WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Published to 2016-10-31✕
Overview 5,454 matches · 390 in Waratek scope · 5 protected · 10 exploited · 2 CISA KEV · 590 public PoC · 21 EPSS ≥ 0.5
split by peak 656 / year
Not applicable: 4,971Outside Waratek scope: 93No exploit published: 370Mitigation candidate: 15Protected by Waratek: 5 Low: 5,454 not blocked: 5,449blocked by ARMR today: 5 No public exploit: 4,851Forecast only: 7Proof of concept only: 5Working exploit published: 581Exploited: 10
19901 Not applicable1 Low1 not blocked1 No public exploit1 19910 19921 Not applicable1 Low1 not blocked1 No public exploit1 19932 Not applicable2 Low2 not blocked2 No public exploit2 19941 Not applicable1 Low1 not blocked1 Working exploit published1 19951 Not applicable1 Low1 not blocked1 No public exploit1 19969 Not applicable9 Low9 not blocked9 No public exploit9 199719 Not applicable19 Low19 not blocked19 Working exploit published4 Forecast only2 No public exploit13 199823 Not applicable23 Low23 not blocked23 Working exploit published5 No public exploit18 1999111 Not applicable111 Low111 not blocked111 Working exploit published28 No public exploit83 200096 Not applicable96 Low96 not blocked96 Working exploit published34 No public exploit62 2001182 Outside Waratek scope2 Not applicable180 Low182 not blocked182 Working exploit published38 No public exploit144 2002143 No exploit published3 Not applicable140 Low143 not blocked143 Working exploit published18 Forecast only2 No public exploit123 200397 Mitigation candidate1 No exploit published5 Outside Waratek scope1 Not applicable90 Low97 not blocked97 Working exploit published16 No public exploit81 2004203 No exploit published3 Not applicable200 Low203 not blocked203 Working exploit published36 No public exploit167 2005441 No exploit published5 Outside Waratek scope1 Not applicable435 Low441 not blocked441 Exploited2 Working exploit published52 No public exploit387 2006509 No exploit published11 Outside Waratek scope1 Not applicable497 Low509 not blocked509 Exploited1 Working exploit published99 No public exploit409 2007232 Protected by Waratek1 No exploit published10 Outside Waratek scope4 Not applicable217 Low232 blocked by ARMR today1 not blocked231 Working exploit published29 Proof of concept only1 No public exploit202 2008185 No exploit published7 Outside Waratek scope3 Not applicable175 Low185 not blocked185 Working exploit published30 No public exploit155 2009197 Protected by Waratek1 No exploit published21 Outside Waratek scope5 Not applicable170 Low197 blocked by ARMR today1 not blocked196 Exploited1 Working exploit published33 No public exploit163 2010277 Mitigation candidate2 No exploit published20 Outside Waratek scope10 Not applicable245 Low277 not blocked277 Exploited1 Working exploit published28 No public exploit248 2011260 Protected by Waratek1 Mitigation candidate2 No exploit published31 Outside Waratek scope13 Not applicable213 Low260 blocked by ARMR today1 not blocked259 Working exploit published13 Proof of concept only1 No public exploit246 2012508 Mitigation candidate4 No exploit published76 Outside Waratek scope6 Not applicable422 Low508 not blocked508 Working exploit published33 Proof of concept only1 No public exploit474 2013515 Protected by Waratek1 Mitigation candidate2 No exploit published51 Outside Waratek scope11 Not applicable450 Low515 blocked by ARMR today1 not blocked514 Exploited4 Working exploit published20 No public exploit491 2014656 No exploit published49 Outside Waratek scope14 Not applicable593 Low656 not blocked656 Exploited1 Working exploit published27 Proof of concept only1 No public exploit627 2015588 Protected by Waratek1 Mitigation candidate4 No exploit published46 Outside Waratek scope12 Not applicable525 Low588 blocked by ARMR today1 not blocked587 Working exploit published33 Proof of concept only1 Forecast only1 No public exploit553 2016197 No exploit published32 Outside Waratek scope10 Not applicable155 Low197 not blocked197 Working exploit published4 Forecast only2 No public exploit191
199219951998200120042007201020132016
5,454 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 55 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-8288 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin.
CVE-2016-8286 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges.
CVE-2016-8284 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication.
CVE-2016-5618 Low 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality via vectors related to Code Generation Engine.
CVE-2016-5615 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx.
CVE-2016-5561 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect availability via vectors related to IKE.
CVE-2016-5542 Low 2016-10-25 Outside Waratek scope No public exploit Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries.
CVE-2016-5525 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.3 allows local users to affect integrity via vectors related to Cluster check files.
CVE-2016-5508 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 4.3 allows local users to affect confidentiality via vectors related to Cluster Geo.
CVE-2016-5506 Low 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware allows local users to affect confidentiality and integrity via vectors related to App Server.
CVE-2016-5499 Low 2016-10-25 Outside Waratek scope No public exploit Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2016-5498.
