WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Published to 2016-03-31✕
Overview 75,535 matches · 2,521 in Waratek scope · 0 protected · 755 exploited · 196 CISA KEV · 19,919 public PoC · 1,405 EPSS ≥ 0.5
75,535matches 2,521in Waratek scope3.3% 0protected0.0% 755exploited1.0% 196CISA KEV0.3% 19,919public PoC26.4% 1,405EPSS ≥ 0.51.9%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 144 0.2% No exploit published 2,377 3.1% Outside Waratek scope 1,421 1.9% Not applicable 70,756 93.7% Withdrawn CVE 837 1.1%
Critical 399 0.5% High 30,373 40.2% Medium 38,602 51.1% Low 5,324 7.0% None 0 0.0% Unknown 837 1.1%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 75,535 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 755 1.0% Working exploit published 19,389 25.7% Proof of concept only 60 0.1% Forecast only 175 0.2% No public exploit 55,156 73.0%
split by peak 7,967 / year
Withdrawn CVE: 837Not applicable: 70,756Outside Waratek scope: 1,421No exploit published: 2,377Mitigation candidate: 144 Unknown: 837Low: 5,324Medium: 38,602High: 30,373Critical: 399 not blocked: 75,535 No public exploit: 55,156Forecast only: 175Proof of concept only: 60Working exploit published: 19,389Exploited: 755
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199426 Not applicable25 Withdrawn CVE1 High14 Medium10 Low1 Unknown1 not blocked26 Working exploit published6 No public exploit20 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199675 No exploit published1 Not applicable73 Withdrawn CVE1 Critical1 High43 Medium21 Low9 Unknown1 not blocked75 Working exploit published18 Forecast only1 No public exploit56 1997253 Not applicable252 Withdrawn CVE1 Critical1 High143 Medium89 Low19 Unknown1 not blocked253 Exploited2 Working exploit published73 Forecast only2 No public exploit176 1998247 Not applicable246 Withdrawn CVE1 Critical1 High137 Medium85 Low23 Unknown1 not blocked247 Exploited1 Working exploit published50 No public exploit196 1999923 No exploit published2 Outside Waratek scope1 Not applicable891 Withdrawn CVE29 Critical3 High423 Medium357 Low111 Unknown29 not blocked923 Exploited2 Working exploit published282 No public exploit639 20001,020 Mitigation candidate6 No exploit published6 Outside Waratek scope2 Not applicable1,005 Withdrawn CVE1 Critical2 High454 Medium467 Low96 Unknown1 not blocked1,020 Exploited5 Working exploit published427 Forecast only1 No public exploit587 20011,678 Mitigation candidate2 No exploit published10 Outside Waratek scope14 Not applicable1,649 Withdrawn CVE3 Critical12 High775 Medium706 Low182 Unknown3 not blocked1,678 Exploited14 Working exploit published480 Forecast only2 No public exploit1,182 20022,167 Mitigation candidate8 No exploit published26 Outside Waratek scope12 Not applicable2,107 Withdrawn CVE14 Critical10 High1,022 Medium978 Low143 Unknown14 not blocked2,167 Exploited12 Working exploit published545 Forecast only9 No public exploit1,601 20031,546 Mitigation candidate7 No exploit published30 Outside Waratek scope6 Not applicable1,482 Withdrawn CVE21 Critical9 High674 Medium745 Low97 Unknown21 not blocked1,546 Exploited10 Working exploit published498 Forecast only1 No public exploit1,037 20042,477 Mitigation candidate1 No exploit published24 Outside Waratek scope8 Not applicable2,416 Withdrawn CVE28 Critical10 High972 Medium1,264 Low203 Unknown28 not blocked2,477 Exploited21 Working exploit published755 Forecast only1 No public exploit1,700 20055,007 Mitigation candidate4 No exploit published75 Outside Waratek scope17 Not applicable4,833 Withdrawn CVE78 Critical13 High2,048 Medium2,427 Low441 Unknown78 not blocked5,007 Exploited22 Working exploit published1,340 Forecast only11 No public exploit3,634 20066,651 Mitigation candidate4 No exploit