Overview 3,221 matches · 239 protected · 42 exploited · 17 CISA KEV · 212 public PoC · 90 EPSS ≥ 0.5
Protected by Waratek
240
7.5%
Rule in development
0
0.0%
Mitigation candidate
160
5.0%
No exploit published
2,821
87.6%
split by
peak 535 / year
19961
No exploit published1
High1
not blocked1
No public exploit1
19970
19980
19992
No exploit published2
High2
not blocked2
No public exploit2
200012
Mitigation candidate6
No exploit published6
High5
Medium7
not blocked12
Working exploit published6
No public exploit6
200113
Protected by Waratek1
Mitigation candidate2
No exploit published10
High7
Medium6
blocked by ARMR today1
not blocked12
Working exploit published2
No public exploit11
200237
Protected by Waratek3
Mitigation candidate8
No exploit published26
High11
Medium23
Low3
blocked by ARMR today3
not blocked34
Working exploit published8
Forecast only2
No public exploit27
200339
Protected by Waratek2
Mitigation candidate7
No exploit published30
High9
Medium24
Low6
blocked by ARMR today2
not blocked37
Working exploit published8
No public exploit31
200427
Protected by Waratek2
Mitigation candidate1
No exploit published24
High6
Medium18
Low3
blocked by ARMR today2
not blocked25
Working exploit published1
No public exploit26
200582
Protected by Waratek3
Mitigation candidate4
No exploit published75
Critical1
High30
Medium46
Low5
blocked by ARMR today3
not blocked79
Working exploit published5
No public exploit77
2006133
Protected by Waratek8
Mitigation candidate4
No exploit published121
High66
Medium56
Low11
blocked by ARMR today8
not blocked125
Exploited1
Working exploit published5
No public exploit127
2007150
Protected by Waratek6
Mitigation candidate10
No exploit published134
High68
Medium71
Low11
blocked by ARMR today6
not blocked144
Working exploit published11
No public exploit139
2008136
Protected by Waratek7
Mitigation candidate9
No exploit published120
High46
Medium83
Low7
blocked by ARMR today7
not blocked129
Exploited2
Working exploit published12
No public exploit122
2009203
Protected by Waratek9
Mitigation candidate13
No exploit published181
High52
Medium129
Low22
blocked by ARMR today9
not blocked194
Exploited1
Working exploit published16
No public exploit186
2010183
Protected by Waratek9
Mitigation candidate12
No exploit published162
Critical1
High27
Medium133
Low22
blocked by ARMR today9
not blocked174
Exploited3
Working exploit published14
Forecast only1
No public exploit165
2011193
Protected by Waratek6
Mitigation candidate9
No exploit published178
High20
Medium139
Low34
blocked by ARMR today6
not blocked187
Working exploit published11
Proof of concept only1
No public exploit181
2012311
Protected by Waratek9
Mitigation candidate24
No exploit published278
Critical3
High29
Medium199
Low80
blocked by ARMR today9
not blocked300
not established2
Exploited8
Working exploit published19
No public exploit284
2013349
Protected by Waratek26
Mitigation candidate18
No exploit published305
Critical1
High45
Medium249
Low54
blocked by ARMR today26
not blocked322
not established1
Exploited9
Working exploit published17
Proof of concept only1
Forecast only1
No public exploit321
2014335
Protected by Waratek41
Mitigation candidate12
No exploit published282
High30
Medium256
Low49
blocked by ARMR today41
not blocked294
Exploited4
Working exploit published14
Proof of concept only1
Forecast only2
No public exploit314
2015323
Protected by Waratek32
Mitigation candidate6
No exploit published285
Critical4
High42
Medium226
Low51
blocked by ARMR today32
not blocked291
Exploited4
Working exploit published8
Proof of concept only1
No public exploit310
2016535
Protected by Waratek58
Mitigation candidate12
No exploit published465
Critical47
High134
Medium321
Low33
blocked by ARMR today57
partly blocked1
not blocked476
not established1
Exploited8
Working exploit published18
Proof of concept only1
Forecast only5
No public exploit503
2017157
Protected by Waratek18
Mitigation candidate3
No exploit published136
Critical13
High77
Medium60
Low7
blocked by ARMR today18
not blocked139
Exploited2
Working exploit published6
Proof of concept only1
No public exploit148
19971999200120032005200720092011201320152017
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-5565 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated users to affect confidentiality via vectors related to OPERA. |
| CVE-2016-5564 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to OPERA. |
| CVE-2016-5563 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote administrators to affect confidentiality, integrity, and availability via vectors related to OPERA. |
| CVE-2016-5562 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle iProcurement component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5560 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 16.1 allows remote authenticated users to affect confidentiality and integrity via vectors related to OpenUI. |
| CVE-2016-5557 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Advanced Pricing component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5543 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Enterprise Limits and Collateral Management component in Oracle Financial Services Applications 12.0.0 and 12.1.0 allows remote attackers to affect confidentiality and integrity via vectors related to INFRA. |
| CVE-2016-5540 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Retail Xstore Payment component in Oracle Retail Applications 1.x allows local users to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5539 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Retail Xstore Payment component in Oracle Retail Applications 1.x allows local users to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2016-5537 | Medium | 2016-10-25 | Protected by Waratek | No public exploit | Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information is from the October 2016 CPU. Oracle has not commented on third-party claims that this issue is a directory traversal vulnerability which allows local users with certain permissions to write to arbitrary files and consequently gain privileges via a .. (dot dot) in a archive entry in a ZIP file imported as a project. |
| CVE-2016-5536 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-8281. |
| CVE-2016-5535 | Critical | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. |
| CVE-2016-5534 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Apps - Customer Order Management component in Oracle Siebel CRM 16.1 allows remote authenticated users to affect confidentiality via unknown vectors. |
