WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2016-02-29✕
Overview 38,630 matches · 1,805 in Waratek scope · 121 protected · 190 exploited · 18 CISA KEV · 8,759 public PoC · 342 EPSS ≥ 0.5
split by peak 5,314 / year
Not applicable: 36,087Outside Waratek scope: 738No exploit published: 1,580Mitigation candidate: 104Protected by Waratek: 121 Medium: 38,630 not established: 3not blocked: 38,506blocked by ARMR today: 121 No public exploit: 29,680Forecast only: 95Proof of concept only: 25Working exploit published: 8,640Exploited: 190
19891 Not applicable1 Medium1 not blocked1 No public exploit1 19902 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 19914 Not applicable4 Medium4 not blocked4 No public exploit4 19920 19933 Not applicable3 Medium3 not blocked3 No public exploit3 199410 Not applicable10 Medium10 not blocked10 Working exploit published2 No public exploit8 19956 Not applicable6 Medium6 not blocked6 Working exploit published2 No public exploit4 199621 Not applicable21 Medium21 not blocked21 Working exploit published5 No public exploit16 199789 Not applicable89 Medium89 not blocked89 Working exploit published18 No public exploit71 199885 Not applicable85 Medium85 not blocked85 Working exploit published11 No public exploit74 1999357 Outside Waratek scope1 Not applicable356 Medium357 not blocked357 Working exploit published119 No public exploit238 2000467 Mitigation candidate4 No exploit published3 Not applicable460 Medium467 not blocked467 Exploited2 Working exploit published195 No public exploit270 2001706 Mitigation candidate2 No exploit published4 Outside Waratek scope7 Not applicable693 Medium706 not blocked706 Exploited3 Working exploit published219 Forecast only2 No public exploit482 2002980 Protected by Waratek2 Mitigation candidate6 No exploit published15 Outside Waratek scope4 Not applicable953 Medium980 blocked by ARMR today2 not blocked978 Exploited3 Working exploit published246 Forecast only3 No public exploit728 2003747 Protected by Waratek2 Mitigation candidate4 No exploit published18 Outside Waratek scope1 Not applicable722 Medium747 blocked by ARMR today2 not blocked745 Working exploit published243 No public exploit504 20041,265 Protected by Waratek1 Mitigation candidate1 No exploit published16 Outside Waratek scope4 Not applicable1,243 Medium1,265 blocked by ARMR today1 not blocked1,264 Exploited10 Working exploit published414 Forecast only1 No public exploit840 20052,430 Protected by Waratek3 Mitigation candidate4 No exploit published39 Outside Waratek scope6 Not applicable2,378 Medium2,430 blocked by ARMR today3 not blocked2,427 Exploited8 Working exploit published622 Forecast only6 No public exploit1,794 20063,324 Protected by Waratek4 Mitigation candidate4 No exploit published48 Outside Waratek scope3 Not applicable3,265 Medium3,324 blocked by ARMR today4 not blocked3,320 Exploited10 Working exploit published1,137 Forecast only2 No public exploit2,175 20073,101 Protected by Waratek2 Mitigation candidate9 No exploit published60 Outside Waratek scope53 Not applicable2,977 Medium3,101 blocked by ARMR today2 not blocked3,099 Exploited14 Working exploit published1,052 Forecast only1 No public exploit2,034 20082,582 Protected by Waratek4 Mitigation candidate8 No exploit published71 Outside Waratek scope26 Not applicable2,473 Medium2,582 blocked by ARMR today4 not blocked2,578 Exploited7 Working exploit published987 Proof of concept only2 Forecast only1 No public exploit1,585 20092,786 Protected by Waratek5 Mitigation candidate9 No exploit published115 Outside Waratek scope31 Not applicable2,626 Medium2,786 blocked by ARMR today5 not blocked2,781 Exploited16 Working exploit published1,123 Proof of concept only2 Forecast only3 No public exploit1,642 20102,241 Protected by Waratek6 Mitigation candidate9 No exploit published118 Outside Waratek scope34 Not applicable2,074 Medium2,241 blocked by ARMR today6 not blocked2,235 Exploited14 Working exploit published547 Proof of concept only1 Forecast only2 No public exploit1,677 20112,101 Protected by Waratek4 Mitigation candidate3 No exploit published132 Outside Waratek scope58 Not applicable1,904 Medium2,101 blocked by ARMR today4 not blocked2,097 Exploited9 Working exploit published294 Proof of concept only3 Forecast only1 No public exploit1,794 20123,035 Protected by Waratek5 Mitigation candidate17 No exploit published177 Outside Waratek scope50 Not applicable2,786 Medium3,035 blocked by ARMR today5 not blocked3,029 not established1 Exploited20 Working exploit published475 Proof of concept only2 Forecast only42 No public exploit2,496 20132,914 Protected by Waratek12 Mitigation candidate12 No exploit published225 Outside Waratek scope155 Not applicable2,510 Medium2,914 blocked by ARMR today12 not blocked2,901 not established1 Exploited23 Working exploit published237 Proof of concept only1 Forecast only6 No public exploit2,647 