Overview 30,992 matches · 536 in Waratek scope · 56 protected · 534 exploited · 145 CISA KEV · 10,483 public PoC · 1,018 EPSS ≥ 0.5
30,992matches
536in Waratek scope1.7%
56protected0.2%
534exploited1.7%
145CISA KEV0.5%
10,483public PoC33.8%
1,018EPSS ≥ 0.53.3%
Protected by Waratek
56
0.2%
Rule in development
0
0.0%
Mitigation candidate
30
0.1%
No exploit published
450
1.5%
Outside Waratek scope
593
1.9%
Not applicable
29,863
96.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
56
0.2%
partly blocked
0
0.0%
not blocked
30,936
99.8%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 3,162 / year
19882
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19892
Not applicable2
High2
not blocked2
No public exploit2
19908
Not applicable8
High8
not blocked8
No public exploit8
199111
Not applicable11
High11
not blocked11
Working exploit published2
No public exploit9
199212
Not applicable12
High12
not blocked12
No public exploit12
19938
Not applicable8
High8
not blocked8
No public exploit8
199414
Not applicable14
High14
not blocked14
Working exploit published3
No public exploit11
199517
Not applicable17
High17
not blocked17
Working exploit published2
No public exploit15
199643
No exploit published1
Not applicable42
High43
not blocked43
Working exploit published12
Forecast only1
No public exploit30
1997143
Not applicable143
High143
not blocked143
Exploited2
Working exploit published51
No public exploit90
1998137
Not applicable137
High137
not blocked137
Exploited1
Working exploit published33
No public exploit103
1999423
No exploit published2
Not applicable421
High423
not blocked423
Exploited2
Working exploit published132
No public exploit289
2000454
Mitigation candidate2
No exploit published3
Outside Waratek scope2
Not applicable447
High454
not blocked454
Exploited3
Working exploit published197
Forecast only1
No public exploit253
2001776
Protected by Waratek1
No exploit published6
Outside Waratek scope5
Not applicable764
High776
blocked by ARMR today1
not blocked775
Exploited11
Working exploit published219
No public exploit546
20021,023
Protected by Waratek1
Mitigation candidate2
No exploit published8
Outside Waratek scope8
Not applicable1,004
High1,023
blocked by ARMR today1
not blocked1,022
Exploited9
Working exploit published276
Forecast only3
No public exploit735
2003674
Mitigation candidate2
No exploit published7
Outside Waratek scope4
Not applicable661
High674
not blocked674
Exploited10
Working exploit published236
No public exploit428
2004973
Protected by Waratek1
No exploit published5
Outside Waratek scope4
Not applicable963
High973
blocked by ARMR today1
not blocked972
Exploited10
Working exploit published302
No public exploit661
20052,048
No exploit published30
Outside Waratek scope10
Not applicable2,008
High2,048
not blocked2,048
Exploited11
Working exploit published658
Forecast only5
No public exploit1,374
20062,763
Protected by Waratek4
No exploit published62
Outside Waratek scope63
Not applicable2,634
High2,763
blocked by ARMR today4
not blocked2,759
Exploited26
Working exploit published1,197
Proof of concept only1
Forecast only4
No public exploit1,535
20073,162
Protected by Waratek3
Mitigation candidate1
No exploit published64
Outside Waratek scope26
Not applicable3,068
High3,162
blocked by ARMR today3
not blocked3,159
Exploited32
Working exploit published1,405
Proof of concept only1
Forecast only4
No public exploit1,720
20082,846
Protected by Waratek3
Mitigation candidate1
No exploit published42
Outside Waratek scope44
Not applicable2,756
High2,846
blocked by ARMR today3
not blocked2,843
Exploited33
Working exploit published1,492
Proof of concept only2
Forecast only8
No public exploit1,311
20092,734
Protected by Waratek3
Mitigation candidate4
No exploit published45
Outside Waratek scope26
Not applicable2,656
High2,734
blocked by ARMR today3
not blocked2,731
Exploited54
Working exploit published1,424
No public exploit1,256
20102,093
Protected by Waratek2
Mitigation candidate1
No exploit published24
Outside Waratek scope41
Not applicable2,025
High2,093
blocked by ARMR today2
not blocked2,091
Exploited53
Working exploit published730
Forecast only6
No public exploit1,304
20111,784
Protected by Waratek1
Mitigation candidate4
No exploit published15
Outside Waratek scope44
Not applicable1,720
High1,784
blocked by ARMR today1
not blocked1,783
Exploited38
Working exploit published380
Proof of concept only1
Forecast only2
No public exploit1,363
20121,724
Protected by Waratek2
Mitigation candidate2
No exploit published25
Outside Waratek scope34
Not applicable1,661
High1,724
blocked by ARMR today2
not blocked1,722
Exploited31
Working exploit published316
Proof of concept only4
Forecast only4
No public exploit1,369
20131,735
Protected by Waratek12
Mitigation candidate4
No exploit published29
Outside Waratek scope132
Not applicable1,558
High1,735
blocked by ARMR today12
not blocked1,723
Exploited62
Working exploit published241
Proof of concept only2
Forecast only15
No public exploit1,415
20141,938
Protected by Waratek9
Mitigation candidate3
No exploit published18
Outside Waratek scope74
Not applicable1,834
High1,938
blocked by ARMR today9
