Overview 40,518 matches · 1,986 in Waratek scope · 127 protected · 202 exploited · 25 CISA KEV · 8,867 public PoC · 354 EPSS ≥ 0.5
40,518matches
1,986in Waratek scope4.9%
127protected0.3%
202exploited0.5%
25CISA KEV0.1%
8,867public PoC21.9%
354EPSS ≥ 0.50.9%
Protected by Waratek
127
0.3%
Rule in development
0
0.0%
Mitigation candidate
106
0.3%
No exploit published
1,753
4.3%
Outside Waratek scope
775
1.9%
Not applicable
37,757
93.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
127
0.3%
partly blocked
0
0.0%
not blocked
40,388
99.7%
not established
3
0.0%
unrecorded
0
0.0%
split by
peak 5,314 / year
19891
Not applicable1
Medium1
not blocked1
No public exploit1
19902
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
19914
Not applicable4
Medium4
not blocked4
No public exploit4
19920
19933
Not applicable3
Medium3
not blocked3
No public exploit3
199410
Not applicable10
Medium10
not blocked10
Working exploit published2
No public exploit8
19956
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
199621
Not applicable21
Medium21
not blocked21
Working exploit published5
No public exploit16
199789
Not applicable89
Medium89
not blocked89
Working exploit published18
No public exploit71
199885
Not applicable85
Medium85
not blocked85
Working exploit published11
No public exploit74
1999357
Outside Waratek scope1
Not applicable356
Medium357
not blocked357
Working exploit published119
No public exploit238
2000467
Mitigation candidate4
No exploit published3
Not applicable460
Medium467
not blocked467
Exploited2
Working exploit published195
No public exploit270
2001706
Mitigation candidate2
No exploit published4
Outside Waratek scope7
Not applicable693
Medium706
not blocked706
Exploited3
Working exploit published219
Forecast only2
No public exploit482
2002980
Protected by Waratek2
Mitigation candidate6
No exploit published15
Outside Waratek scope4
Not applicable953
Medium980
blocked by ARMR today2
not blocked978
Exploited3
Working exploit published246
Forecast only3
No public exploit728
2003747
Protected by Waratek2
Mitigation candidate4
No exploit published18
Outside Waratek scope1
Not applicable722
Medium747
blocked by ARMR today2
not blocked745
Working exploit published243
No public exploit504
20041,265
Protected by Waratek1
Mitigation candidate1
No exploit published16
Outside Waratek scope4
Not applicable1,243
Medium1,265
blocked by ARMR today1
not blocked1,264
Exploited10
Working exploit published414
Forecast only1
No public exploit840
20052,430
Protected by Waratek3
Mitigation candidate4
No exploit published39
Outside Waratek scope6
Not applicable2,378
Medium2,430
blocked by ARMR today3
not blocked2,427
Exploited8
Working exploit published622
Forecast only6
No public exploit1,794
20063,324
Protected by Waratek4
Mitigation candidate4
No exploit published48
Outside Waratek scope3
Not applicable3,265
Medium3,324
blocked by ARMR today4
not blocked3,320
Exploited10
Working exploit published1,137
Forecast only2
No public exploit2,175
20073,101
Protected by Waratek2
Mitigation candidate9
No exploit published60
Outside Waratek scope53
Not applicable2,977
Medium3,101
blocked by ARMR today2
not blocked3,099
Exploited14
Working exploit published1,052
Forecast only1
No public exploit2,034
20082,582
Protected by Waratek4
Mitigation candidate8
No exploit published71
Outside Waratek scope26
Not applicable2,473
Medium2,582
blocked by ARMR today4
not blocked2,578
Exploited7
Working exploit published987
Proof of concept only2
Forecast only1
No public exploit1,585
20092,786
Protected by Waratek5
Mitigation candidate9
No exploit published115
Outside Waratek scope31
Not applicable2,626
Medium2,786
blocked by ARMR today5
not blocked2,781
Exploited16
Working exploit published1,123
Proof of concept only2
Forecast only3
No public exploit1,642
20102,241
Protected by Waratek6
Mitigation candidate9
No exploit published118
Outside Waratek scope34
Not applicable2,074
Medium2,241
blocked by ARMR today6
not blocked2,235
Exploited14
Working exploit published547
Proof of concept only1
Forecast only2
No public exploit1,677
20112,101
Protected by Waratek4
Mitigation candidate3
No exploit published132
Outside Waratek scope58
Not applicable1,904
Medium2,101
blocked by ARMR today4
not blocked2,097
Exploited9
Working exploit published294
Proof of concept only3
Forecast only1
No public exploit1,794
20123,035
Protected by Waratek5
Mitigation candidate17
No exploit published177
Outside Waratek scope50
Not applicable2,786
Medium3,035
blocked by ARMR today5
not blocked3,029
not established1
Exploited20
Working exploit published475
Proof of concept only2
Forecast only42
No public exploit2,496
20132,914
Protected by Waratek12
Mitigation candidate12
No exploit published225
Outside Waratek scope155
Not applicable2,510
Medium2,914
blocked by ARMR today12
not blocked2,901
not established1
Exploited23
Working exploit published237
Proof of concept only1
Forecast only6
No public exploit2,647
20145,314
Protected by Waratek32
Mitigation candidate9
No exploit published215
Outside Waratek scope165
Not applicable4,893
Medium5,314
