CVEs

31,434 total · page 601 of 629

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2016-4060	Foxitsoftware Reader	Hig	0.49	7.5	0.00	Apr 22, 2016	Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVE-2016-4059	Foxitsoftware Reader	Hig	0.51	7.8	0.01	Apr 22, 2016	Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document.
CVE-2016-1593	Novell Service Desk	Hig	0.57	7.2	0.85	Apr 22, 2016	Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a…
CVE-2016-2354	Lemurmonitors Bluedriver	Hig	0.57	8.8	0.00	Apr 22, 2016	The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a…
CVE-2016-2306	Ecava Integraxor	Hig	0.49	7.5	0.00	Apr 22, 2016	The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVE-2016-2299	Ecava Integraxor	Hig	0.48	7.3	0.01	Apr 22, 2016	SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-3190	Cairographics Cairo	Hig	0.49	7.5	0.01	Apr 21, 2016	The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
CVE-2016-3461	Oracle Corporation Mysql Enterprise Monitor	Hig	0.47	7.2	0.01	Apr 21, 2016	Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to affect confidentiality, integrity, and availability via vectors related to Monitoring: Server.
CVE-2016-3456	Oracle Corporation Complex Maintenance Repair And Overhaul	Hig	0.53	8.2	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul component in Oracle Supply Chain Products Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Dialog Box.
CVE-2016-3455	Oracle Corporation Outside In Technology	Hig	0.56	8.6	0.01	Apr 21, 2016	Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters.
CVE-2016-3449	Sun Corporation Java Se	Hig	0.54	8.3	0.04	Apr 21, 2016	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.
CVE-2016-3441	Oracle Corporation Solaris	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect confidentiality, integrity, and availability via vectors related to Filesystem.
CVE-2016-3439	Oracle Corporation CRM Technical Foundation	Hig	0.53	8.2	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Call Phone Number Page.
CVE-2016-3438	Oracle Corporation Configurator	Hig	0.53	8.2	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April…
CVE-2016-3437	Oracle Corporation CRM Technical Foundation	Hig	0.53	8.2	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Person Address Page.
CVE-2016-3436	Oracle Corporation Common Applications Calendar	Hig	0.53	8.2	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Tasks.
CVE-2016-3421	Oracle Corporation Peoplesoft Enterprise Peopletools	Hig	0.48	7.4	0.00	Apr 21, 2016	Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Activity Guide.
CVE-2016-3418	Oracle Corporation Berkeley Db	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-2294	Accuenergy Acuvim Iir Net Firmware	Hig	0.49	7.5	0.00	Apr 21, 2016	The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover a cleartext mail-server password via unspecified vectors.
CVE-2016-2293	Accuenergy Acuvim Iir Net Firmware	Hig	0.56	8.6	0.00	Apr 21, 2016	The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover settings via a direct request to an unspecified URL.
CVE-2016-2280	Honeywell Uniformance Process History Database	Hig	0.49	7.5	0.00	Apr 21, 2016	Buffer overflow in RDISERVER in Honeywell Uniformance Process History Database (PHD) R310, R320, and R321 allows remote attackers to cause a denial of service (service outage) via unspecified vectors.
CVE-2016-1367	Cisco Systems, Inc. Cisco Adaptive Security Appliance	Hig	0.49	7.5	0.00	Apr 21, 2016	The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug ID CSCus23248.
CVE-2016-1364	Cisco Systems, Inc. Wireless Lan Controller Software	Hig	0.49	7.5	0.01	Apr 21, 2016	Cisco Wireless LAN Controller (WLC) Software 7.4 before 7.4.130.0(MD) and 7.5, 7.6, and 8.0 before 8.0.110.0(ED) allows remote attackers to cause a denial of service (device reload) via crafted Bonjour traffic, aka Bug ID CSCur66908.
CVE-2016-1362	Cisco Systems, Inc. Aireos	Hig	0.49	7.5	0.00	Apr 21, 2016	Cisco AireOS 4.1 through 7.4.120.0, 7.5.x, and 7.6.100.0 on Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug ID CSCun86747.
CVE-2016-0694	Oracle Corporation Berkeley Db	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0692	Oracle Corporation Berkeley Db	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0689	Oracle Corporation Berkeley Db	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0682	Oracle Corporation Berkeley Db	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0681	Oracle Corporation Olap	Hig	0.51	7.8	0.00	Apr 21, 2016	Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unspecified vectors.