20145,314 Protected by Waratek32 Mitigation candidate9 No exploit published215 Outside Waratek scope165 Not applicable4,893 Medium5,314 blocked by ARMR today32 not blocked5,282 Exploited24 Working exploit published415 Proof of concept only7 Forecast only12 No public exploit4,856 20153,501 Protected by Waratek20 Mitigation candidate1 No exploit published205 Outside Waratek scope126 Not applicable3,149 Medium3,501 blocked by ARMR today20 not blocked3,481 Exploited23 Working exploit published254 Proof of concept only7 Forecast only8 No public exploit3,209 2016558 Protected by Waratek19 Mitigation candidate2 No exploit published119 Outside Waratek scope14 Not applicable404 Medium558 blocked by ARMR today19 not blocked538 not established1 Exploited4 Working exploit published22 Forecast only5 No public exploit527
1989199219951998200120042007201020132016
38,630 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 387 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-0245 Medium 2016-02-29 Not applicable No public exploit The XML parser in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF10 allows remote authenticated users to read arbitrary files or cause a denial of service via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-0244 Medium 2016-02-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0243.
CVE-2016-0243 Medium 2016-02-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2016-0244.
CVE-2016-0225 Medium 2016-02-29 Not applicable No public exploit IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x through 7.0.0.9 allows remote authenticated Commerce Accelerator administrators to obtain sensitive information via unspecified vectors.
CVE-2015-8524 Medium 2016-02-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Process Portal in IBM Business Process Manager 8.5.0.x through 8.5.0.2, 8.5.5.x through 8.5.5.0, and 8.5.6.x through 8.5.6.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-7491 Medium 2016-02-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
CVE-2015-7457 Medium 2016-02-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVE-2016-2532 Medium 2016-02-28 Not applicable No public exploit The dissect_llrp_parameters function in epan/dissectors/packet-llrp.c in the LLRP dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 does not limit the recursion depth, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
CVE-2016-2531 Medium 2016-02-28 Not applicable No public exploit Off-by-one error in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that triggers a 0xff tag value, a different vulnerability than CVE-2016-2530.
CVE-2016-2530 Medium 2016-02-28 Not applicable No public exploit The dissct_rsl_ipaccess_msg function in epan/dissectors/packet-rsl.c in the RSL dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 mishandles the case of an unrecognized TLV type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet, a different vulnerability than CVE-2016-2531.
CVE-2016-2529 Medium 2016-02-28 Not applicable No public exploit The iseries_check_file_type function in wiretap/iseries.c in the iSeries file parser in Wireshark 2.0.x before 2.0.2 does not consider that a line may lack the "OBJECT PROTOCOL" substring, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
CVE-2016-2528 Medium 2016-02-28 Not applicable No public exploit The dissect_nhdr_extopt function in epan/dissectors/packet-lbmc.c in the LBMC dissector in Wireshark 2.0.x before 2.0.2 does not validate length values, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
CVE-2016-2527 Medium 2016-02-28 Not applicable No public exploit wiretap/nettrace_3gpp_32_423.c in the 3GPP TS 32.423 Trace file parser in Wireshark 2.0.x before 2.0.2 does not ensure that a '\0' character is present at the end of certain strings, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted file.
CVE-2016-2526 Medium 2016-02-28 Not applicable No public exploit epan/dissectors/packet-hiqnet.c in the HiQnet dissector in Wireshark 2.0.x before 2.0.2 does not validate the data type, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVE-2016-2525 Medium 2016-02-28 Not applicable No public exploit epan/dissectors/packet-http2.c in the HTTP/2 dissector in Wireshark 2.0.x before 2.0.2 does not limit the amount of header data, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
CVE-2016-2524 Medium 2016-02-28 Not applicable No public exploit epan/dissectors/packet-x509af.c in the X.509AF dissector in Wireshark 2.0.x before 2.0.2 mishandles the algorithm ID, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
CVE-2016-2523 Medium 2016-02-28 Not applicable No public exploit The dnp3_al_process_object function in epan/dissectors/packet-dnp.c in the DNP3 dissector in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
CVE-2016-2522 Medium 2016-02-28 Not applicable No public exploit The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.