blocked by ARMR today32
not blocked5,282
Exploited24
Working exploit published415
Proof of concept only7
Forecast only12
No public exploit4,856
20153,501
Protected by Waratek20
Mitigation candidate1
No exploit published205
Outside Waratek scope126
Not applicable3,149
Medium3,501
blocked by ARMR today20
not blocked3,481
Exploited23
Working exploit published254
Proof of concept only7
Forecast only8
No public exploit3,209
20162,446
Protected by Waratek25
Mitigation candidate4
No exploit published292
Outside Waratek scope51
Not applicable2,074
Medium2,446
blocked by ARMR today25
not blocked2,420
not established1
Exploited16
Working exploit published122
Proof of concept only6
Forecast only9
No public exploit2,293
1989199219951998200120042007201020132016
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-6859 | Medium | 2016-12-31 | Not applicable | No public exploit | Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to obtain sensitive information by triggering an error and then reading a Java stack trace. |
| CVE-2016-6858 | Medium | 2016-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5.1.1.12, 5.2.0.x and 5.3.0.x before 5.3.0.10, 5.4.x before 5.4.0.9, 5.5.0.x before 5.5.0.9, 5.5.1.x before 5.5.1.10, 5.6.x before 5.6.0.8, and 5.7.x before 5.7.0.9 allows remote authenticated users to inject arbitrary web script or HTML via the Name field. |
| CVE-2016-6857 | Medium | 2016-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13, 5.3.x before 5.3.0.11, 5.4.x before 5.4.0.11, 5.5.0.x before 5.5.0.10, 5.5.1.x before 5.5.1.11, 5.6.x before 5.6.0.11, and 5.7.x before 5.7.0.15 allows remote authenticated users to inject arbitrary web script or HTML via the ID field. |
| CVE-2016-6856 | Medium | 2016-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage parameter. |
| CVE-2016-10083 | Medium | 2016-12-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case. |
| CVE-2016-9916 | Medium | 2016-12-29 | Not applicable | No public exploit | Memory leak in hw/9pfs/9p-proxy.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the proxy backend. |
| CVE-2016-9915 | Medium | 2016-12-29 | Not applicable | No public exploit | Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in the handle backend. |
| CVE-2016-9914 | Medium | 2016-12-29 | Not applicable | No public exploit | Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) by leveraging a missing cleanup operation in FileOperations. |
| CVE-2016-9913 | Medium | 2016-12-29 | Not applicable | No public exploit | Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup. |
| CVE-2016-9891 | Medium | 2016-12-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title). |
| CVE-2016-9846 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. |
| CVE-2016-9845 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes. |
| CVE-2016-9776 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It could occur while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could use this issue to crash the QEMU process on the host leading to DoS. |
| CVE-2016-7463 | Medium | 2016-12-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted VM. |
| CVE-2016-7458 | Medium | 2016-12-29 | Not applicable | No public exploit | VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2016-7087 | Medium | 2016-12-29 | Not applicable | No public exploit | Directory traversal vulnerability in the Connection Server in VMware Horizon View 5.x before 5.3.7, 6.x before 6.2.3, and 7.x before 7.0.1 allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2016-5334 | Medium | 2016-12-29 | Not applicable | No public exploit | VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors. |
| CVE-2016-5329 | Medium | 2016-12-29 | Not applicable | No public exploit | VMware Fusion 8.x before 8.5 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors. |
| CVE-2016-5328 | Medium | 2016-12-29 | Not applicable | No public exploit | VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addresses and bypass the kASLR protection mechanism via unspecified vectors. |
| CVE-2016-2198 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS. |
| CVE-2016-2197 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS. |
| CVE-2016-1981 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. It could occur while processing data via transmit or receive descriptors, provided the initial receive/transmit descriptor head (TDH/RDH) is set outside the allocated descriptor buffer. A privileged user inside guest could use this flaw to crash the QEMU instance resulting in DoS. |
| CVE-2016-1922 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw. It occurs while doing I/O port write operations via hmp interface. In that, 'current_cpu' remains null, which leads to the null pointer dereference. A user or process could use this flaw to crash the QEMU instance, resulting in DoS issue. |
| CVE-2015-8818 | Medium | 2016-12-29 | Not applicable | No public exploit | The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors. |