published121 Outside Waratek scope67 Not applicable6,408 Withdrawn CVE51 Critical12 High2,759 Medium3,320 Low509 Unknown51 not blocked6,651 Exploited36 Working exploit published2,439 Proof of concept only1 Forecast only6 No public exploit4,169 20076,590 Mitigation candidate10 No exploit published134 Outside Waratek scope83 Not applicable6,283 Withdrawn CVE80 Critical21 High3,159 Medium3,099 Low231 Unknown80 not blocked6,590 Exploited47 Working exploit published2,494 Proof of concept only5 Forecast only5 No public exploit4,039 20085,657 Mitigation candidate9 No exploit published120 Outside Waratek scope74 Not applicable5,422 Withdrawn CVE32 Critical19 High2,843 Medium2,578 Low185 Unknown32 not blocked5,657 Exploited40 Working exploit published2,515 Proof of concept only4 Forecast only9 No public exploit3,089 20095,769 Mitigation candidate13 No exploit published181 Outside Waratek scope62 Not applicable5,467 Withdrawn CVE46 Critical15 High2,731 Medium2,781 Low196 Unknown46 not blocked5,769 Exploited73 Working exploit published2,587 Proof of concept only2 Forecast only3 No public exploit3,104 20104,658 Mitigation candidate12 No exploit published162 Outside Waratek scope86 Not applicable4,370 Withdrawn CVE28 Critical27 High2,091 Medium2,235 Low277 Unknown28 not blocked4,658 Exploited71 Working exploit published1,310 Proof of concept only1 Forecast only9 No public exploit3,267 20114,166 Mitigation candidate9 No exploit published178 Outside Waratek scope116 Not applicable3,841 Withdrawn CVE22 Critical5 High1,783 Medium2,097 Low259 Unknown22 not blocked4,166 Exploited50 Working exploit published689 Proof of concept only4 Forecast only4 No public exploit3,419 20125,340 Mitigation candidate22 No exploit published278 Outside Waratek scope94 Not applicable4,883 Withdrawn CVE63 Critical18 High1,722 Medium3,029 Low508 Unknown63 not blocked5,340 Exploited54 Working exploit published831 Proof of concept only7 Forecast only46 No public exploit4,402 20135,297 Mitigation candidate17 No exploit published305 Outside Waratek scope300 Not applicable4,538 Withdrawn CVE137 Critical22 High1,723 Medium2,901 Low514 Unknown137 not blocked5,297 Exploited90 Working exploit published517 Proof of concept only2 Forecast only21 No public exploit4,667 20147,967 Mitigation candidate12 No exploit published282 Outside Waratek scope253 Not applicable7,340 Withdrawn CVE80 Critical20 High1,929 Medium5,282 Low656 Unknown80 not blocked7,967 Exploited95 Working exploit published791 Proof of concept only12 Forecast only14 No public exploit7,055 20156,563 Mitigation candidate6 No exploit published285 Outside Waratek scope202 Not applicable5,969 Withdrawn CVE101 Critical48 High2,346 Medium3,481 Low587 Unknown101 not blocked6,563 Exploited92 Working exploit published643 Proof of concept only16 Forecast only19 No public exploit5,793 20161,375 Mitigation candidate2 No exploit published157 Outside Waratek scope24 Not applicable1,174 Withdrawn CVE18 Critical129 High522 Medium634 Low72 Unknown18 not blocked1,375 Exploited18 Working exploit published90 Proof of concept only6 Forecast only11 No public exploit1,250
1989199219951998200120042007201020132016
75,535 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 756 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-3142 High 2016-03-31 Not applicable No public exploit The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.
CVE-2016-3141 Critical 2016-03-31 Not applicable Proof of concept only Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
CVE-2015-8837 High 2016-03-30 Not applicable No public exploit Stack-based buffer overflow in the isofs_real_readdir function in isofs.c in FuseISO 20070708 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long pathname in an ISO file.
