Overview 5,411 matches · 387 in Waratek scope · 5 protected · 10 exploited · 2 CISA KEV · 589 public PoC · 20 EPSS ≥ 0.5
5,411matches
387in Waratek scope7.2%
5protected0.1%
10exploited0.2%
2CISA KEV0.0%
589public PoC10.9%
20EPSS ≥ 0.50.4%
Protected by Waratek
5
0.1%
Rule in development
0
0.0%
Mitigation candidate
15
0.3%
No exploit published
367
6.8%
Outside Waratek scope
88
1.6%
Not applicable
4,936
91.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
5
0.1%
partly blocked
0
0.0%
not blocked
5,406
99.9%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 656 / year
19901
Not applicable1
Low1
not blocked1
No public exploit1
19910
19921
Not applicable1
Low1
not blocked1
No public exploit1
19932
Not applicable2
Low2
not blocked2
No public exploit2
19941
Not applicable1
Low1
not blocked1
Working exploit published1
19951
Not applicable1
Low1
not blocked1
No public exploit1
19969
Not applicable9
Low9
not blocked9
No public exploit9
199719
Not applicable19
Low19
not blocked19
Working exploit published4
Forecast only2
No public exploit13
199823
Not applicable23
Low23
not blocked23
Working exploit published5
No public exploit18
1999111
Not applicable111
Low111
not blocked111
Working exploit published28
No public exploit83
200096
Not applicable96
Low96
not blocked96
Working exploit published34
No public exploit62
2001182
Outside Waratek scope2
Not applicable180
Low182
not blocked182
Working exploit published38
No public exploit144
2002143
No exploit published3
Not applicable140
Low143
not blocked143
Working exploit published18
Forecast only2
No public exploit123
200397
Mitigation candidate1
No exploit published5
Outside Waratek scope1
Not applicable90
Low97
not blocked97
Working exploit published16
No public exploit81
2004203
No exploit published3
Not applicable200
Low203
not blocked203
Working exploit published36
No public exploit167
2005441
No exploit published5
Outside Waratek scope1
Not applicable435
Low441
not blocked441
Exploited2
Working exploit published52
No public exploit387
2006509
No exploit published11
Outside Waratek scope1
Not applicable497
Low509
not blocked509
Exploited1
Working exploit published99
No public exploit409
2007232
Protected by Waratek1
No exploit published10
Outside Waratek scope4
Not applicable217
Low232
blocked by ARMR today1
not blocked231
Working exploit published29
Proof of concept only1
No public exploit202
2008185
No exploit published7
Outside Waratek scope3
Not applicable175
Low185
not blocked185
Working exploit published30
No public exploit155
2009197
Protected by Waratek1
No exploit published21
Outside Waratek scope5
Not applicable170
Low197
blocked by ARMR today1
not blocked196
Exploited1
Working exploit published33
No public exploit163
2010277
Mitigation candidate2
No exploit published20
Outside Waratek scope10
Not applicable245
Low277
not blocked277
Exploited1
Working exploit published28
No public exploit248
2011260
Protected by Waratek1
Mitigation candidate2
No exploit published31
Outside Waratek scope13
Not applicable213
Low260
blocked by ARMR today1
not blocked259
Working exploit published13
Proof of concept only1
No public exploit246
2012508
Mitigation candidate4
No exploit published76
Outside Waratek scope6
Not applicable422
Low508
not blocked508
Working exploit published33
Proof of concept only1
No public exploit474
2013515
Protected by Waratek1
Mitigation candidate2
No exploit published51
Outside Waratek scope11
Not applicable450
Low515
blocked by ARMR today1
not blocked514
Exploited4
Working exploit published20
No public exploit491
2014656
No exploit published49
Outside Waratek scope14
Not applicable593
Low656
not blocked656
Exploited1
Working exploit published27
Proof of concept only1
No public exploit627
2015588
Protected by Waratek1
Mitigation candidate4
No exploit published46
Outside Waratek scope12
Not applicable525
Low588
blocked by ARMR today1
not blocked587
Working exploit published33
Proof of concept only1
Forecast only1
No public exploit553
2016154
No exploit published29
Outside Waratek scope5
Not applicable120
Low154
not blocked154
Working exploit published3
Forecast only2
No public exploit149
199219951998200120042007201020132016
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-5812 | Low | 2016-08-24 | Not applicable | No public exploit | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain sensitive information by reading a configuration file. |
| CVE-2013-7458 | Low | 2016-08-10 | Not applicable | No public exploit | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file. |
| CVE-2016-3321 | Low | 2016-08-09 | Not applicable | No public exploit | Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability." |
| CVE-2016-2960 | Low | 2016-08-08 | No exploit published | No public exploit | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages. |