CVE-2016-0679	Oracle Corporation Peoplesoft Enterprise Peopletools	Hig	0.57	8.7	0.00	Apr 21, 2016	Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect integrity and availability via vectors related to PIA Grids.
CVE-2015-6360	Cisco Systems, Inc. Libsrtp	Hig	0.50	7.5	0.18	Apr 21, 2016	The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.
CVE-2016-1384	Cisco Systems, Inc. Cisco iOS	Hig	0.49	7.5	0.00	Apr 20, 2016	The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID CSCux46898.
CVE-2016-0891	EMC Corporation Vipr Srm	Hig	0.60	8.8	0.03	Apr 20, 2016	Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.
CVE-2015-7801	Optipng Project Optipng	Hig	0.57	8.8	0.02	Apr 20, 2016	Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
CVE-2016-3628	TIBCO Software Enterprise Message Service	Hig	0.57	8.8	0.03	Apr 20, 2016	Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.
CVE-2016-0741	Fedoraproject 389 Directory Server	Hig	0.49	7.5	0.04	Apr 19, 2016	slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
CVE-2014-9765	Xdelta Xdelta3	Hig	0.50	8.8	0.02	Apr 19, 2016	Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
CVE-2016-4040	Dotcms Dotcms	Hig	0.47	7.2	0.00	Apr 19, 2016	SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
CVE-2016-3960	Xen Xen	Hig	0.57	8.8	0.00	Apr 19, 2016	Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
CVE-2016-3943	WatchGuard Panda Endpoint Administration Agent	Hig	0.54	7.8	0.00	Apr 18, 2016	Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module.
CVE-2015-7378	Pandasecurity URL Filtering	Hig	0.54	7.8	0.00	Apr 18, 2016	Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
CVE-2016-3071	Libreswan Libreswan	Hig	0.49	7.5	0.01	Apr 18, 2016	Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
CVE-2015-8106	Latex2rtf Latex2rtf	Hig	0.51	7.8	0.01	Apr 18, 2016	Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
CVE-2015-7552	GdkPixbuf GdkPixbuf	Hig	0.51	7.8	0.02	Apr 18, 2016	Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
CVE-2016-1656	Google Chrome	Hig	0.49	7.5	0.00	Apr 18, 2016	The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
CVE-2016-1655	Google Chrome	Hig	0.57	8.8	0.03	Apr 18, 2016	Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.
CVE-2016-1653	Google Chrome	Hig	0.57	8.8	0.02	Apr 18, 2016	The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write…
CVE-2016-1651	Google Chrome	Hig	0.53	8.1	0.02	Apr 18, 2016	fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service…
CVE-2016-2422	Google Android	Hig	0.51	7.8	0.00	Apr 18, 2016	Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining…
CVE-2016-2420	Google Android	Hig	0.51	7.8	0.00	Apr 18, 2016	rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.

CVE-2016-4060HigApr 22, 2016
Foxitsoftware
Reader
risk 0.49cvss 7.5epss 0.00
Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVE-2016-4059HigApr 22, 2016
Foxitsoftware
Reader
risk 0.51cvss 7.8epss 0.01
Use-after-free vulnerability in Foxit Reader and PhantomPDF before 7.3.4 on Windows allows remote attackers to execute arbitrary code via a crafted FlateDecode stream in a PDF document.
CVE-2016-1593HigApr 22, 2016
Novell
Service Desk
risk 0.57cvss 7.2epss 0.85
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a .. (dot dot) in a filename within a multipart/form-data POST request to a…
CVE-2016-2354HigApr 22, 2016
Lemurmonitors
Bluedriver
risk 0.57cvss 8.8epss 0.00
The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a…
CVE-2016-2306HigApr 22, 2016
Ecava
Integraxor
risk 0.49cvss 7.5epss 0.00
The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network.
CVE-2016-2299HigApr 22, 2016
Ecava
Integraxor
risk 0.48cvss 7.3epss 0.01
SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-3190HigApr 21, 2016
Cairographics
Cairo
risk 0.49cvss 7.5epss 0.01
The fill_xrgb32_lerp_opaque_spans function in cairo-image-compositor.c in cairo before 1.14.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a negative span length.
CVE-2016-3461HigApr 21, 2016
Oracle Corporation
Mysql Enterprise Monitor
risk 0.47cvss 7.2epss 0.01
Unspecified vulnerability in the MySQL Enterprise Monitor component in Oracle MySQL 3.0.25 and earlier and 3.1.2 and earlier allows remote administrators to affect confidentiality, integrity, and availability via vectors related to Monitoring: Server.