CVE-2015-8836 High 2016-03-30 Not applicable No public exploit Integer overflow in the isofs_real_read_zf function in isofs.c in FuseISO 20070708 might allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large ZF block size in an ISO file, leading to a heap-based buffer overflow.
CVE-2016-3679 High 2016-03-29 Not applicable No public exploit Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-2288 High 2016-03-29 Not applicable Working exploit published Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file.
CVE-2016-1760 Medium 2016-03-29 Not applicable No public exploit The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app.
CVE-2016-1650 High 2016-03-29 Not applicable No public exploit The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.
CVE-2016-1649 High 2016-03-29 Not applicable No public exploit The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type mismatch, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted shader stages.
CVE-2016-1648 High 2016-03-29 Not applicable No public exploit Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes_extension_bindings.cc in the Extensions implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-1647 High 2016-03-29 Not applicable No public exploit Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2016-1646 High 2016-03-29 Not applicable Exploited The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-2344 High 2016-03-28 Not applicable No public exploit Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted command. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.
CVE-2016-1314 Medium 2016-03-28 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (CDM) 8.1(1) allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux80760.
CVE-2016-0226 High 2016-03-28 Not applicable No public exploit The client implementation in IBM Informix Dynamic Server 11.70.xCn on Windows does not properly restrict access to the (1) nsrd, (2) nsrexecd, and (3) portmap executable files, which allows local users to gain privileges via a Trojan horse file.
CVE-2014-9769 High 2016-03-28 Not applicable No public exploit pcre_jit_compile.c in PCRE 8.35 does not properly use table jumps to optimize nested alternatives, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a crafted string, as demonstrated by packets encountered by Suricata during use of a regular expression in an Emerging Threats Open ruleset.
CVE-2016-3119 Medium 2016-03-26 Not applicable No public exploit The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
CVE-2016-1351 High 2016-03-26 Not applicable No public exploit The Locator/ID Separation Protocol (LISP) implementation in Cisco IOS 15.1 and 15.2 and NX-OS 4.1 through 6.2 allows remote attackers to cause a denial of service (device reload) via a crafted header in a packet, aka Bug ID CSCuu64279.
CVE-2016-1350 High 2016-03-26 Not applicable No public exploit Cisco IOS 15.3 and 15.4, Cisco IOS XE 3.8 through 3.11, and Cisco Unified Communications Manager allow remote attackers to cause a denial of service (device reload) via malformed SIP messages, aka Bug ID CSCuj23293.
CVE-2016-1349 High 2016-03-26 Not applicable No public exploit The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet, aka Bug ID CSCuv45410.
CVE-2016-1348 High 2016-03-26 Not applicable No public exploit Cisco IOS 15.0 through 15.5 and IOS XE 3.3 through 3.16 allow remote attackers to cause a denial of service (device reload) via a crafted DHCPv6 Relay message, aka Bug ID CSCus55821.
CVE-2016-1344 Medium 2016-03-26 Not applicable No public exploit The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets, aka Bug ID CSCux38417.
CVE-2016-1160 Medium 2016-03-26 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-2340 Medium 2016-03-25 Not applicable No public exploit The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-1788 Medium 2016-03-24 Not applicable No public exploit Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechanism, which allows remote attackers to read message attachments via vectors related to duplicate messages.
CVE-2016-1787 Medium 2016-03-24 Not applicable No public exploit Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors.
CVE-2016-1786 Medium 2016-03-24 Not applicable No public exploit The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.
CVE-2016-1785 Medium 2016-03-24 Not applicable No public exploit The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
CVE-2016-1784 Medium 2016-03-24 Not applicable No public exploit The History implementation in WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to cause a denial of service (resource consumption and application crash) via a crafted web site.
CVE-2016-1783 High 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2016-1782 Medium 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypass intended port restrictions via a crafted web site.
