| CVE-2015-8126 | High 7.5 | Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x… Assigned by mitre | Nov 13, 2015 |
| CVE-2015-4852 Known exploited | Critical 9.8 | The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protoc… Assigned by oracle | Nov 18, 2015 |
| CVE-2015-5317 Known exploited | High 7.5 | The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request. Assigned by redhat | Nov 25, 2015 |
| CVE-2015-5287 Known exploited | High 7.8 | The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable na… Assigned by redhat | Dec 7, 2015 |
| CVE-2015-6175 Known exploited | High 7.8 | The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability." Assigned by microsoft | Dec 9, 2015 |
| CVE-2015-6420 | Critical 9.8 | Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Device… | Dec 15, 2015 |
| CVE-2015-7755 Known exploited | Critical 9.8 | Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.… Assigned by mitre | Dec 19, 2015 |
| CVE-2015-8651 Known exploited | High 8.8 | Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20… Assigned by adobe | Dec 28, 2015 |
| CVE-2015-7450 Known exploited | Critical 9.8 | Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a craf… Assigned by ibm | Jan 2, 2016 |
| CVE-2015-7575 | Medium 5.9 | Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in T… Assigned by redhat | Jan 9, 2016 |
| CVE-2016-0035 | High 7.8 | Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers… Assigned by microsoft | Jan 13, 2016 |
| CVE-2016-0010 | High 7.8 | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for M… Assigned by microsoft | Jan 13, 2016 |
| CVE-2016-0011 | Medium 5.4 | Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) a… Assigned by microsoft | Jan 13, 2016 |
| CVE-2016-0012 | Medium 4.3 | Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Ex… Assigned by microsoft | Jan 13, 2016 |
| CVE-2015-6117 | Medium 6.1 | Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) a… Assigned by microsoft | Jan 13, 2016 |
| CVE-2016-0034 Known exploited | High 8.8 | Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption)… Assigned by microsoft | Jan 13, 2016 |
| CVE-2016-0494 | High 10.0 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0466 | Medium 5.0 | Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affec… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0483 | High 10.0 | Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0448 | Medium 4.0 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0475 | Medium 5.8 | Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0402 | Medium 5.0 | Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vect… Assigned by oracle | Jan 21, 2016 |
| CVE-2016-0055 | High 7.8 | Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." Assigned by microsoft | Feb 10, 2016 |
| CVE-2016-0040 Known exploited | High 7.8 | The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege V… Assigned by microsoft | Feb 10, 2016 |
| CVE-2016-0984 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR S… Assigned by adobe | Feb 10, 2016 |
| CVE-2016-0752 Known exploited | High 7.5 | Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read… Assigned by redhat | Feb 16, 2016 |
| CVE-2016-2388 Known exploited | Medium 5.3 | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846. Assigned by mitre | Feb 16, 2016 |
| CVE-2016-2386 Known exploited | Critical 9.8 | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079. Assigned by mitre | Feb 16, 2016 |
| CVE-2016-0714 | High 8.8 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticat… Assigned by redhat | Feb 25, 2016 |
| CVE-2016-0763 | Medium 6.3 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLink… Assigned by redhat | Feb 25, 2016 |
| CVE-2016-0706 | Medium 4.3 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/Restrict… Assigned by redhat | Feb 25, 2016 |
| CVE-2015-5174 | Medium 4.3 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager… Assigned by redhat | Feb 25, 2016 |
| CVE-2015-5351 | High 8.8 | The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, wh… Assigned by redhat | Feb 25, 2016 |
| CVE-2015-5345 | Medium 5.3 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which a… Assigned by redhat | Feb 25, 2016 |
| CVE-2015-5346 | High 8.1 | Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the sam… Assigned by redhat | Feb 25, 2016 |
| CVE-2016-0099 Known exploited | High 7.8 | The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 15… Assigned by microsoft | Mar 9, 2016 |
| CVE-2016-1010 Known exploited | High 8.8 | Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK befor… Assigned by adobe | Mar 12, 2016 |
| CVE-2016-1646 Known exploited | High 8.8 | The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to c… Assigned by Chrome | Mar 29, 2016 |
| CVE-2016-1019 Known exploited | High 7.8 | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild… Assigned by adobe | Apr 7, 2016 |
| CVE-2016-3976 Known exploited | High 7.5 | Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownload… Assigned by mitre | Apr 7, 2016 |
| CVE-2016-0167 Known exploited | High 7.8 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 al… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0165 Known exploited | High 7.8 | The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 al… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0162 Known exploited | Medium 4.3 | Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability." Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-0151 Known exploited | High 7.8 | The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local user… Assigned by microsoft | Apr 12, 2016 |
| CVE-2016-3427 Known exploited | Critical 9.8 | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle | Apr 21, 2016 |
| CVE-2016-3081 Known exploited | High 8.1 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to… Assigned by redhat | Apr 26, 2016 |
| CVE-2016-3718 Known exploited | Medium 5.5 | The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Assigned by redhat | May 5, 2016 |
| CVE-2016-3715 Known exploited | Medium 5.5 | The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Assigned by redhat | May 5, 2016 |
| CVE-2016-3714 Known exploited | High 8.4 | The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code… Assigned by redhat | May 5, 2016 |
| CVE-2016-4117 Known exploited | High 7.8 | Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016. Assigned by adobe | May 11, 2016 |