CVE-2016-1342 Medium 2016-02-26 Not applicable No public exploit The device login page in Cisco FirePOWER Management Center 5.3 through 6.0.0.1 allows remote attackers to obtain potentially sensitive software-version information by reading help files, aka Bug ID CSCuy36654.
CVE-2016-0763 Medium 2016-02-25 No exploit published No public exploit The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
CVE-2016-0706 Medium 2016-02-25 No exploit published No public exploit Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
CVE-2015-5345 Medium 2016-02-25 Protected by Waratek No public exploit The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVE-2015-5174 Medium 2016-02-25 Protected by Waratek No public exploit Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
CVE-2016-1157 Medium 2016-02-23 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in log_chat.cgi in Script* Log-Chat before 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-2316 Medium 2016-02-22 Not applicable No public exploit chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.
CVE-2016-2232 Medium 2016-02-22 Not applicable No public exploit Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost.
CVE-2016-2037 Medium 2016-02-22 Not applicable No public exploit The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.
CVE-2016-0725 Medium 2016-02-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
CVE-2016-0724 Medium 2016-02-22 Not applicable No public exploit The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
CVE-2015-5342 Medium 2016-02-22 Not applicable No public exploit The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
CVE-2015-5341 Medium 2016-02-22 Not applicable No public exploit mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
CVE-2015-5340 Medium 2016-02-22 Not applicable No public exploit Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
CVE-2015-5339 Medium 2016-02-22 Not applicable No public exploit The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
CVE-2015-5337 Medium 2016-02-22 Not applicable No public exploit Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
CVE-2015-5336 Medium 2016-02-22 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
CVE-2015-5335 Medium 2016-02-22 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
CVE-2015-5332 Medium 2016-02-22 Not applicable No public exploit Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
CVE-2015-5331 Medium 2016-02-22 Not applicable No public exploit Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
CVE-2015-5272 Medium 2016-02-22 Not applicable No public exploit The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."
CVE-2015-5269 Medium 2016-02-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.
CVE-2015-5268 Medium 2016-02-22 Not applicable No public exploit The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
CVE-2015-5266 Medium 2016-02-22 Not applicable No public exploit The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
CVE-2015-5265 Medium 2016-02-22 Not applicable No public exploit The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.
CVE-2015-5264 Medium 2016-02-22 Not applicable No public exploit The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.
CVE-2015-3275 Medium 2016-02-22 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
CVE-2015-3274 Medium 2016-02-22 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
CVE-2015-3273 Medium 2016-02-22 Not applicable No public exploit mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
CVE-2016-1628 Medium 2016-02-21 Not applicable No public exploit pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.
CVE-2016-2045 Medium 2016-02-20 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response.
CVE-2016-2044 Medium 2016-02-20 Not applicable No public exploit libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CVE-2016-2043 Medium 2016-02-20 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
CVE-2016-2042 Medium 2016-02-20 Not applicable No public exploit phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
CVE-2016-2040 Medium 2016-02-20 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
CVE-2016-2039 Medium 2016-02-20 Not applicable No public exploit libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
CVE-2016-2038 Medium 2016-02-20 Not applicable No public exploit phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CVE-2016-2271 Medium 2016-02-19 Not applicable No public exploit VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.
CVE-2016-2270 Medium 2016-02-19 Not applicable No public exploit Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.
CVE-2016-1156 Medium 2016-02-19 Not applicable No public exploit LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline.
CVE-2015-7769 Medium 2016-02-19 Not applicable No public exploit baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
CVE-2016-2509 Medium 2016-02-18 Not applicable No public exploit The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network.
CVE-2016-1987 Medium 2016-02-18 Not applicable No public exploit HPE IPFilter A.11.31.18.21 on HP-UX, when a certain keep-state configuration is enabled, allows remote attackers to cause a denial of service via unspecified UDP packets.
CVE-2015-8287 Medium 2016-02-18 Not applicable No public exploit Swann SRNVW-470LCD devices with firmware through 0114 and SWNVW-470CAM devices with firmware through 1022 allow remote attackers to watch live video by visiting an unspecified URL.
CVE-2015-5970 Medium 2016-02-18 Not applicable No public exploit The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a system entity reference.
CVE-2016-2398 Medium 2016-02-17 Not applicable No public exploit Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.
CVE-2016-2072 Medium 2016-02-17 Not applicable No public exploit The Administrative Web Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 11.x before 11.0 Build 64.34, 10.5 before 10.5 Build 59.13, 10.5.e before Build 59.1305.e, and 10.1 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2016-2046 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the UserPortal page in SOPHOS UTM before 9.353 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
CVE-2016-1334 Medium 2016-02-17 Not applicable No public exploit Cisco Small Business 500 Wireless Access Point devices with firmware 1.0.4.4 allow remote attackers to set the system time via a crafted POST request, aka Bug ID CSCuy01457.