CVE-2016-1781 Medium 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.
CVE-2016-1780 Medium 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment via a crafted web site.
CVE-2016-1779 Medium 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.
CVE-2016-1778 High 2016-03-24 Not applicable No public exploit WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2016-1777 High 2016-03-24 Not applicable No public exploit Web Server in Apple OS X Server before 5.1 supports the RC4 algorithm, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVE-2016-1776 Medium 2016-03-24 Not applicable No public exploit Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request.
CVE-2016-1775 High 2016-03-24 Not applicable No public exploit TrueTypeScaler in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
CVE-2016-1774 Medium 2016-03-24 Not applicable No public exploit The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading backup data that lacks intended restrictions.
CVE-2016-1773 Low 2016-03-24 Not applicable No public exploit The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via unspecified vectors.
CVE-2016-1772 Medium 2016-03-24 Not applicable No public exploit The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors.
CVE-2016-1771 Medium 2016-03-24 Not applicable No public exploit The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site.
CVE-2016-1770 Medium 2016-03-24 Not applicable No public exploit The Reminders component in Apple OS X before 10.11.4 allows attackers to bypass an intended user-confirmation requirement and trigger a dialing action via a tel: URL.
CVE-2016-1769 High 2016-03-24 Not applicable Working exploit published QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop file.
CVE-2016-1768 High 2016-03-24 Not applicable Working exploit published QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image, a different vulnerability than CVE-2016-1767.
CVE-2016-1767 High 2016-03-24 Not applicable Working exploit published QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix image, a different vulnerability than CVE-2016-1768.
CVE-2016-1766 High 2016-03-24 Not applicable No public exploit The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors.
CVE-2016-1765 High 2016-03-24 Not applicable No public exploit otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVE-2016-1764 Medium 2016-03-24 Not applicable Proof of concept only The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL.
CVE-2016-1763 Low 2016-03-24 Not applicable No public exploit Messages in Apple iOS before 9.3 does not ensure that an auto-fill action applies to the intended message thread, which allows remote authenticated users to obtain sensitive information by providing a crafted sms: URL and reading a thread.
CVE-2016-1762 High 2016-03-24 Not applicable No public exploit The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document.
CVE-2016-1761 Critical 2016-03-24 Not applicable No public exploit libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
CVE-2016-1759 High 2016-03-24 Not applicable No public exploit The kernel in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1758 Low 2016-03-24 Not applicable No public exploit The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app.
CVE-2016-1757 High 2016-03-24 Not applicable Working exploit published Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVE-2016-1756 High 2016-03-24 Not applicable No public exploit The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVE-2016-1755 High 2016-03-24 Not applicable Working exploit published The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1754.
CVE-2016-1754 High 2016-03-24 Not applicable No public exploit The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1755.
CVE-2016-1753 High 2016-03-24 Not applicable No public exploit Multiple integer overflows in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allow attackers to execute arbitrary code in a privileged context via a crafted app.
CVE-2016-1752 Medium 2016-03-24 Not applicable No public exploit The kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to cause a denial of service via a crafted app.
CVE-2016-1751 High 2016-03-24 Not applicable No public exploit The kernel in Apple iOS before 9.3, tvOS before 9.2, and watchOS before 2.2 does not properly restrict the execute permission, which allows attackers to bypass a code-signing protection mechanism via a crafted app.
CVE-2016-1750 High 2016-03-24 Not applicable No public exploit Use-after-free vulnerability in the kernel in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVE-2016-1749 High 2016-03-24 Not applicable Working exploit published IOUSBFamily in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1748 Low 2016-03-24 Not applicable No public exploit IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
CVE-2016-1747 High 2016-03-24 Not applicable No public exploit IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1746.
CVE-2016-1746 High 2016-03-24 Not applicable No public exploit IOGraphics in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1747.
CVE-2016-1745 Medium 2016-03-24 Not applicable No public exploit IOFireWireFamily in Apple OS X before 10.11.4 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-1744 High 2016-03-24 Not applicable Working exploit published The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1743.
