WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Published to 2016-07-31✕
Overview 78,017 matches · 2,723 in Waratek scope · 0 protected · 788 exploited · 213 CISA KEV · 20,103 public PoC · 1,440 EPSS ≥ 0.5
78,017matches 2,723in Waratek scope3.5% 0protected0.0% 788exploited1.0% 213CISA KEV0.3% 20,103public PoC25.8% 1,440EPSS ≥ 0.51.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 149 0.2% No exploit published 2,574 3.3% Outside Waratek scope 1,477 1.9% Not applicable 72,957 93.5% Withdrawn CVE 860 1.1%
Critical 768 1.0% High 31,584 40.5% Medium 39,406 50.5% Low 5,399 6.9% None 0 0.0% Unknown 860 1.1%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 78,017 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 788 1.0% Working exploit published 19,552 25.1% Proof of concept only 68 0.1% Forecast only 188 0.2% No public exploit 57,421 73.6%
split by peak 7,967 / year
Withdrawn CVE: 860Not applicable: 72,957Outside Waratek scope: 1,477No exploit published: 2,574Mitigation candidate: 149 Unknown: 860Low: 5,399Medium: 39,406High: 31,584Critical: 768 not blocked: 78,017 No public exploit: 57,421Forecast only: 188Proof of concept only: 68Working exploit published: 19,552Exploited: 788
19882 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 19893 Not applicable3 High2 Medium1 not blocked3 No public exploit3 199011 Not applicable11 High8 Medium2 Low1 not blocked11 Working exploit published1 No public exploit10 199115 Not applicable15 High11 Medium4 not blocked15 Working exploit published2 No public exploit13 199214 Not applicable13 Withdrawn CVE1 High12 Low1 Unknown1 not blocked14 No public exploit14 199313 Not applicable13 High8 Medium3 Low2 not blocked13 No public exploit13 199426 Not applicable25 Withdrawn CVE1 High14 Medium10 Low1 Unknown1 not blocked26 Working exploit published6 No public exploit20 199525 Not applicable25 Critical1 High17 Medium6 Low1 not blocked25 Working exploit published5 No public exploit20 199675 No exploit published1 Not applicable73 Withdrawn CVE1 Critical1 High43 Medium21 Low9 Unknown1 not blocked75 Working exploit published18 Forecast only1 No public exploit56 1997253 Not applicable252 Withdrawn CVE1 Critical1 High143 Medium89 Low19 Unknown1 not blocked253 Exploited2 Working exploit published73 Forecast only2 No public exploit176 1998247 Not applicable246 Withdrawn CVE1 Critical1 High137 Medium85 Low23 Unknown1 not blocked247 Exploited1 Working exploit published50 No public exploit196 1999923 No exploit published2 Outside Waratek scope1 Not applicable891 Withdrawn CVE29 Critical3 High423 Medium357 Low111 Unknown29 not blocked923 Exploited2 Working exploit published282 No public exploit639 20001,020 Mitigation candidate6 No exploit published6 Outside Waratek scope2 Not applicable1,005 Withdrawn CVE1 Critical2 High454 Medium467 Low96 Unknown1 not blocked1,020 Exploited5 Working exploit published427 Forecast only1 No public exploit587 20011,678 Mitigation candidate2 No exploit published10 Outside Waratek scope14 Not applicable1,649 Withdrawn CVE3 Critical12 High775 Medium706 Low182 Unknown3 not blocked1,678 Exploited14 Working exploit published480 Forecast only2 No public exploit1,182 20022,167 Mitigation candidate8 No exploit published26 Outside Waratek scope12 Not applicable2,107 Withdrawn CVE14 Critical10 High1,022 Medium978 Low143 Unknown14 not blocked2,167 Exploited12 Working exploit published545 Forecast only9 No public exploit1,601 20031,546 Mitigation candidate7 No exploit published30 Outside Waratek scope6 Not applicable1,482 Withdrawn CVE21 Critical9 High674 Medium745 Low97 Unknown21 not blocked1,546 Exploited10 Working exploit published498 Forecast only1 No public exploit1,037 20042,477 Mitigation candidate1 No exploit published24 Outside Waratek scope8 Not applicable2,416 Withdrawn CVE28 