| CVE-2016-0380 | Low | 2016-08-08 | Not applicable | No public exploit | IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations. |
| CVE-2016-0281 | Low | 2016-08-08 | Not applicable | No public exploit | The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or FC5899 adapter crash) via crafted packets. |
| CVE-2016-0266 | Low | 2016-08-08 | Not applicable | No public exploit | IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors. |
| CVE-2016-6224 | Low | 2016-07-22 | Not applicable | No public exploit | ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which allows local users to obtain sensitive information via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8946. |
| CVE-2016-4645 | Low | 2016-07-22 | Not applicable | No public exploit | CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2016-4593 | Low | 2016-07-22 | Not applicable | No public exploit | The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors. |
| CVE-2016-4583 | Low | 2016-07-22 | Not applicable | No public exploit | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document. |
| CVE-2015-8946 | Low | 2016-07-22 | Not applicable | No public exploit | ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2016-5473 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to File Folders / Attachment, a different vulnerability than CVE-2016-3537. |
| CVE-2016-5466 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-3450 and CVE-2016-5460. |
| CVE-2016-5462 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote administrators to affect confidentiality via vectors related to Workspaces. |
| CVE-2016-5460 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-3450 and CVE-2016-5466. |
| CVE-2016-5444 | Low | 2016-07-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection. |
| CVE-2016-3531 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to PC / Notification. |
| CVE-2016-3516 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote authenticated users to affect confidentiality via vectors related to GUI, a different vulnerability than CVE-2016-3514. |
| CVE-2016-3490 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, and 6.4.1 allows remote authenticated users to affect confidentiality via vectors related to Database. |
| CVE-2016-3485 | Low | 2016-07-21 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking. |
| CVE-2016-3484 | Low | 2016-07-21 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality and integrity via unknown vectors. |
| CVE-2016-3482 | Low | 2016-07-21 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect confidentiality via vectors related to SSL/TLS Module. |
| CVE-2016-3474 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality via vectors related to Security. |
| CVE-2016-3469 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows local users to affect confidentiality via vectors related to Services. |
| CVE-2016-3452 | Low | 2016-07-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption. |
| CVE-2016-3450 | Low | 2016-07-21 | No exploit published | No public exploit | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-5460 and CVE-2016-5466. |
| CVE-2016-3276 | Low | 2016-07-13 | Not applicable | No public exploit | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability." |
| CVE-2016-3274 | Low | 2016-07-13 | Not applicable | No public exploit | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability." |
| CVE-2016-3272 | Low | 2016-07-13 | Not applicable | No public exploit | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which allows local users to obtain sensitive information from an arbitrary process via a crafted application, aka "Windows Kernel Information Disclosure Vulnerability." |
| CVE-2016-3251 | Low | 2016-07-13 | Not applicable | Forecast only | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerability." |
| CVE-2016-3763 | Low | 2016-07-11 | Not applicable | No public exploit | net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 27593919. |
| CVE-2016-3759 | Low | 2016-07-11 | Not applicable | No public exploit | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages priv-app access to insert a backup transport, aka internal bug 28406080. |
| CVE-2016-5849 | Low | 2016-07-04 | Not applicable | No public exploit | Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage. |
| CVE-2016-5702 | Low | 2016-07-03 | Not applicable | No public exploit | phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI. |
| CVE-2016-2894 | Low | 2016-07-03 | Not applicable | No public exploit | IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions. |