| CVE-2016-5533 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 8.4, 15.x, and 16.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5532 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Shipping Execution component in Oracle E-Business Suite 12.1.1 through 12.1.3 and 12.2.3 through 12.2.6 allows remote attackers to affect confidentiality via vectors related to Workflow Events. |
| CVE-2016-5531 | Critical | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices. |
| CVE-2016-5530 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5529 and CVE-2016-8293. |
| CVE-2016-5529 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Integration Broker, a different vulnerability than CVE-2016-5530 and CVE-2016-8293. |
| CVE-2016-5527 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2016-5524. |
| CVE-2016-5526 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Apache Tomcat. |
| CVE-2016-5524 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2016-5527. |
| CVE-2016-5523 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to AutoVue Java Applet. |
| CVE-2016-5522 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via unknown vectors. |
| CVE-2016-5521 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-5512. |
| CVE-2016-5519 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Java Server Faces. |
| CVE-2016-5518 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to webfileservices. |
| CVE-2016-5517 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 allows local users to affect confidentiality via vectors related to AD Utilities. |
| CVE-2016-5515 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RMIServlet. |
| CVE-2016-5514 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to ExportServlet. |
| CVE-2016-5513 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to File Manager. |
| CVE-2016-5512 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-5521. |
| CVE-2016-5511 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 12.2.1.0.0, 12.2.1.1.0, and 12.2.1.2.0 allows remote attackers to affect integrity via unknown vectors. |
| CVE-2016-5510 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality via unknown vectors. |
| CVE-2016-5506 | Low | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware allows local users to affect confidentiality and integrity via vectors related to App Server. |
| CVE-2016-5504 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.1.0.4, 6.1.1.6, and 6.2.0.0 allows local users to affect confidentiality via vectors related to Supplier Portal. |
| CVE-2016-5502 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, 12.0.1 through 12.0.3 allows remote authenticated users to affect confidentiality and integrity via vectors related to INFRA. |
| CVE-2016-5500 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vectors related to Viewer. |
| CVE-2016-5495 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Discoverer component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vectors related to EUL Code & Schema. |
| CVE-2016-5493 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Private Banking component in Oracle Financial Services Applications 12.0.1 through 12.0.3 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5491 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Commerce Service Center component in Oracle Commerce 10.0.3.5 and 10.2.0.5 allows remote attackers to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5490 | Low | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.4.0 allows local users to affect confidentiality via vectors related to INFRA. |
| CVE-2016-5489 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.1.1 through 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via vectors related to Runtime Catalog. |
| CVE-2016-5488 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.3.0 allows remote attackers to affect availability via vectors related to Web Container, a different vulnerability than CVE-2016-3445. |
| CVE-2016-5482 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Commerce Guided Search component in Oracle Commerce 6.2.2, 6.3.0, 6.4.1.2, and 6.5.0 through 6.5.2 allows remote attackers to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-5479 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.3.0, 11.4.0, and 12.0.1 allows remote authenticated users to affect confidentiality via vectors related to INFRA. |
| CVE-2016-3551 | Critical | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Web Services component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXWS Web Services Stack. |
| CVE-2016-3505 | High | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces. |
| CVE-2016-3473 | High | 2016-10-25 | Mitigation candidate | Working exploit published | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors. |
| CVE-2016-1000031 | Critical | 2016-10-25 | Protected by Waratek | No public exploit | Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution |
| CVE-2016-0377 | Medium | 2016-10-22 | No exploit published | No public exploit | The Administrative Console in IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, and 8.5.x before 8.5.5.10 mishandles CSRFtoken cookies, which allows remote authenticated users to obtain sensitive information via unspecified vectors. |
| CVE-2016-7065 | High | 2016-10-13 | Protected by Waratek | Working exploit published | The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object. |
| CVE-2016-6325 | High | 2016-10-13 | No exploit published | No public exploit | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2) /etc/tomcat/tomcat.conf, which allows local users to gain privileges by leveraging membership in the tomcat group. |
| CVE-2016-5425 | High | 2016-10-13 | Mitigation candidate | Working exploit published | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group. |
| CVE-2015-2080 | High | 2016-10-07 | Mitigation candidate | Working exploit published | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak. |
| CVE-2016-6652 | Medium | 2016-10-05 | Protected by Waratek | No public exploit | SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call. |
| CVE-2016-5983 | High | 2016-10-05 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object. |
| CVE-2016-7046 | Medium | 2016-10-03 | No exploit published | No public exploit | Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL. |