Critical10 High972 Medium1,264 Low203 Unknown28 not blocked2,477 Exploited21 Working exploit published755 Forecast only1 No public exploit1,700 20055,007 Mitigation candidate4 No exploit published75 Outside Waratek scope17 Not applicable4,833 Withdrawn CVE78 Critical13 High2,048 Medium2,427 Low441 Unknown78 not blocked5,007 Exploited22 Working exploit published1,340 Forecast only11 No public exploit3,634 20066,651 Mitigation candidate4 No exploit published121 Outside Waratek scope67 Not applicable6,408 Withdrawn CVE51 Critical12 High2,759 Medium3,320 Low509 Unknown51 not blocked6,651 Exploited36 Working exploit published2,439 Proof of concept only1 Forecast only6 No public exploit4,169 20076,590 Mitigation candidate10 No exploit published134 Outside Waratek scope83 Not applicable6,283 Withdrawn CVE80 Critical21 High3,159 Medium3,099 Low231 Unknown80 not blocked6,590 Exploited47 Working exploit published2,494 Proof of concept only5 Forecast only5 No public exploit4,039 20085,657 Mitigation candidate9 No exploit published120 Outside Waratek scope74 Not applicable5,422 Withdrawn CVE32 Critical19 High2,843 Medium2,578 Low185 Unknown32 not blocked5,657 Exploited40 Working exploit published2,515 Proof of concept only4 Forecast only9 No public exploit3,089 20095,769 Mitigation candidate13 No exploit published181 Outside Waratek scope62 Not applicable5,467 Withdrawn CVE46 Critical15 High2,731 Medium2,781 Low196 Unknown46 not blocked5,769 Exploited73 Working exploit published2,587 Proof of concept only2 Forecast only3 No public exploit3,104 20104,658 Mitigation candidate12 No exploit published162 Outside Waratek scope86 Not applicable4,370 Withdrawn CVE28 Critical27 High2,091 Medium2,235 Low277 Unknown28 not blocked4,658 Exploited71 Working exploit published1,310 Proof of concept only1 Forecast only9 No public exploit3,267 20114,166 Mitigation candidate9 No exploit published178 Outside Waratek scope116 Not applicable3,841 Withdrawn CVE22 Critical5 High1,783 Medium2,097 Low259 Unknown22 not blocked4,166 Exploited50 Working exploit published689 Proof of concept only4 Forecast only4 No public exploit3,419 20125,340 Mitigation candidate22 No exploit published278 Outside Waratek scope94 Not applicable4,883 Withdrawn CVE63 Critical18 High1,722 Medium3,029 Low508 Unknown63 not blocked5,340 Exploited54 Working exploit published831 Proof of concept only7 Forecast only46 No public exploit4,402 20135,297 Mitigation candidate17 No exploit published305 Outside Waratek scope300 Not applicable4,538 Withdrawn CVE137 Critical22 High1,723 Medium2,901 Low514 Unknown137 not blocked5,297 Exploited90 Working exploit published517 Proof of concept only2 Forecast only21 No public exploit4,667 20147,967 Mitigation candidate12 No exploit published282 Outside Waratek scope253 Not applicable7,340 Withdrawn CVE80 Critical20 High1,929 Medium5,282 Low656 Unknown80 not blocked7,967 Exploited95 Working exploit published791 Proof of concept only12 Forecast only14 No public exploit7,055 20156,563 Mitigation candidate6 No exploit published285 Outside Waratek scope202 Not applicable5,969 Withdrawn CVE101 Critical48 High2,346 Medium3,481 Low587 Unknown101 not blocked6,563 Exploited92 Working exploit published643 Proof of concept only16 Forecast only19 No public exploit5,793 20163,857 Mitigation candidate7 No exploit published354 Outside Waratek scope80 Not applicable3,375 Withdrawn CVE41 Critical498 High1,733 Medium1,438 Low147 Unknown41 not blocked3,857 Exploited51 Working exploit published253 Proof of concept only14 Forecast only24 No public exploit3,515
1989199219951998200120042007201020132016
78,017 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 781 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-5005 Medium 2016-07-28 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.