| CVE-2016-2870 | Low | 2016-07-02 | Not applicable | No public exploit | Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors. |
| CVE-2016-2868 | Low | 2016-07-02 | Not applicable | No public exploit | IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2016-2861 | Low | 2016-07-02 | Not applicable | No public exploit | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. |
| CVE-2015-8801 | Low | 2016-06-30 | Not applicable | No public exploit | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device. |
| CVE-2016-0259 | Low | 2016-06-26 | Not applicable | No public exploit | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands. |
| CVE-2015-7473 | Low | 2016-06-26 | Not applicable | No public exploit | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp. |
| CVE-2016-1862 | Low | 2016-06-19 | Not applicable | No public exploit | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860. |
| CVE-2016-1860 | Low | 2016-06-19 | Not applicable | No public exploit | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862. |
| CVE-2016-1183 | Low | 2016-06-19 | Not applicable | No public exploit | NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname. |
| CVE-2016-5233 | Low | 2016-06-10 | Not applicable | No public exploit | Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182 allow remote base stations to obtain sensitive subscriber signal strength information via vectors involving improper security status verification, aka HWPSIRT-2015-12007. |
| CVE-2016-4527 | Low | 2016-06-10 | Not applicable | No public exploit | ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2016-4516 | Low | 2016-06-10 | Not applicable | No public exploit | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors. |
| CVE-2016-4511 | Low | 2016-06-10 | Not applicable | No public exploit | ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file. |
| CVE-2016-3711 | Low | 2016-06-08 | Not applicable | No public exploit | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie. |
| CVE-2016-1212 | Low | 2016-06-05 | Not applicable | No public exploit | Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors. |
| CVE-2016-4486 | Low | 2016-05-23 | Not applicable | Working exploit published | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message. |
| CVE-2016-1852 | Low | 2016-05-20 | Not applicable | No public exploit | Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors. |
| CVE-2016-1849 | Low | 2016-05-20 | Not applicable | No public exploit | The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory. |
| CVE-2016-1798 | Low | 2016-05-20 | Not applicable | No public exploit | Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app. |
| CVE-2016-1796 | Low | 2016-05-20 | Not applicable | No public exploit | Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds memory access) via a crafted app. |
| CVE-2016-1791 | Low | 2016-05-20 | Not applicable | No public exploit | The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. |
| CVE-2016-1790 | Low | 2016-05-20 | Not applicable | No public exploit | Buffer overflow in the Accessibility component in Apple iOS before 9.3.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. |
| CVE-2016-0707 | Low | 2016-05-18 | Not applicable | No public exploit | The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories. |
| CVE-2016-0175 | Low | 2016-05-11 | Not applicable | No public exploit | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses, and consequently bypass the KASLR protection mechanism, via a crafted application, aka "Win32k Information Disclosure Vulnerability." |
| CVE-2015-0858 | Low | 2016-05-06 | Not applicable | No public exploit | Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory. |
| CVE-2016-4534 | Low | 2016-05-05 | Not applicable | Working exploit published | The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local administrators to bypass intended self-protection rules and unlock the console window by closing registry handles. |
| CVE-2016-3716 | Low | 2016-05-05 | Not applicable | Working exploit published | The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. |
| CVE-2016-4053 | Low | 2016-04-25 | Not applicable | No public exploit | Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. |
| CVE-2016-1185 | Low | 2016-04-25 | Not applicable | No public exploit | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application. |
| CVE-2016-3428 | Low | 2016-04-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect availability via vectors related to Engineering Communication Interface. |
| CVE-2016-3426 | Low | 2016-04-21 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE. |
| CVE-2016-3419 | Low | 2016-04-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect availability via vectors related to Filesystem. |