| CVE-2015-8817 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built to use 'address_space_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w access issue. It could occur while doing pci_dma_read/write calls. Affects QEMU versions >= 1.6.0 and <= 2.3.1. A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS. |
| CVE-2015-8745 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS. |
| CVE-2015-8744 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It occurs when a guest sends a Layer-2 packet smaller than 22 bytes. A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS. |
| CVE-2015-8701 | Medium | 2016-12-29 | Not applicable | No public exploit | QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmit (tx) descriptors in 'tx_consume' routine, if a descriptor was to have more than allowed (ROCKER_TX_FRAGS_MAX=16) fragments. A privileged user inside guest could use this flaw to cause memory leakage on the host or crash the QEMU process instance resulting in DoS issue. |
| CVE-2016-9756 | Medium | 2016-12-28 | Not applicable | No public exploit | arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
| CVE-2016-9685 | Medium | 2016-12-28 | Not applicable | No public exploit | Multiple memory leaks in error paths in fs/xfs/xfs_attr_list.c in the Linux kernel before 4.5.1 allow local users to cause a denial of service (memory consumption) via crafted XFS filesystem operations. |
| CVE-2016-9588 | Medium | 2016-12-28 | Not applicable | No public exploit | arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest. |
| CVE-2016-6213 | Medium | 2016-12-28 | Not applicable | No public exploit | fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. |
| CVE-2016-10072 | Medium | 2016-12-27 | Not applicable | No public exploit | WampServer 3.0.6 has two files called 'wampmanager.exe' and 'unins000.exe' with a weak ACL for Modify. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local attacker must insert an executable file called wampmanager.exe or unins000.exe and replace the original files. The next time one of these programs is launched by a more privileged user, malicious code chosen by the local attacker will run. NOTE: the vendor disputes the relevance of this report, taking the position that a configuration in which "'someone' (an attacker) is able to replace files on a PC" is not "the fault of WampServer. |
| CVE-2016-9224 | Medium | 2016-12-26 | Not applicable | No public exploit | A vulnerability in the Cisco Jabber Guest Server could allow an unauthenticated, remote attacker to initiate connections to arbitrary hosts. More Information: CSCvc31635. Known Affected Releases: 10.6(9). Known Fixed Releases: 11.0(0). |
| CVE-2016-9681 | Medium | 2016-12-25 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Serendipity before 2.0.5 allow remote authenticated users to inject arbitrary web script or HTML via a category or directory name. |
| CVE-2016-10006 | Medium | 2016-12-24 | No exploit published | No public exploit | In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS. |
| CVE-2016-9923 | Medium | 2016-12-23 | Not applicable | No public exploit | Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS. |
| CVE-2016-9921 | Medium | 2016-12-23 | Not applicable | No public exploit | Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when cirrus graphics mode was set to be VGA. A privileged user inside guest could use this flaw to crash the Qemu process instance on the host, resulting in DoS. |
| CVE-2016-9912 | Medium | 2016-12-23 | Not applicable | No public exploit | Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host. |
| CVE-2016-9911 | Medium | 2016-12-23 | Not applicable | No public exploit | Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. |
| CVE-2016-9907 | Medium | 2016-12-23 | Not applicable | No public exploit | Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host. |
| CVE-2016-9889 | Medium | 2016-12-23 | Not applicable | No public exploit | Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before 16.1 don't have the input sanitized, related to tiki-setup.php and article_image.php. The impact is XSS. |
| CVE-2016-9561 | Medium | 2016-12-23 | Not applicable | No public exploit | The che_configure function in libavcodec/aacdec_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allocation of huge memory, and being killed by the OS) via a crafted MOV file. |
| CVE-2016-8595 | Medium | 2016-12-23 | Not applicable | No public exploit | The gsm_parse function in libavcodec/gsm_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
| CVE-2016-7968 | Medium | 2016-12-23 | Not applicable | No public exploit | KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. HTML Mail contents were not sanitized for JavaScript and included code was executed. |
| CVE-2016-7905 | Medium | 2016-12-23 | Not applicable | No public exploit | The read_gab2_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer used) via a crafted AVI file. |
| CVE-2016-7787 | Medium | 2016-12-23 | Not applicable | No public exploit | A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user. |