not blocked1,929
Exploited63
Working exploit published340
Proof of concept only5
Forecast only4
No public exploit1,526
20152,354
Protected by Waratek8
Mitigation candidate1
No exploit published33
Outside Waratek scope60
Not applicable2,252
High2,354
blocked by ARMR today8
not blocked2,346
Exploited57
Working exploit published351
Proof of concept only8
Forecast only10
No public exploit1,928
20161,091
Protected by Waratek6
Mitigation candidate3
No exploit published31
Outside Waratek scope16
Not applicable1,035
High1,091
blocked by ARMR today6
not blocked1,085
Exploited26
Working exploit published107
Proof of concept only5
Forecast only8
No public exploit945
1989199219951998200120042007201020132016
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-4506 | High | 2016-05-31 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability on Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allows remote authenticated users to hijack the authentication of arbitrary users. |
| CVE-2016-4505 | High | 2016-05-31 | Not applicable | No public exploit | Resource Data Management (RDM) Intuitive 650 TDB Controller devices before 2.1.24 allow remote authenticated users to modify arbitrary passwords via unspecified vectors. |
| CVE-2016-4502 | High | 2016-05-31 | Not applicable | No public exploit | Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier allows remote attackers to bypass intended access restrictions and execute arbitrary functions via a modified parameter. |
| CVE-2016-2295 | High | 2016-05-31 | Not applicable | No public exploit | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allow remote attackers to obtain sensitive cleartext information by reading a configuration file. |
| CVE-2016-2286 | High | 2016-05-31 | Not applicable | No public exploit | Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 have a blank default password, which allows remote attackers to obtain access via unspecified vectors. |
| CVE-2016-2285 | High | 2016-05-31 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability on Moxa MiiNePort_E1_4641 devices with firmware 1.1.10 Build 09120714, MiiNePort_E1_7080 devices with firmware 1.1.10 Build 09120714, MiiNePort_E2_1242 devices with firmware 1.1 Build 10080614, MiiNePort_E2_4561 devices with firmware 1.1 Build 10080614, and MiiNePort E3 devices with firmware 1.0 Build 11071409 allows remote attackers to hijack the authentication of arbitrary users. |
| CVE-2016-0879 | High | 2016-05-31 | Not applicable | No public exploit | Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspecified URL. |
| CVE-2016-0878 | High | 2016-05-31 | Not applicable | No public exploit | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to cause a denial of service (cold start) by sending two crafted ping requests. |
| CVE-2016-0877 | High | 2016-05-31 | Not applicable | No public exploit | Memory leak on Moxa Secure Router EDR-G903 devices before 3.4.12 allows remote attackers to cause a denial of service (memory consumption) by executing the ping function. |
| CVE-2016-0876 | High | 2016-05-31 | Not applicable | No public exploit | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to discover cleartext passwords by reading a configuration file. |
| CVE-2016-0875 | High | 2016-05-31 | Not applicable | No public exploit | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL. |
| CVE-2016-4118 | High | 2016-05-30 | Not applicable | No public exploit | Untrusted search path vulnerability in the installer in Adobe Connect Add-In before 11.9.976.291 on Windows allows local users to gain privileges via unspecified vectors. |
| CVE-2016-2309 | High | 2016-05-30 | Not applicable | No public exploit | iRZ RUH2 before 2b does not validate firmware patches, which allows remote authenticated users to modify data or cause a denial of service via unspecified vectors. |
| CVE-2016-2025 | High | 2016-05-30 | Not applicable | No public exploit | HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related to the Web Client, Service Request Catalog, and Mobility components. |
| CVE-2016-1409 | High | 2016-05-29 | Not applicable | Exploited | The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Cisco IOS XE 2.1 through 3.17S, IOS XR 2.0.0 through 5.3.2, and NX-OS allows remote attackers to cause a denial of service (packet-processing outage) via crafted ND messages, aka Bug ID CSCuz66542, as exploited in the wild in May 2016. |
| CVE-2016-1404 | High | 2016-05-29 | Not applicable | No public exploit | Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic to an Autosupport server and leveraging knowledge of this key from another installation, aka Bug ID CSCur85504. |
| CVE-2016-1410 | High | 2016-05-28 | Not applicable | No public exploit | Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) attending or (2) hosting a meeting, aka Bug ID CSCux84312. |
| CVE-2016-4791 | High | 2016-05-26 | Not applicable | No public exploit | The administrative user interface in Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r2, 8.0 before 8.0r9, and 7.4 before 7.4r13.4 allows remote administrators to enumerate files, read arbitrary files, and conduct server side request forgery (SSRF) attacks via unspecified vectors. |