| CVE-2016-0691 | Low | 2016-04-21 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0690. |
| CVE-2016-0690 | Low | 2016-04-21 | Outside Waratek scope | No public exploit | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a different vulnerability than CVE-2016-0691. |
| CVE-2016-0688 | Low | 2016-04-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors related to Core Components. |
| CVE-2016-0671 | Low | 2016-04-21 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL Module. |
| CVE-2016-0643 | Low | 2016-04-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML. |
| CVE-2015-8842 | Low | 2016-04-20 | Not applicable | No public exploit | tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file. |
| CVE-2014-9770 | Low | 2016-04-20 | Not applicable | No public exploit | tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain sensitive information by reading these files. |
| CVE-2015-7511 | Low | 2016-04-19 | Not applicable | No public exploit | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations. |
| CVE-2016-3972 | Low | 2016-04-18 | Not applicable | No public exploit | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the fileName parameter. |
| CVE-2016-3159 | Low | 2016-04-13 | Not applicable | No public exploit | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. |
| CVE-2016-3158 | Low | 2016-04-13 | Not applicable | No public exploit | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. |
| CVE-2016-2057 | Low | 2016-04-13 | Not applicable | No public exploit | lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue. |
| CVE-2015-5313 | Low | 2016-04-11 | Not applicable | No public exploit | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. |
| CVE-2016-2513 | Low | 2016-04-08 | Not applicable | No public exploit | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests. |
| CVE-2016-1773 | Low | 2016-03-24 | Not applicable | No public exploit | The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via unspecified vectors. |
| CVE-2016-1763 | Low | 2016-03-24 | Not applicable | No public exploit | Messages in Apple iOS before 9.3 does not ensure that an auto-fill action applies to the intended message thread, which allows remote authenticated users to obtain sensitive information by providing a crafted sms: URL and reading a thread. |
| CVE-2016-1758 | Low | 2016-03-24 | Not applicable | No public exploit | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a crafted app. |
| CVE-2016-1748 | Low | 2016-03-24 | Not applicable | No public exploit | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. |
| CVE-2016-3155 | Low | 2016-03-18 | Not applicable | No public exploit | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors. |
| CVE-2016-0208 | Low | 2016-03-14 | Not applicable | No public exploit | IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via unspecified vectors. |
| CVE-2016-0125 | Low | 2016-03-09 | Not applicable | No public exploit | Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka "Microsoft Edge Information Disclosure Vulnerability." |
| CVE-2016-1356 | Low | 2016-03-03 | Not applicable | No public exploit | Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by measuring timing differences, aka Bug ID CSCuy41615. |
| CVE-2015-7490 | Low | 2016-03-03 | Not applicable | No public exploit | IBM InfoSphere Information Server 8.5 through FP3, 8.7 through FP2, 9.1 through 9.1.2.0, 11.3 through 11.3.1.2, and 11.5 allows remote authenticated users to bypass intended access restrictions via a modified cookie. |
| CVE-2015-7455 | Low | 2016-02-29 | Not applicable | No public exploit | IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI. |
| CVE-2015-7576 | Low | 2016-02-16 | Not applicable | No public exploit | The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences. |
| CVE-2016-0701 | Low | 2016-02-15 | Not applicable | Forecast only | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file. |
| CVE-2015-7408 | Low | 2016-02-15 | Not applicable | No public exploit | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority. |
| CVE-2016-2091 | Low | 2016-02-08 | Not applicable | No public exploit | The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file. |
| CVE-2016-0618 | Low | 2016-01-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality via unknown vectors related to Zones. |
| CVE-2016-0610 | Low | 2016-01-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.6.27 and earlier and MariaDB before 10.0.22 and 10.1.x before 10.1.9 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. |
| CVE-2016-0609 | Low | 2016-01-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges. |
| CVE-2016-0608 | Low | 2016-01-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF. |