| CVE-2016-7785 | Medium | 2016-12-23 | Not applicable | No public exploit | The avi_read_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault) via a crafted AVI file. |
| CVE-2016-7562 | Medium | 2016-12-23 | Not applicable | No public exploit | The ff_draw_pc_font function in libavcodec/cga_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer overflow) via a crafted AVI file. |
| CVE-2016-7555 | Medium | 2016-12-23 | Not applicable | No public exploit | The avi_read_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has a crafted "strh" structure. |
| CVE-2016-7122 | Medium | 2016-12-23 | Not applicable | No public exploit | The avi_read_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that has a crafted 'nctg' structure. |
| CVE-2016-6910 | Medium | 2016-12-23 | Not applicable | No public exploit | The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data. |
| CVE-2016-6881 | Medium | 2016-12-23 | Not applicable | No public exploit | The zlib_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service via a crafted SWF file. |
| CVE-2016-2312 | Medium | 2016-12-23 | Not applicable | No public exploit | Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when turning a screen on again. |
| CVE-2016-7091 | Medium | 2016-12-22 | Not applicable | No public exploit | sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline could use this flaw to read content from specially formatted files with elevated privileges provided by sudo. |
| CVE-2016-9757 | Medium | 2016-12-20 | Not applicable | No public exploit | In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site scripting (XSS) elements in the tag name field. Once this tag is viewed in the Tag Detail page of the Rapid7 Nexpose 6.4.12 UI by another authenticated user, the script is run in that user's browser context. |
| CVE-2016-7295 | Medium | 2016-12-20 | Not applicable | No public exploit | The Common Log File System (CLFS) driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information from process memory via a crafted application, aka "Windows Common Log File System Driver Information Disclosure Vulnerability." |
| CVE-2016-7284 | Medium | 2016-12-20 | Not applicable | No public exploit | Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." |
| CVE-2016-7282 | Medium | 2016-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Browser Information Disclosure Vulnerability." |
| CVE-2016-7281 | Medium | 2016-12-20 | Not applicable | No public exploit | The Web Workers implementation in Microsoft Internet Explorer 10 and 11 and Microsoft Edge allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Microsoft Browser Security Feature Bypass Vulnerability." |
| CVE-2016-7280 | Medium | 2016-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7206. |
| CVE-2016-7278 | Medium | 2016-12-20 | Not applicable | No public exploit | Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Windows Hyperlink Object Library Information Disclosure Vulnerability." |
| CVE-2016-7267 | Medium | 2016-12-20 | Not applicable | No public exploit | Microsoft Excel 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 misparses file formats, which makes it easier for remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Security Feature Bypass Vulnerability." |
| CVE-2016-7258 | Medium | 2016-12-20 | Not applicable | No public exploit | The kernel in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 mishandles page-fault system calls, which allows local users to obtain sensitive information from arbitrary processes via a crafted application, aka "Windows Kernel Memory Address Information Disclosure Vulnerability." |
| CVE-2016-7257 | Medium | 2016-12-20 | Not applicable | No public exploit | The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability." |
| CVE-2016-7219 | Medium | 2016-12-20 | Not applicable | No public exploit | The Crypto driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka "Windows Crypto Driver Information Disclosure Vulnerability." |
| CVE-2016-7206 | Medium | 2016-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Microsoft Edge allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Edge Information Disclosure Vulnerability," a different vulnerability than CVE-2016-7280. |
| CVE-2016-5303 | Medium | 2016-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute. |
| CVE-2016-4552 | Medium | 2016-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the href attribute in an area tag in an e-mail message. |
| CVE-2016-5193 | Medium | 2016-12-18 | Not applicable | No public exploit | Google Chrome prior to 54.0 for iOS had insufficient validation of URLs for windows open by DOM, which allowed a remote attacker to bypass restrictions on navigation to certain URL schemes via crafted HTML pages. |
| CVE-2016-5192 | Medium | 2016-12-18 | Not applicable | No public exploit | Blink in Google Chrome prior to 54.0.2840.59 for Windows missed a CORS check on redirect in TextTrackLoader, which allowed a remote attacker to bypass cross-origin restrictions via crafted HTML pages. |