CVE-2016-3456HigApr 21, 2016
Oracle Corporation
Complex Maintenance Repair And Overhaul
risk 0.53cvss 8.2epss 0.00
Unspecified vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul component in Oracle Supply Chain Products Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Dialog Box.
CVE-2016-3455HigApr 21, 2016
Oracle Corporation
Outside In Technology
risk 0.56cvss 8.6epss 0.01
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Outside In Filters.
CVE-2016-3449HigApr 21, 2016
Sun Corporation
Java Se
risk 0.54cvss 8.3epss 0.04
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.
CVE-2016-3441HigApr 21, 2016
Oracle Corporation
Solaris
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect confidentiality, integrity, and availability via vectors related to Filesystem.
CVE-2016-3439HigApr 21, 2016
Oracle Corporation
CRM Technical Foundation
risk 0.53cvss 8.2epss 0.00
Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Call Phone Number Page.
CVE-2016-3438HigApr 21, 2016
Oracle Corporation
Configurator
risk 0.53cvss 8.2epss 0.00
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat. NOTE: the previous information is from the April…
CVE-2016-3437HigApr 21, 2016
Oracle Corporation
CRM Technical Foundation
risk 0.53cvss 8.2epss 0.00
Unspecified vulnerability in the Oracle CRM Wireless component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Person Address Page.
CVE-2016-3436HigApr 21, 2016
Oracle Corporation
Common Applications Calendar
risk 0.53cvss 8.2epss 0.00
Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Tasks.
CVE-2016-3421HigApr 21, 2016
Oracle Corporation
Peoplesoft Enterprise Peopletools
risk 0.48cvss 7.4epss 0.00
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Activity Guide.
CVE-2016-3418HigApr 21, 2016
Oracle Corporation
Berkeley Db
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-2294HigApr 21, 2016
Accuenergy
Acuvim Iir Net Firmware
risk 0.49cvss 7.5epss 0.00
The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover a cleartext mail-server password via unspecified vectors.
CVE-2016-2293HigApr 21, 2016
Accuenergy
Acuvim Iir Net Firmware
risk 0.56cvss 8.6epss 0.00
The AXM-NET module in Accuenergy Acuvim II NET Firmware 3.08 and Acuvim IIR NET Firmware 3.08 allows remote attackers to discover settings via a direct request to an unspecified URL.
CVE-2016-2280HigApr 21, 2016
Honeywell
Uniformance Process History Database
risk 0.49cvss 7.5epss 0.00
Buffer overflow in RDISERVER in Honeywell Uniformance Process History Database (PHD) R310, R320, and R321 allows remote attackers to cause a denial of service (service outage) via unspecified vectors.
CVE-2016-1367HigApr 21, 2016
Cisco Systems, Inc.
Cisco Adaptive Security Appliance
risk 0.49cvss 7.5epss 0.00
The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug ID CSCus23248.
CVE-2016-1364HigApr 21, 2016
Cisco Systems, Inc.
Wireless Lan Controller Software
risk 0.49cvss 7.5epss 0.01
Cisco Wireless LAN Controller (WLC) Software 7.4 before 7.4.130.0(MD) and 7.5, 7.6, and 8.0 before 8.0.110.0(ED) allows remote attackers to cause a denial of service (device reload) via crafted Bonjour traffic, aka Bug ID CSCur66908.
CVE-2016-1362HigApr 21, 2016
Cisco Systems, Inc.
Aireos
risk 0.49cvss 7.5epss 0.00
Cisco AireOS 4.1 through 7.4.120.0, 7.5.x, and 7.6.100.0 on Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug ID CSCun86747.
CVE-2016-0694HigApr 21, 2016
Oracle Corporation
Berkeley Db
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0692HigApr 21, 2016
Oracle Corporation
Berkeley Db
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0689HigApr 21, 2016
Oracle Corporation
Berkeley Db
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0682HigApr 21, 2016
Oracle Corporation
Berkeley Db
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the DataStore component in Oracle Berkeley DB 11.2.5.0.32, 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, 12.1.6.0.35, and 12.1.6.1.26 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability…
CVE-2016-0681HigApr 21, 2016
Oracle Corporation
Olap
risk 0.51cvss 7.8epss 0.00
Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality, integrity, and availability via unspecified vectors.