CVE-2016-5498 Low 2016-10-25 Outside Waratek scope No public exploit Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2016-5499.
CVE-2016-5490 Low 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.4.0 allows local users to affect confidentiality via vectors related to INFRA.
CVE-2016-5481 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in the Sun ZFS Storage Appliance Kit (AK) component in Oracle Sun Systems Products Suite AK 2013 allows remote attackers to affect confidentiality via vectors related to Core Services.
CVE-2016-5480 Low 2016-10-25 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect integrity via vectors related to Bash.
CVE-2016-3562 Low 2016-10-25 Outside Waratek scope No public exploit Unspecified vulnerability in the RDBMS Security and SQL*Plus components in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote administrators to affect confidentiality via vectors related to DBA.
CVE-2016-1000033 Low 2016-10-25 Not applicable No public exploit Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.
CVE-2016-0240 Low 2016-10-22 Not applicable No public exploit IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP.
CVE-2016-7960 Low 2016-10-13 Not applicable No public exploit Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain sensitive configuration information via unspecified vectors.
CVE-2016-7437 Low 2016-10-13 Not applicable No public exploit SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC function callbacks by leveraging filtering of non-critical events in audit analysis reports, aka SAP Security Note 2252312.
CVE-2016-5432 Low 2016-10-03 Not applicable No public exploit The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
CVE-2016-0379 Low 2016-09-26 Not applicable No public exploit IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by leveraging queue-manager rights.
CVE-2016-0248 Low 2016-09-26 Not applicable No public exploit IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified vectors.
CVE-2016-4751 Low 2016-09-25 Not applicable No public exploit The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site.
CVE-2016-4739 Low 2016-09-25 Not applicable No public exploit mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to obtain sensitive information by sending a DNS query to an unintended interface.
CVE-2016-4717 Low 2016-09-25 Not applicable No public exploit The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial of service via a crafted app.
CVE-2016-4715 Low 2016-09-25 Not applicable No public exploit The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app.
CVE-2016-4749 Low 2016-09-18 Not applicable No public exploit Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file.
CVE-2016-4747 Low 2016-09-18 Not applicable No public exploit Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.
CVE-2016-4740 Low 2016-09-18 Not applicable No public exploit Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain sensitive information via unspecified vectors.
CVE-2016-4620 Low 2016-09-18 Not applicable No public exploit The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app.
CVE-2016-3354 Low 2016-09-14 Not applicable No public exploit The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "GDI Information Disclosure Vulnerability."
CVE-2016-3344 Low 2016-09-14 Not applicable No public exploit The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode Information Disclosure Vulnerability."
CVE-2016-3325 Low 2016-09-14 Not applicable Working exploit published Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2016-3291 Low 2016-09-14 Not applicable No public exploit Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVE-2016-0137 Low 2016-09-14 Not applicable No public exploit The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft APP-V ASLR Bypass."
CVE-2016-5166 Low 2016-09-11 Not applicable No public exploit The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is referenced by an http:// URL, which makes it easier for user-assisted remote attackers to discover NetNTLM hashes and conduct SMB relay attacks via a crafted web page that is accessed with the "Save page as" menu choice.
CVE-2016-3888 Low 2016-09-11 Not applicable No public exploit internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism, and send premium SMS messages during the Setup Wizard provisioning stage, via unspecified vectors, aka internal bug 29420123.
CVE-2016-4379 Low 2016-09-08 Not applicable No public exploit The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack.
CVE-2016-5429 Low 2016-09-03 Not applicable No public exploit jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack, related to JWE.php and JWS.php.
CVE-2016-2998 Low 2016-09-01 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that update data.
CVE-2016-0385 Low 2016-09-01 Outside Waratek scope No public exploit Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when HttpSessionIdReuse is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVE-2016-0370 Low 2016-09-01 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an application that was built with this product.
CVE-2016-5812 Low 2016-08-24 Not applicable No public exploit Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain sensitive information by reading a configuration file.
CVE-2013-7458 Low 2016-08-10 Not applicable No public exploit linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.
CVE-2016-3321 Low 2016-08-09 Not applicable No public exploit Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."
CVE-2016-2960 Low 2016-08-08 No exploit published No public exploit IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and 9.0.0.x before 9.0.0.1 allows remote attackers to cause a denial of service via crafted SIP messages.
CVE-2016-0380 Low 2016-08-08 Not applicable No public exploit IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain sensitive information via standard filesystem operations.
CVE-2016-0281 Low 2016-08-08 Not applicable No public exploit The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or FC5899 adapter crash) via crafted packets.
CVE-2016-0266 Low 2016-08-08 Not applicable No public exploit IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
CVE-2016-6224 Low 2016-07-22 Not applicable No public exploit ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which allows local users to obtain sensitive information via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8946.
CVE-2016-4645 Low 2016-07-22 Not applicable No public exploit CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2016-4593 Low 2016-07-22 Not applicable No public exploit The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors.