CVE-2016-4531 High 2016-07-28 Not applicable No public exploit Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVE-2016-4522 Critical 2016-07-28 Not applicable No public exploit SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2016-4469 High 2016-07-28 Not applicable Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add new repository proxy connectors via the token parameter to admin/addProxyConnector_commit.action, (2) new repositories via the token parameter to admin/addRepository_commit.action, (3) edit existing repositories via the token parameter to admin/editRepository_commit.action, (4) add legacy artifact paths via the token parameter to admin/addLegacyArtifactPath_commit.action, (5) change the organizational appearance via the token parameter to admin/saveAppearance.action, or (6) upload new artifacts via the token parameter to upload_submit.action.
CVE-2016-1467 Medium 2016-07-28 Not applicable No public exploit Cisco Videoscape Session Resource Manager (VSRM) allows remote attackers to cause a denial of service (device restart) by sending a traffic flood to upstream devices, aka Bug ID CSCva01813.
CVE-2016-1465 Medium 2016-07-28 Not applicable No public exploit Cisco Nexus 1000v Application Virtual Switch (AVS) devices before 5.2(1)SV3(1.5i) allow remote attackers to cause a denial of service (ESXi hypervisor crash and purple screen) via a crafted Cisco Discovery Protocol packet that triggers an out-of-bounds memory access, aka Bug ID CSCuw57985.
CVE-2016-1463 High 2016-07-28 Not applicable No public exploit Cisco FireSIGHT System Software 5.3.0, 5.3.1, 5.4.0, 6.0, and 6.0.1 allows remote attackers to bypass Snort rules via crafted parameters in the header of an HTTP packet, aka Bug ID CSCuz20737.
CVE-2016-1462 Medium 2016-07-28 Outside Waratek scope No public exploit Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Prime Service Catalog (PSC) 11.0 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCuz63795.
CVE-2016-1460 Medium 2016-07-28 Not applicable No public exploit Cisco Wireless LAN Controller (WLC) devices 7.4(121.0) and 8.0(0.30220.385) allow remote attackers to cause a denial of service via crafted wireless management frames, aka Bug ID CSCun92979.
CVE-2016-1374 High 2016-07-28 Not applicable No public exploit The web framework in Cisco Unified Computing System (UCS) Performance Manager 2.0.0 and earlier allows remote authenticated users to execute arbitrary commands via crafted parameters in a GET request, aka Bug ID CSCuy07827.
CVE-2016-6152 High 2016-07-26 Not applicable No public exploit CA eHealth 6.2.x and 6.3.x before 6.3.2.13 allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-6151 High 2016-07-26 Not applicable No public exploit CA eHealth 6.2.x allows remote authenticated users to cause a denial of service or possibly execute arbitrary commands via unspecified vectors.
CVE-2016-3992 Medium 2016-07-26 Not applicable No public exploit cronic before 3 allows local users to write to arbitrary files via a symlink attack on a (1) cronic.out.$$, (2) cronic.err.$$, or (3) cronic.trace.$$ file in /tmp.
CVE-2015-5738 High 2016-07-26 Not applicable No public exploit The RSA-CRT implementation in the Cavium Software Development Kit (SDK) 2.x, when used on OCTEON II CN6xxx Hardware on Linux to support TLS with Perfect Forward Secrecy (PFS), makes it easier for remote attackers to obtain private RSA keys by conducting a Lenstra side-channel attack.