CVE-2016-1333 Medium 2016-02-17 Not applicable No public exploit Cisco IOS 15.5(3)M and 15.6(1)T0a on Cisco 1000 Connected Grid routers allows remote authenticated users to cause a denial of service (device reload) via an SNMP request for unspecified BRIDGE MIB OIDs, aka Bug ID CSCux89878.
CVE-2016-1153 Medium 2016-02-17 Not applicable No public exploit customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service via unspecified vectors, a different vulnerability than CVE-2015-8489.
CVE-2016-1152 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions, and read or write to plan data, via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2015-8486.
CVE-2016-1150 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1149.
CVE-2016-1149 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, and CVE-2016-1150.
CVE-2015-8489 Medium 2016-02-17 Not applicable No public exploit customapp in Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to cause a denial of service (excessive database locking) via a crafted CSV file, a different vulnerability than CVE-2016-1153.
CVE-2015-8488 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 10.3.0 allows remote attackers to read image files via a crafted e-mail message, a different vulnerability than CVE-2015-8487.
CVE-2015-8487 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 9.0.0 through 10.3 allows remote attackers to discover CSRF tokens via unspecified vectors, a different vulnerability than CVE-2015-8488.
CVE-2015-8486 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary report titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8485, and CVE-2016-1152.
CVE-2015-8485 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended access restrictions and read arbitrary posting titles via unspecified vectors, a different vulnerability than CVE-2015-8484, CVE-2015-8486, and CVE-2016-1152.
CVE-2015-8484 Medium 2016-02-17 Not applicable No public exploit Cybozu Office 9.9.0 through 10.3.0 allows remote authenticated users to bypass intended calendar-viewing restrictions via unspecified vectors, a different vulnerability than CVE-2015-8485, CVE-2015-8486, and CVE-2016-1152.
CVE-2015-7798 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2016-1149, and CVE-2016-1150.
CVE-2015-7797 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
CVE-2015-7796 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
CVE-2015-7795 Medium 2016-02-17 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7796, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
CVE-2013-7447 Medium 2016-02-17 Not applicable No public exploit Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.
CVE-2016-2388 Medium 2016-02-16 Not applicable Exploited The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
CVE-2016-2387 Medium 2016-02-16 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
CVE-2016-0753 Medium 2016-02-16 Not applicable No public exploit Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.
CVE-2015-7580 Medium 2016-02-16 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
CVE-2015-7579 Medium 2016-02-16 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
CVE-2015-7578 Medium 2016-02-16 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
CVE-2015-7577 Medium 2016-02-16 Not applicable No public exploit activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
CVE-2016-2314 Medium 2016-02-15 Not applicable No public exploit GlobespanVirata ftpd 1.0, as used on Huawei SmartAX MT882 devices V200R002B022 Arg, allows remote authenticated users to cause a denial of service (device outage) by using the FTP MKD command to create a directory with a long name, and then using certain other commands.
CVE-2016-1331 Medium 2016-02-15 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 11.5(0.99833.5) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy10766.
CVE-2016-1330 Medium 2016-02-15 Not applicable No public exploit Cisco IOS 15.2(4)E on Industrial Ethernet 2000 devices allows remote attackers to cause a denial of service (device reload) via crafted Cisco Discovery Protocol (CDP) packets, aka Bug ID CSCuy27746.
CVE-2016-1321 Medium 2016-02-15 Not applicable No public exploit Cisco Universal Small Cell devices with firmware R2.12 through R3.5 contain an image-decryption key in flash memory, which allows remote attackers to bypass a certain certificate-validation feature and obtain sensitive firmware-image and IP address data via a request to an unspecified Cisco server, aka Bug ID CSCut98082.
CVE-2016-0747 Medium 2016-02-15 Not applicable No public exploit The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
CVE-2016-0232 Medium 2016-02-15 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading README files.
CVE-2016-0231 Medium 2016-02-15 Not applicable No public exploit IBM Financial Transaction Manager (FTM) for ACH Services, Check Services and Corporate Payment Services (CPS) 3.0.0 before FP12 allows remote authenticated users to obtain sensitive information by reading exception details in error logs.
CVE-2015-8797 Medium 2016-02-15 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
CVE-2015-8796 Medium 2016-02-15 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.
CVE-2015-8795 Medium 2016-02-15 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.
‹ prev page 1 of 387 next ›