| CVE-2016-5398 | Medium | 2016-10-03 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes. |
| CVE-2016-5019 | Critical | 2016-10-03 | Protected by Waratek | No public exploit | CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string. |
| CVE-2016-4436 | Critical | 2016-10-03 | No exploit published | No public exploit | Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up. |
| CVE-2016-1240 | High | 2016-10-03 | Mitigation candidate | Working exploit published | The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out. |
| CVE-2016-5986 | High | 2016-10-01 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.x before 8.0.0.13, 8.5.x before 8.5.5.11, 9.0.x before 9.0.0.2, and Liberty before 16.0.0.3 mishandles responses, which allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2016-3042 | Medium | 2016-10-01 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Application Server (WAS) Liberty before 16.0.0.3 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving OpenID Connect clients. |
| CVE-2016-6637 | Critical | 2016-09-30 | No exploit published | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page. |
| CVE-2016-6330 | Critical | 2016-09-27 | Protected by Waratek | No public exploit | The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737. |
| CVE-2016-4978 | High | 2016-09-27 | Protected by Waratek | No public exploit | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath. |
| CVE-2016-5406 | High | 2016-09-26 | No exploit published | No public exploit | The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves. |
| CVE-2016-5395 | Medium | 2016-09-26 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies. |
| CVE-2016-4993 | Medium | 2016-09-26 | No exploit published | No public exploit | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. |
| CVE-2016-6801 | High | 2016-09-21 | No exploit published | No public exploit | Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header. |
| CVE-2016-4464 | Critical | 2016-09-21 | No exploit published | No public exploit | The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature. |
| CVE-2016-6802 | High | 2016-09-20 | No exploit published | No public exploit | Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path. |
| CVE-2016-7034 | High | 2016-09-07 | No exploit published | No public exploit | The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF protection mechanisms or (2) conduct cross-site request forgery (CSRF) attacks by obtaining an old token. |
| CVE-2016-7033 | Medium | 2016-09-07 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2016-6346 | High | 2016-09-07 | No exploit published | No public exploit | RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors. |
| CVE-2016-6345 | Medium | 2016-09-07 | No exploit published | No public exploit | RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs. |
| CVE-2016-6344 | Medium | 2016-09-07 | No exploit published | No public exploit | Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies. |
| CVE-2016-5422 | High | 2016-09-07 | No exploit published | No public exploit | The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request. |
| CVE-2016-3089 | Medium | 2016-08-19 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter. |
| CVE-2016-2960 | Low | 2016-08-08 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages. |
| CVE-2016-5000 | Medium | 2016-08-05 | Protected by Waratek | No public exploit | The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2016-4999 | Critical | 2016-08-05 | Protected by Waratek | No public exploit | SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI. |
| CVE-2016-0782 | Medium | 2016-08-05 | No exploit published | No public exploit | The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue. |
| CVE-2016-3737 | Critical | 2016-08-02 | Protected by Waratek | No public exploit | The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. |
| CVE-2016-5005 | Medium | 2016-07-28 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action. |
| CVE-2016-5477 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1 and 3.0.1 allows remote attackers to affect confidentiality via vectors related to Administration. |
| CVE-2016-5476 | High | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Retail Applications 13.0, 13.1, 13.2, 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Install. |
| CVE-2016-5475 | High | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to Install. |
| CVE-2016-5474 | High | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Retail Service Backbone component in Oracle Retail Applications 14.0, 14.1, and 15.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to RSB Kernel. |
| CVE-2016-5473 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to File Folders / Attachment, a different vulnerability than CVE-2016-3537. |
| CVE-2016-5472 | High | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows local users to affect confidentiality, integrity, and availability via vectors related to Install and Packaging. |
| CVE-2016-5470 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 and 8.55 allows remote attackers to affect confidentiality via vectors related to Application Designer. |
| CVE-2016-5468 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect confidentiality and integrity via vectors related to EAI, a different vulnerability than CVE-2016-5451. |
| CVE-2016-5467 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise FSCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to eProcurement. |
| CVE-2016-5466 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-3450 and CVE-2016-5460. |
| CVE-2016-5465 | High | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53, 8.54, and 8.55 allows remote attackers to affect confidentiality and integrity via vectors related to Panel Processor. |
| CVE-2016-5464 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect integrity via vectors related to SWSE Server, a different vulnerability than CVE-2016-5463. |
| CVE-2016-5463 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect integrity via vectors related to SWSE Server, a different vulnerability than CVE-2016-5464. |
| CVE-2016-5462 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote administrators to affect confidentiality via vectors related to Workspaces. |
| CVE-2016-5461 | Medium | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote authenticated users to affect confidentiality via vectors related to Object Manager. |