| CVE-2016-5191 | Medium | 2016-12-18 | Not applicable | No public exploit | Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL. |
| CVE-2016-5190 | Medium | 2016-12-18 | Not applicable | No public exploit | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages. |
| CVE-2016-5189 | Medium | 2016-12-18 | Not applicable | No public exploit | Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
| CVE-2016-5188 | Medium | 2016-12-18 | Not applicable | No public exploit | Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages. |
| CVE-2016-5187 | Medium | 2016-12-18 | Not applicable | No public exploit | Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages. |
| CVE-2016-5186 | Medium | 2016-12-18 | Not applicable | No public exploit | Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files. |
| CVE-2016-5181 | Medium | 2016-12-18 | Not applicable | No public exploit | Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages. |
| CVE-2016-9998 | Medium | 2016-12-17 | Not applicable | No public exploit | SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL. |
| CVE-2016-9997 | Medium | 2016-12-17 | Not applicable | No public exploit | SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL. |
| CVE-2016-9951 | Medium | 2016-12-17 | Not applicable | Working exploit published | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK. |
| CVE-2016-9159 | Medium | 2016-12-17 | Not applicable | No public exploit | A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices. |
| CVE-2016-9964 | Medium | 2016-12-16 | Not applicable | No public exploit | redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call. |
| CVE-2016-8827 | Medium | 2016-12-16 | Not applicable | No public exploit | NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks proper access control and parameter validation, allowing for information disclosure via a directory traversal attack. |
| CVE-2016-8826 | Medium | 2016-12-16 | Not applicable | No public exploit | All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service. |
| CVE-2016-8820 | Medium | 2016-12-16 | Not applicable | No public exploit | All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure. |
| CVE-2016-3129 | Medium | 2016-12-16 | Not applicable | No public exploit | A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell. |
| CVE-2016-7891 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks. |
| CVE-2016-7888 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak. |
| CVE-2016-7884 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks. |
| CVE-2016-7883 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks. |
| CVE-2016-7882 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks. |
| CVE-2016-6934 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks. |
| CVE-2016-6933 | Medium | 2016-12-15 | Not applicable | No public exploit | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks. |
| CVE-2016-6854 | Medium | 2016-12-15 | Not applicable | Working exploit published | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code which got injected to a mail with inline PGP signature gets executed when verifying the signature. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). |
| CVE-2016-6853 | Medium | 2016-12-15 | Not applicable | Working exploit published | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code and references to external websites can be injected to the names of PGP public keys. When requesting that key later on using a specific URL, such script code might get executed. In case of injecting external websites, users might get lured into a phishing scheme. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). |
| CVE-2016-6852 | Medium | 2016-12-15 | Not applicable | No public exploit | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Users can provide local file paths to the RSS reader; the response and error code give hints about whether the provided file exists or not. Attackers may discover specific system files or library versions on the middleware server to prepare further attacks. |
| CVE-2016-6851 | Medium | 2016-12-15 | Not applicable | Working exploit published | An issue was discovered in Open-Xchange OX Guard before 2.4.2-rev5. Script code can be provided as parameter to the OX Guard guest reader web application. This allows cross-site scripting attacks against arbitrary users since no prior authentication is needed. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.) in case the user has an active session on the same domain already. |
| CVE-2016-6850 | Medium | 2016-12-15 | Not applicable | No public exploit | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.). |
| CVE-2016-6848 | Medium | 2016-12-15 | Not applicable | No public exploit | An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. API requests can be used to inject, generate and download executable files to the client ("Reflected File Download"). Malicious platform specific (e.g. Microsoft Windows) batch file can be created via a trusted domain without authentication that, if executed by the user, may lead to local code execution. |