CVE-2016-6297 High 2016-07-25 Not applicable No public exploit Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.
CVE-2016-6296 Critical 2016-07-25 Not applicable No public exploit Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.
CVE-2016-6295 Critical 2016-07-25 Not applicable No public exploit ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.
CVE-2016-6294 Critical 2016-07-25 Not applicable No public exploit The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
CVE-2016-6293 Critical 2016-07-25 Not applicable No public exploit The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.
CVE-2016-6292 Medium 2016-07-25 Not applicable No public exploit The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.
CVE-2016-6291 Critical 2016-07-25 Not applicable No public exploit The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.
CVE-2016-6290 Critical 2016-07-25 Not applicable No public exploit ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.
CVE-2016-6289 High 2016-07-25 Not applicable No public exploit Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.
CVE-2016-6288 Critical 2016-07-25 Not applicable No public exploit The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.
CVE-2016-5137 Medium 2016-07-23 Not applicable No public exploit The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 52.0.2743.82, does not apply http :80 policies to https :443 URLs and does not apply ws :80 policies to wss :443 URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. NOTE: this vulnerability is associated with a specification change after CVE-2016-1617 resolution.
CVE-2016-5136 High 2016-07-23 Not applicable No public exploit Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.
CVE-2016-5135 Medium 2016-07-23 Not applicable No public exploit WebKit/Source/core/html/parser/HTMLPreloadScanner.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not consider referrer-policy information inside an HTML document during a preload request, which allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted web site, as demonstrated by a "Content-Security-Policy: referrer origin-when-cross-origin" header that overrides a "<META name='referrer' content='no-referrer'>" element.
CVE-2016-5134 High 2016-07-23 Not applicable No public exploit net/proxy/proxy_service.cc in the Proxy Auto-Config (PAC) feature in Google Chrome before 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, a related issue to CVE-2016-3763.
CVE-2016-5133 Medium 2016-07-23 Not applicable No public exploit Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream.
CVE-2016-5132 High 2016-07-23 Not applicable No public exploit The Service Workers subsystem in Google Chrome before 52.0.2743.82 does not properly implement the Secure Contexts specification during decisions about whether to control a subframe, which allows remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.
CVE-2016-5131 High 2016-07-23 Not applicable No public exploit Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.
CVE-2016-5130 Medium 2016-07-23 Not applicable No public exploit content/renderer/history_controller.cc in Google Chrome before 52.0.2743.82 does not properly restrict multiple uses of a JavaScript forward method, which allows remote attackers to spoof the URL display via a crafted web site.
CVE-2016-5129 High 2016-07-23 Not applicable No public exploit Google V8 before 5.2.361.32, as used in Google Chrome before 52.0.2743.82, does not properly process left-trimmed objects, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code.
CVE-2016-5128 High 2016-07-23 Not applicable No public exploit objects.cc in Google V8 before 5.2.361.27, as used in Google Chrome before 52.0.2743.82, does not prevent API interceptors from modifying a store target without setting a property, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-5127 High 2016-07-23 Not applicable No public exploit Use-after-free vulnerability in WebKit/Source/core/editing/VisibleUnits.cpp in Blink, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code involving an @import at-rule in a Cascading Style Sheets (CSS) token sequence in conjunction with a rel=import attribute of a LINK element.
CVE-2016-1711 High 2016-07-23 Not applicable No public exploit WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not disable frame navigation during a detach operation on a DocumentLoader object, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1710 High 2016-07-23 Not applicable No public exploit The ChromeClientImpl::createWindow method in WebKit/Source/web/ChromeClientImpl.cpp in Blink, as used in Google Chrome before 52.0.2743.82, does not prevent window creation by a deferred frame, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
CVE-2016-1709 High 2016-07-23 Not applicable No public exploit Heap-based buffer overflow in the ByteArray::Get method in data/byte_array.cc in Google sfntly before 2016-06-10, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SFNT font.