| CVE-2016-4786 | High | 2016-05-26 | Not applicable | No public exploit | Pulse Connect Secure (PCS) 8.2 before 8.2r1, 8.1 before 8.1r3, 8.0 before 8.0r11, and 7.4 before 7.4r13.4 allow remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. |
| CVE-2016-4021 | High | 2016-05-26 | Not applicable | No public exploit | The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop and CPU consumption) via crafted input, as demonstrated by the \xa3\x03 string. |
| CVE-2016-3681 | High | 2016-05-26 | Not applicable | No public exploit | Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03021. |
| CVE-2016-3680 | High | 2016-05-26 | Not applicable | No public exploit | Buffer overflow in the Wi-Fi driver in Huawei Mate 8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (crash) or possibly gain privileges via a crafted application, aka HWPSIRT-2016-03020. |
| CVE-2016-1887 | High | 2016-05-25 | Not applicable | Working exploit published | Integer signedness error in the sockargs function in sys/kern/uipc_syscalls.c in FreeBSD 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to cause a denial of service (memory overwrite and kernel panic) or gain privileges via a negative buflen argument, which triggers a heap-based buffer overflow. |
| CVE-2016-1886 | High | 2016-05-25 | Not applicable | Working exploit published | Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow." |
| CVE-2016-1407 | High | 2016-05-25 | Not applicable | No public exploit | Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries, which allows remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports, aka Bug ID CSCux95576. |
| CVE-2016-1406 | High | 2016-05-25 | Outside Waratek scope | No public exploit | The API web interface in Cisco Prime Infrastructure before 3.1 and Cisco Evolved Programmable Network Manager before 1.2.4 allows remote authenticated users to bypass intended RBAC restrictions and obtain sensitive information, and consequently gain privileges, via crafted JSON data, aka Bug ID CSCuy12409. |
| CVE-2016-1400 | High | 2016-05-25 | Not applicable | No public exploit | Cisco TelePresence Video Communications Server (VCS) X8.x before X8.7.2 allows remote attackers to cause a denial of service (service disruption) via a crafted URI in a SIP header, aka Bug ID CSCuy43258. |
| CVE-2016-1383 | High | 2016-05-25 | Not applicable | No public exploit | Memory leak in Cisco AsyncOS through 8.8 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an unspecified HTTP status code, aka Bug ID CSCur28305. |
| CVE-2016-1382 | High | 2016-05-25 | Not applicable | No public exploit | Cisco AsyncOS before 8.5.3-069 and 8.6 through 8.8 on Web Security Appliance (WSA) devices mishandles memory allocation for HTTP requests, which allows remote attackers to cause a denial of service (proxy-process reload) via a crafted request, aka Bug ID CSCuu02529. |
| CVE-2016-1381 | High | 2016-05-25 | Not applicable | No public exploit | Memory leak in Cisco AsyncOS 8.5 through 9.0 before 9.0.1-162 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via an HTTP file-range request for cached content, aka Bug ID CSCuw97270. |
| CVE-2016-1380 | High | 2016-05-25 | Not applicable | No public exploit | Cisco AsyncOS 8.0 before 8.0.6-119 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (proxy-process hang) via a crafted HTTP POST request, aka Bug ID CSCuo12171. |
| CVE-2015-8853 | High | 2016-05-25 | Not applicable | No public exploit | The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80." |
| CVE-2016-4951 | High | 2016-05-23 | Not applicable | No public exploit | The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation. |
| CVE-2016-4913 | High | 2016-05-23 | Not applicable | No public exploit | The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem. |
| CVE-2016-4805 | High | 2016-05-23 | Not applicable | No public exploit | Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions. |
| CVE-2016-4794 | High | 2016-05-23 | Not applicable | No public exploit | Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls. |
| CVE-2016-4782 | High | 2016-05-23 | Not applicable | No public exploit | Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack." |
| CVE-2016-4580 | High | 2016-05-23 | Not applicable | No public exploit | The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request. |
| CVE-2016-4577 | High | 2016-05-23 | Not applicable | No public exploit | Buffer overflow in the Smart DNS functionality in the Huawei NGFW Module and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls with software before V500R001C20SPC100 allows remote attackers to cause a denial of service or execute arbitrary code via a crafted packet, related to "illegitimate parameters." |
| CVE-2016-4568 | High | 2016-05-23 | Not applicable | No public exploit | drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call. |
| CVE-2016-4565 | High | 2016-05-23 | Not applicable | No public exploit | The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. |