CVE-2016-1743 High 2016-03-24 Not applicable Working exploit published The Intel driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1744.
CVE-2016-1741 Critical 2016-03-24 Not applicable Working exploit published The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1740 High 2016-03-24 Not applicable No public exploit FontParser in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.
CVE-2016-1738 High 2016-03-24 Not applicable No public exploit dyld in Apple OS X before 10.11.4 allows attackers to bypass a code-signing protection mechanism via a modified app.
CVE-2016-1737 Medium 2016-03-24 Not applicable No public exploit Carbon in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dfont file.
CVE-2016-1736 High 2016-03-24 Not applicable No public exploit Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1735.
CVE-2016-1735 High 2016-03-24 Not applicable No public exploit Bluetooth in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1736.
CVE-2016-1734 Medium 2016-03-24 Not applicable No public exploit AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.
CVE-2016-1733 High 2016-03-24 Not applicable No public exploit AppleRAID in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-1732 Medium 2016-03-24 Not applicable No public exploit AppleRAID in Apple OS X before 10.11.4 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2016-1599 Medium 2016-03-24 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-1366 Medium 2016-03-24 Not applicable No public exploit The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID CSCuw75848.
CVE-2016-1347 High 2016-03-24 Not applicable No public exploit The Wide Area Application Services (WAAS) Express implementation in Cisco IOS 15.1 through 15.5 allows remote attackers to cause a denial of service (device reload) via a crafted TCP segment, aka Bug ID CSCuq59708.
CVE-2016-0636 High 2016-03-24 Outside Waratek scope No public exploit Unspecified vulnerability in Oracle Java SE 7u97, 8u73, and 8u74 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Hotspot sub-component.
CVE-2015-7551 High 2016-03-24 Not applicable No public exploit The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.
CVE-2015-6854 Critical 2016-03-24 Not applicable No public exploit The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
CVE-2015-6853 Critical 2016-03-24 Not applicable No public exploit The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
CVE-2009-2197 Medium 2016-03-24 Not applicable No public exploit Apple Safari before 9.1 allows remote attackers to spoof the user interface via a web page that places text in a crafted context, leading to unintended use of that text within a Safari dialog.
CVE-2016-3116 Medium 2016-03-22 Not applicable Working exploit published CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.
CVE-2016-3115 Medium 2016-03-22 Not applicable Working exploit published Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
CVE-2016-1998 Critical 2016-03-22 Not applicable No public exploit HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVE-2016-1997 Critical 2016-03-22 Not applicable No public exploit HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
CVE-2015-7454 Medium 2016-03-21 Not applicable No public exploit Business Space in IBM WebSphere Process Server 6.1.2.0 through 7.0.0.5 and Business Process Manager Advanced 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote authenticated users to bypass intended access restrictions and create an arbitrary page or space via unspecified vectors.
CVE-2016-2287 Medium 2016-03-19 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-2245 Critical 2016-03-19 Not applicable No public exploit HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.
CVE-2016-0283 Medium 2016-03-19 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the OpenID Connect (OIDC) client web application in IBM WebSphere Application Server (WAS) Liberty Profile 8.5.5 before 8.5.5.9 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-2286 Medium 2016-03-19 Not applicable No public exploit lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
CVE-2016-3155 Low 2016-03-18 Not applicable No public exploit Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors.
CVE-2016-2281 High 2016-03-18 Not applicable No public exploit Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVE-2016-1996 High 2016-03-18 Not applicable No public exploit HPE System Management Homepage before 7.5.4 allows local users to obtain sensitive information or modify data via unspecified vectors.
CVE-2016-1995 Critical 2016-03-18 Not applicable No public exploit HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2016-1994 Medium 2016-03-18 Not applicable No public exploit HPE System Management Homepage before 7.5.4 allows remote authenticated users to obtain sensitive information via unspecified vectors.
‹ prev page 1 of 756 next ›