CVE-2016-1708 High 2016-07-23 Not applicable No public exploit The Chrome Web Store inline-installation implementation in the Extensions subsystem in Google Chrome before 52.0.2743.82 does not properly consider object lifetimes during progress observation, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.
CVE-2016-1707 Medium 2016-07-23 Not applicable No public exploit ios/web/web_state/ui/crw_web_controller.mm in Google Chrome before 52.0.2743.82 on iOS does not ensure that an invalid URL is replaced with the about:blank URL, which allows remote attackers to spoof the URL display via a crafted web site.
CVE-2016-1706 Critical 2016-07-23 Not applicable No public exploit The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected message type, related to broker_process_dispatcher.cc, ppapi_plugin_process_host.cc, ppapi_thread.cc, and render_frame_message_filter.cc.
CVE-2016-1705 High 2016-07-23 Not applicable No public exploit Multiple unspecified vulnerabilities in Google Chrome before 52.0.2743.82 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-6224 Low 2016-07-22 Not applicable No public exploit ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which allows local users to obtain sensitive information via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8946.
CVE-2016-6204 Medium 2016-07-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the integrated web server in Siemens SINEMA Remote Connect Server before 1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-5874 High 2016-07-22 Not applicable No public exploit Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP packets.
CVE-2016-5744 High 2016-07-22 Not applicable No public exploit Siemens SIMATIC WinCC 7.0 through SP3 and 7.2 allows remote attackers to read arbitrary WinCC station files via crafted packets.
CVE-2016-5743 Critical 2016-07-22 Not applicable No public exploit Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.2 Update 1 as distributed in SIMATIC PCS 7 8.2, and SIMATIC WinCC Runtime Professional before 13 SP1 Update 9 allow remote attackers to execute arbitrary code via crafted packets.
CVE-2016-4653 High 2016-07-22 Not applicable No public exploit The kernel in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1863 and CVE-2016-4582.
CVE-2016-4652 Medium 2016-07-22 Not applicable No public exploit CoreGraphics in Apple OS X before 10.11.6 allows local users to obtain sensitive information from kernel memory and consequently gain privileges, or cause a denial of service (out-of-bounds read), via unspecified vectors.
CVE-2016-4651 Medium 2016-07-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)" vulnerability.
CVE-2016-4649 Medium 2016-07-22 Not applicable No public exploit Audio in Apple OS X before 10.11.6 allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4648 Medium 2016-07-22 Not applicable No public exploit Audio in Apple OS X before 10.11.6 allows local users to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2016-4647 High 2016-07-22 Not applicable No public exploit Audio in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted file.
CVE-2016-4646 Medium 2016-07-22 Not applicable No public exploit Audio in Apple OS X before 10.11.6 mishandles a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted audio file.
CVE-2016-4645 Low 2016-07-22 Not applicable No public exploit CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2016-4641 High 2016-07-22 Not applicable No public exploit Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."
CVE-2016-4640 High 2016-07-22 Not applicable No public exploit Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4639 High 2016-07-22 Not applicable No public exploit Login Window in Apple OS X before 10.11.6 does not properly initialize memory, which allows local users to cause a denial of service via unspecified vectors.
CVE-2016-4638 High 2016-07-22 Not applicable No public exploit Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion."
CVE-2016-4637 High 2016-07-22 Not applicable No public exploit CoreGraphics in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted BMP image.
CVE-2016-4635 Medium 2016-07-22 Not applicable No public exploit FaceTime in Apple iOS before 9.3.3 and OS X before 10.11.6 allows man-in-the-middle attackers to spoof relayed-call termination, and obtain sensitive audio information in opportunistic circumstances, via unspecified vectors.
CVE-2016-4634 High 2016-07-22 Not applicable No public exploit The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors.
CVE-2016-4633 High 2016-07-22 Not applicable No public exploit Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4632 High 2016-07-22 Not applicable No public exploit ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVE-2016-4631 High 2016-07-22 Not applicable Proof of concept only ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF file.