| CVE-2016-4558 | High | 2016-05-23 | Not applicable | Working exploit published | The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count. |
| CVE-2016-4557 | High | 2016-05-23 | Not applicable | Working exploit published | The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor. |
| CVE-2016-4485 | High | 2016-05-23 | Not applicable | No public exploit | The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message. |
| CVE-2016-4087 | High | 2016-05-23 | Not applicable | No public exploit | Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch is enabled, allows remote attackers to cause a denial of service or execute arbitrary code via crafted DNS packets. |
| CVE-2016-4049 | High | 2016-05-23 | Not applicable | No public exploit | The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a denial of service (assertion failure and daemon crash) via a large BGP packet. |
| CVE-2016-4001 | High | 2016-05-23 | Not applicable | No public exploit | Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large packets, allows remote attackers to cause a denial of service (QEMU crash) via a large packet. |
| CVE-2016-3959 | High | 2016-05-23 | Not applicable | No public exploit | The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries. |
| CVE-2016-3958 | High | 2016-05-23 | Not applicable | No public exploit | Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. |
| CVE-2016-3664 | High | 2016-05-23 | Not applicable | No public exploit | Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allows man-in-the-middle attackers to spoof this server and obtain sensitive information via a crafted certificate. |
| CVE-2016-2855 | High | 2016-05-23 | Not applicable | No public exploit | The Huawei Mobile Broadband HL Service 22.001.25.00.03 and earlier uses a weak ACL for the MobileBrServ program data directory, which allows local users to gain SYSTEM privileges by modifying VERSION.dll. |
| CVE-2016-4343 | High | 2016-05-22 | Not applicable | No public exploit | The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive. |
| CVE-2016-4342 | High | 2016-05-22 | Not applicable | No public exploit | ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive. |
| CVE-2016-2222 | High | 2016-05-22 | Not applicable | No public exploit | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php. |
| CVE-2016-2221 | High | 2016-05-22 | Not applicable | No public exploit | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL. |
| CVE-2016-2157 | High | 2016-05-22 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins. |
| CVE-2015-8879 | High | 2016-05-22 | Not applicable | No public exploit | The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table. |
| CVE-2015-8877 | High | 2016-05-22 | Not applicable | No public exploit | The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function. |
| CVE-2015-8867 | High | 2016-05-22 | Not applicable | No public exploit | The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. |
| CVE-2016-1402 | High | 2016-05-21 | Not applicable | No public exploit | The Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorization is enabled, allows remote attackers to cause a denial of service (authentication outage) via a crafted Password Authentication Protocol (PAP) authentication request, aka Bug ID CSCun25815. |
| CVE-2016-4348 | High | 2016-05-20 | Not applicable | No public exploit | The _rsvg_css_normalize_font_size function in librsvg 2.40.2 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via circular definitions in an SVG document. |
| CVE-2016-4070 | High | 2016-05-20 | Not applicable | No public exploit | Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not). |
| CVE-2016-3728 | High | 2016-05-20 | Not applicable | No public exploit | Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/. |
| CVE-2016-3693 | High | 2016-05-20 | Not applicable | No public exploit | The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method. |
| CVE-2016-1859 | High | 2016-05-20 | Not applicable | No public exploit | The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. |
| CVE-2016-1857 | High | 2016-05-20 | Not applicable | No public exploit | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856. |
| CVE-2016-1856 | High | 2016-05-20 | Not applicable | No public exploit | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1857. |
| CVE-2016-1855 | High | 2016-05-20 | Not applicable | No public exploit | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1856, and CVE-2016-1857. |
| CVE-2016-1854 | High | 2016-05-20 | Not applicable | No public exploit | WebKit, as used in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1855, CVE-2016-1856, and CVE-2016-1857. |
| CVE-2016-1853 | High | 2016-05-20 | Not applicable | No public exploit | Tcl in Apple OS X before 10.11.5 allows remote attackers to obtain sensitive information by leveraging SSLv2 support. |
| CVE-2016-1850 | High | 2016-05-20 | Not applicable | No public exploit | SceneKit in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file. |
| CVE-2016-1848 | High | 2016-05-20 | Not applicable | Working exploit published | QuickTime in Apple OS X before 10.11.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file. |