CVE-2016-0679HigApr 21, 2016
Oracle Corporation
Peoplesoft Enterprise Peopletools
risk 0.57cvss 8.7epss 0.00
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote authenticated users to affect integrity and availability via vectors related to PIA Grids.
CVE-2015-6360HigApr 21, 2016
Cisco Systems, Inc.
Libsrtp
risk 0.50cvss 7.5epss 0.18
The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686.
CVE-2016-1384HigApr 20, 2016
Cisco Systems, Inc.
Cisco iOS
risk 0.49cvss 7.5epss 0.00
The NTP implementation in Cisco IOS 15.1 and 15.5 and IOS XE 3.2 through 3.17 allows remote attackers to modify the system time via crafted packets, aka Bug ID CSCux46898.
CVE-2016-0891HigApr 20, 2016
EMC Corporation
Vipr Srm
risk 0.60cvss 8.8epss 0.03
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.
CVE-2015-7801HigApr 20, 2016
Optipng Project
Optipng
risk 0.57cvss 8.8epss 0.02
Use-after-free vulnerability in OptiPNG 0.6.4 allows remote attackers to execute arbitrary code via a crafted PNG file.
CVE-2016-3628HigApr 20, 2016
TIBCO Software
Enterprise Message Service
risk 0.57cvss 8.8epss 0.03
Buffer overflow in tibemsd in the server in TIBCO Enterprise Message Service (EMS) before 8.3.0 and EMS Appliance before 2.4.0 allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via crafted inbound data.
CVE-2016-0741HigApr 19, 2016
Fedoraproject
389 Directory Server
risk 0.49cvss 7.5epss 0.04
slapd/connection.c in 389 Directory Server (formerly Fedora Directory Server) 1.3.4.x before 1.3.4.7 allows remote attackers to cause a denial of service (infinite loop and connection blocking) by leveraging an abnormally closed connection.
CVE-2014-9765HigApr 19, 2016
Xdelta
Xdelta3
risk 0.50cvss 8.8epss 0.02
Buffer overflow in the main_get_appheader function in xdelta3-main.h in xdelta3 before 3.0.9 allows remote attackers to execute arbitrary code via a crafted input file.
CVE-2016-4040HigApr 19, 2016
Dotcms
Dotcms
risk 0.47cvss 7.2epss 0.00
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
CVE-2016-3960HigApr 19, 2016
Xen
Xen
risk 0.57cvss 8.8epss 0.00
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
CVE-2016-3943HigApr 18, 2016
WatchGuard
Panda Endpoint Administration Agent
risk 0.54cvss 7.8epss 0.00
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent directory and sub-directories, which allows local users to gain SYSTEM privileges by modifying an executable module.
CVE-2015-7378HigApr 18, 2016
Pandasecurity
URL Filtering
risk 0.54cvss 7.8epss 0.00
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to gain SYSTEM privileges by modifying Panda_URL_Filteringb.exe.
CVE-2016-3071HigApr 18, 2016
Libreswan
Libreswan
risk 0.49cvss 7.5epss 0.01
Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
CVE-2015-8106HigApr 18, 2016
Latex2rtf
Latex2rtf
risk 0.51cvss 7.8epss 0.01
Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary code via format string specifiers in the \keywords command in a crafted TeX file.
CVE-2015-7552HigApr 18, 2016
GdkPixbuf
GdkPixbuf
risk 0.51cvss 7.8epss 0.02
Heap-based buffer overflow in the gdk_pixbuf_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted BMP file.
CVE-2016-1656HigApr 18, 2016
Google
Chrome
risk 0.49cvss 7.5epss 0.00
The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.
CVE-2016-1655HigApr 18, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.03
Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.
CVE-2016-1653HigApr 18, 2016
Google
Chrome
risk 0.57cvss 8.8epss 0.02
The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds write…
CVE-2016-1651HigApr 18, 2016
Google
Chrome
risk 0.53cvss 8.1epss 0.02
fxcodec/codec/fx_codec_jpx_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420_to_rgb and sycc422_to_rgb functions, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service…
CVE-2016-2422HigApr 18, 2016
Google
Android
risk 0.51cvss 7.8epss 0.00
Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining…
CVE-2016-2420HigApr 18, 2016
Google
Android
risk 0.51cvss 7.8epss 0.00
rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.