CVE-2016-4630 High 2016-07-22 Not applicable No public exploit ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EXR image with B44 compression.
CVE-2016-4629 Critical 2016-07-22 Not applicable No public exploit ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in an EXR image.
CVE-2016-4628 Medium 2016-07-22 Not applicable No public exploit IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2016-4627 High 2016-07-22 Not applicable No public exploit IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4626 High 2016-07-22 Not applicable No public exploit IOHIDFamily in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors.
CVE-2016-4625 High 2016-07-22 Not applicable Working exploit published Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors.
CVE-2016-4624 High 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4623.
CVE-2016-4623 High 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4622, and CVE-2016-4624.
CVE-2016-4622 High 2016-07-22 Not applicable Proof of concept only WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.
CVE-2016-4621 High 2016-07-22 Not applicable No public exploit libc++abi in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4619 Unknown 2016-07-22 Withdrawn CVE No public exploit Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-8317. Reason: This candidate is a reservation duplicate of CVE-2015-8317. Notes: All CVE users should reference CVE-2015-8317 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE-2016-4616 Critical 2016-07-22 Not applicable No public exploit libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4615, and CVE-2016-4619.
CVE-2016-4615 Critical 2016-07-22 Not applicable No public exploit libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4616, and CVE-2016-4619.
CVE-2016-4614 Critical 2016-07-22 Not applicable No public exploit libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4615, CVE-2016-4616, and CVE-2016-4619.
CVE-2016-4612 Unknown 2016-07-22 Withdrawn CVE No public exploit Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-1683. Reason: This candidate is a reservation duplicate of CVE-2016-1683. Notes: All CVE users should reference CVE-2016-1683 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE-2016-4610 Critical 2016-07-22 Not applicable No public exploit libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612.
CVE-2016-4609 Critical 2016-07-22 Not applicable No public exploit libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.
CVE-2016-4608 Critical 2016-07-22 Not applicable No public exploit libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.
CVE-2016-4607 Critical 2016-07-22 Not applicable No public exploit libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4608, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.
CVE-2016-4605 Medium 2016-07-22 Not applicable No public exploit Calendar in Apple iOS before 9.3.3 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a crafted invitation.
CVE-2016-4604 Medium 2016-07-22 Not applicable No public exploit Safari in Apple iOS before 9.3.3 allows remote attackers to spoof the displayed URL via an HTTP response specifying redirection to an invalid TCP port number.
CVE-2016-4603 Medium 2016-07-22 Not applicable No public exploit Web Media in Apple iOS before 9.3.3 allows attackers to bypass the Private Browsing protection mechanism and obtain sensitive video URL information by leveraging Safari View Controller misbehavior.
CVE-2016-4602 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4600.
CVE-2016-4601 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted SGI image.
CVE-2016-4600 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4597, and CVE-2016-4602.
CVE-2016-4599 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Photoshop document.
CVE-2016-4598 Critical 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image.
CVE-2016-4597 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4596, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4596 High 2016-07-22 Not applicable No public exploit QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted FlashPix bitmap image, a different vulnerability than CVE-2016-4597, CVE-2016-4600, and CVE-2016-4602.
CVE-2016-4595 Medium 2016-07-22 Not applicable No public exploit Safari Login AutoFill in Apple OS X before 10.11.6 allows physically proximate attackers to discover passwords by reading the screen during the login procedure.
CVE-2016-4594 High 2016-07-22 Not applicable No public exploit The Sandbox Profiles component in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows attackers to access the process list via a crafted app that makes an API call.
CVE-2016-4593 Low 2016-07-22 Not applicable No public exploit The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors.
CVE-2016-4592 Medium 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted web site.
CVE-2016-4591 High 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 mishandles the location variable, which allows remote attackers to access the local filesystem via unspecified vectors.
CVE-2016-4590 Medium 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
‹ prev page 1 of 781 next ›