| CVE-2016-1847 | High | 2016-05-20 | Not applicable | No public exploit | OpenGL, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. |
| CVE-2016-1846 | High | 2016-05-20 | Not applicable | Working exploit published | The nvCommandQueue::GetHandleIndex method in the NVIDIA Graphics Drivers subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference and memory corruption) via a crafted app. |
| CVE-2016-1843 | High | 2016-05-20 | Not applicable | No public exploit | The Messages component in Apple OS X before 10.11.5 mishandles filename encoding, which allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2016-1842 | High | 2016-05-20 | Not applicable | No public exploit | MapKit in Apple iOS before 9.3.2, OS X before 10.11.5, and watchOS before 2.2.1 does not use HTTPS for shared links, which allows remote attackers to obtain sensitive information by sniffing the network for HTTP traffic. |
| CVE-2016-1841 | High | 2016-05-20 | Not applicable | No public exploit | libxslt, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. |
| CVE-2016-1840 | High | 2016-05-20 | Not applicable | No public exploit | Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. |
| CVE-2016-1835 | High | 2016-05-20 | Not applicable | No public exploit | Use-after-free vulnerability in the xmlSAX2AttributeNs function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2 and OS X before 10.11.5, allows remote attackers to cause a denial of service via a crafted XML document. |
| CVE-2016-1834 | High | 2016-05-20 | Not applicable | No public exploit | Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. |
| CVE-2016-1832 | High | 2016-05-20 | Not applicable | No public exploit | libc in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors. |
| CVE-2016-1831 | High | 2016-05-20 | Not applicable | No public exploit | The kernel in Apple iOS before 9.3.2 and OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. |
| CVE-2016-1830 | High | 2016-05-20 | Not applicable | No public exploit | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1828, and CVE-2016-1829. |
| CVE-2016-1829 | High | 2016-05-20 | Not applicable | No public exploit | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1828, and CVE-2016-1830. |
| CVE-2016-1828 | High | 2016-05-20 | Not applicable | Working exploit published | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1829, and CVE-2016-1830. |
| CVE-2016-1827 | High | 2016-05-20 | Not applicable | Working exploit published | The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1828, CVE-2016-1829, and CVE-2016-1830. |
| CVE-2016-1826 | High | 2016-05-20 | Not applicable | No public exploit | Integer overflow in the dtrace implementation in the kernel in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app. |
| CVE-2016-1825 | High | 2016-05-20 | Not applicable | Working exploit published | IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. |
| CVE-2016-1824 | High | 2016-05-20 | Not applicable | No public exploit | IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1823. |
| CVE-2016-1823 | High | 2016-05-20 | Not applicable | Working exploit published | The IOHIDDevice::handleReportWithTime function in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read and memory corruption) via a crafted IOHIDReportType enum, which triggers an incorrect cast, a different vulnerability than CVE-2016-1824. |
| CVE-2016-1822 | High | 2016-05-20 | Not applicable | No public exploit | IOFireWireFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. |
| CVE-2016-1821 | High | 2016-05-20 | Not applicable | Working exploit published | IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. |
| CVE-2016-1820 | High | 2016-05-20 | Not applicable | No public exploit | Buffer overflow in IOAudioFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app. |
| CVE-2016-1819 | High | 2016-05-20 | Not applicable | Working exploit published | Use-after-free vulnerability in the IOAccelContext2::clientMemoryForType method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1817 and CVE-2016-1818. |
| CVE-2016-1818 | High | 2016-05-20 | Not applicable | No public exploit | IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1817 and CVE-2016-1819. |
| CVE-2016-1817 | High | 2016-05-20 | Not applicable | No public exploit | IOAcceleratorFamily in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1818 and CVE-2016-1819. |
| CVE-2016-1816 | High | 2016-05-20 | Not applicable | No public exploit | IOAcceleratorFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. |
| CVE-2016-1815 | High | 2016-05-20 | Not applicable | No public exploit | IOAcceleratorFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. |
| CVE-2016-1813 | High | 2016-05-20 | Not applicable | Working exploit published | The IOAccelSharedUserClient2::page_off_resource method in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app. |
| CVE-2016-1812 | High | 2016-05-20 | Not applicable | No public exploit | Buffer overflow in Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context via a crafted app. |