CVE-2016-4583 Low 2016-07-22 Not applicable No public exploit WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document.
CVE-2015-8946 Low 2016-07-22 Not applicable No public exploit ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2016-5473 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to File Folders / Attachment, a different vulnerability than CVE-2016-3537.
CVE-2016-5466 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-3450 and CVE-2016-5460.
CVE-2016-5462 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote administrators to affect confidentiality via vectors related to Workspaces.
CVE-2016-5460 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-3450 and CVE-2016-5466.
CVE-2016-5444 Low 2016-07-21 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.
CVE-2016-3531 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via vectors related to PC / Notification.
CVE-2016-3516 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote authenticated users to affect confidentiality via vectors related to GUI, a different vulnerability than CVE-2016-3514.
CVE-2016-3490 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0, and 6.4.1 allows remote authenticated users to affect confidentiality via vectors related to Database.
CVE-2016-3485 Low 2016-07-21 Outside Waratek scope No public exploit Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to Networking.
CVE-2016-3484 Low 2016-07-21 Outside Waratek scope No public exploit Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality and integrity via unknown vectors.
CVE-2016-3482 Low 2016-07-21 Not applicable No public exploit Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect confidentiality via vectors related to SSL/TLS Module.
CVE-2016-3474 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality via vectors related to Security.
CVE-2016-3469 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows local users to affect confidentiality via vectors related to Services.
CVE-2016-3452 Low 2016-07-21 Not applicable No public exploit Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.
CVE-2016-3450 Low 2016-07-21 No exploit published No public exploit Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect confidentiality via vectors related to Services, a different vulnerability than CVE-2016-5460 and CVE-2016-5466.
CVE-2016-3276 Low 2016-07-13 Not applicable No public exploit Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."
CVE-2016-3274 Low 2016-07-13 Not applicable No public exploit Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability."
CVE-2016-3272 Low 2016-07-13 Not applicable No public exploit The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which allows local users to obtain sensitive information from an arbitrary process via a crafted application, aka "Windows Kernel Information Disclosure Vulnerability."
CVE-2016-3251 Low 2016-07-13 Not applicable Forecast only The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerability."
CVE-2016-3763 Low 2016-07-11 Not applicable No public exploit net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 27593919.
CVE-2016-3759 Low 2016-07-11 Not applicable No public exploit The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages priv-app access to insert a backup transport, aka internal bug 28406080.
CVE-2016-5849 Low 2016-07-04 Not applicable No public exploit Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage.
CVE-2016-5702 Low 2016-07-03 Not applicable No public exploit phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI.
CVE-2016-2894 Low 2016-07-03 Not applicable No public exploit IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved data from arbitrary accounts in opportunistic circumstances by leveraging previous use of a symlink during archive and retrieve actions.
CVE-2016-2870 Low 2016-07-02 Not applicable No public exploit Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors.
CVE-2016-2868 Low 2016-07-02 Not applicable No public exploit IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2016-2861 Low 2016-07-02 Not applicable No public exploit IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
CVE-2015-8801 Low 2016-06-30 Not applicable No public exploit Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
CVE-2016-0259 Low 2016-06-26 Not applicable No public exploit runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display commands.
CVE-2015-7473 Low 2016-06-26 Not applicable No public exploit runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp.
CVE-2016-1862 Low 2016-06-19 Not applicable No public exploit Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1860.
CVE-2016-1860 Low 2016-06-19 Not applicable No public exploit Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than CVE-2016-1862.
CVE-2016-1183 Low 2016-06-19 Not applicable No public exploit NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers to bypass a file-extension protection mechanism, and consequently read arbitrary files, via a crafted pathname.
CVE-2016-5233 Low 2016-06-10 Not applicable No public exploit Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182 allow remote base stations to obtain sensitive subscriber signal strength information via vectors involving improper security status verification, aka HWPSIRT-2015-12007.
CVE-2016-4527 Low 2016-06-10 Not applicable No public exploit ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2016-4516 Low 2016-06-10 Not applicable No public exploit ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2016-4511 Low 2016-06-10 Not applicable No public exploit ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file.
CVE-2016-3711 Low 2016-06-08 Not applicable No public exploit HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.
CVE-2016-1212 Low 2016-06-05 Not applicable No public exploit Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.
CVE-2016-4486 Low 2016-05-23 Not applicable Working exploit published The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
CVE-2016-1852 Low 2016-05-20 Not applicable No public exploit Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors.
CVE-2016-1849 Low 2016-05-20 Not applicable No public exploit The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might allow local users to obtain sensitive information by leveraging read access to a Safari directory.
CVE-2016-1798 Low 2016-05-20 Not applicable No public exploit Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.
CVE-2016-1796 Low 2016-05-20 Not applicable No public exploit Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds memory access) via a crafted app.
CVE-2016-1791 Low 2016-05-20 Not applicable No public exploit The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
‹ prev page 1 of 55 next ›