam Sshauth Project
Libpam Sshauth
risk 0.64cvss 9.8epss 0.00
The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth might allow context-dependent attackers to bypass authentication or gain privileges via a system user account.
CVE-2015-8863CriMay 6, 2016
Jqlang
Jq
risk 0.58cvss 9.8epss 0.10
Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
CVE-2015-0857CriMay 6, 2016
Tardiff Project
Tardiff
risk 0.64cvss 9.8epss 0.03
Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file.
CVE-2016-1387CriMay 5, 2016
Cisco Systems, Inc.
Collaboration Endpoint (CE)
risk 0.64cvss 9.8epss 0.01
The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0.1, and 8.1.0 in Cisco TelePresence Software mishandles authentication, which allows remote attackers to execute control commands or make…
CVE-2016-4351CriMay 5, 2016
Trend Micro
Email Encryption Gateway
risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-2108CriMay 5, 2016
OpenSSL Project
OpenSSL
risk 0.60cvss 9.8epss 0.37
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
CVE-2016-1343CriApr 30, 2016
Cisco Systems, Inc.
Information Server
risk 0.65cvss 10.0epss 0.01
The XML parser in Cisco Information Server (CIS) 6.2 allows remote attackers to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE)…
CVE-2015-8812CriApr 27, 2016
Linux
Kernel
risk 0.57cvss 9.8epss 0.04
drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
CVE-2016-4002CriApr 26, 2016
QEMU
Qemu
risk 0.64cvss 9.8epss 0.08
Buffer overflow in the mipsnet_receive function in hw/net/mipsnet.c in QEMU, when the guest NIC is configured to accept large packets, allows remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger…
CVE-2016-3082CriApr 26, 2016
Apache
Struts
risk 0.66cvss 9.8epss 0.25
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
CVE-2016-3074CriApr 26, 2016
Libgd
Libgd
risk 0.72cvss 9.8epss 0.60
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.
CVE-2016-1601CriApr 26, 2016
SUSE S.A.
Yast2
risk 0.64cvss 9.8epss 0.00
yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an AutoYaST installation when the profile does not contain inst-sys users, which might allow attackers to have unspecified impact via unknown…
CVE-2016-2331CriApr 25, 2016
Slink
Slink
risk 0.64cvss 9.8epss 0.00
The web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CVE-2016-3466CriApr 21, 2016
Oracle Corporation
Field Service
risk 0.59cvss 9.1epss 0.00
Unspecified vulnerability in the Oracle Field Service component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Wireless.
CVE-2016-3454CriApr 21, 2016
Oracle Corporation
Database Server
risk 0.59cvss 9.0epss 0.01
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2016-3443CriApr 21, 2016
Sun Corporation
Java Se
risk 0.63cvss 9.6epss 0.02
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. NOTE: the previous information is from the April 2016 CPU. Oracle has not commented on third-party claims…
CVE-2016-3427CriKEVApr 21, 2016
Sun Corporation
Java Se
risk 0.76cvss 9.8epss 0.93
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2016-2008CriApr 21, 2016
Microfocus
Storage Data Protector
risk 0.65cvss 9.8epss 0.13
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-2007CriApr 21, 2016
Microfocus
Storage Data Protector
risk 0.67cvss 9.8epss 0.47
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3354.
CVE-2016-2006CriApr 21, 2016
Microfocus
Storage Data Protector
risk 0.67cvss 9.8epss 0.47
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3353.
CVE-2016-2005CriApr 21, 2016
Microfocus
Storage Data Protector
risk 0.67cvss 9.8epss 0.47
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allows remote attackers to execute arbitrary code via unspecified vectors, aka ZDI-CAN-3352.
CVE-2016-2004CriApr 21, 2016
Microfocus
Storage Data Protector
risk 0.74cvss 9.8epss 0.93
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.
CVE-2016-1363CriApr 21, 2016
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.65cvss 9.8epss 0.12
Buffer overflow in the redirection functionality in Cisco Wireless LAN Controller (WLC) Software 7.2 through 7.4 before 7.4.140.0(MD) and 7.5 through 8.0 before 8.0.115.0(ED) allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCus25617.
CVE-2016-0699CriApr 21, 2016
Oracle Corporation
Flexcube Direct Banking
risk 0.59cvss 9.1epss 0.01
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attackers to affect confidentiality and integrity via vectors related to the Login sub-component.
CVE-2016-0693CriApr 21, 2016
Oracle Corporation
Solaris
risk 0.64cvss 9.8epss 0.02
Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the PAM LDAP module.