| CVE-2016-0189 Known exploited | High 7.5 | The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of… Assigned by microsoft | May 11, 2016 |
| CVE-2016-0185 Known exploited | High 7.8 | Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Cente… Assigned by microsoft | May 11, 2016 |
| CVE-2010-5326 Known exploited | Critical 10.0 | The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HT… Assigned by mitre | May 13, 2016 |
| CVE-2016-3674 | High 7.5 | Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStre… Assigned by mitre | May 17, 2016 |
| CVE-2016-0718 | Critical 9.8 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Assigned by redhat | May 26, 2016 |
| CVE-2016-3088 Known exploited | Critical 9.8 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Assigned by redhat | Jun 1, 2016 |
| CVE-2016-4437 Known exploited | Critical 9.8 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an uns… Assigned by redhat | Jun 7, 2016 |
| CVE-2016-4523 Known exploited | High 7.5 | The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified v… Assigned by icscert | Jun 9, 2016 |
| CVE-2016-4328 Healthcare | Critical 9.8 | MEDHOST Perioperative Information Management System (aka PIMS or VPIMS) before 2015R1 has hardcoded credentials, which makes it easier for remote attackers to obtain sensitive information via direct… Assigned by certcc | Jun 10, 2016 |
| CVE-2016-3233 | High 7.3 | Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vul… Assigned by microsoft | Jun 16, 2016 |
| CVE-2016-3234 | Medium 5.5 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Ser… Assigned by microsoft | Jun 16, 2016 |
| CVE-2016-0025 | High 7.3 | Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation… Assigned by microsoft | Jun 16, 2016 |
| CVE-2016-3235 Known exploited | High 7.8 | Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted… Assigned by microsoft | Jun 16, 2016 |
| CVE-2016-4171 Known exploited | High 7.8 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016. Assigned by adobe | Jun 16, 2016 |
| CVE-2016-3643 Known exploited | High 7.8 | SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd." Assigned by mitre | Jun 17, 2016 |
| CVE-2016-3189 | Medium 6.5 | Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the… Assigned by mitre | Jun 30, 2016 |
| CVE-2016-4472 | High 8.1 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via… Assigned by redhat | Jun 30, 2016 |
| CVE-2016-1182 | High 8.2 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a… Assigned by jpcert | Jul 4, 2016 |
| CVE-2016-1181 | High 8.1 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of servic… Assigned by jpcert | Jul 4, 2016 |
| CVE-2016-3092 | High 7.5 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, all… | Jul 4, 2016 |
| CVE-2016-5388 | High 8.1 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted cli… Assigned by redhat | Jul 19, 2016 |
| CVE-2016-0635 Healthcare | High 8.8 | Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2, and 12.3.2; the Oracle Health Sciences Information Manager component… Assigned by oracle | Jul 21, 2016 |
| CVE-2016-5131 | High 8.8 | Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via… Assigned by Chrome | Jul 23, 2016 |
| CVE-2016-3313 | High 7.8 | Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Mem… Assigned by microsoft | Aug 9, 2016 |
| CVE-2016-3309 Known exploited | High 7.8 | The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and… Assigned by microsoft | Aug 9, 2016 |
| CVE-2016-6367 Known exploited | High 7.8 | Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or… Assigned by cisco | Aug 18, 2016 |
| CVE-2016-6366 Known exploited | High 8.8 | Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM de… Assigned by cisco | Aug 18, 2016 |
| CVE-2016-4657 Known exploited | High 8.8 | WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. Assigned by apple | Aug 25, 2016 |
| CVE-2016-4656 Known exploited | High 7.8 | The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Assigned by apple | Aug 25, 2016 |
| CVE-2016-4655 Known exploited | Medium 5.5 | The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app. Assigned by apple | Aug 25, 2016 |
| CVE-2016-3357 | High 7.8 | Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2… Assigned by microsoft | Sep 14, 2016 |
| CVE-2016-0141 | Medium 6.5 | The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive… Assigned by microsoft | Sep 14, 2016 |
| CVE-2016-3351 Known exploited | Medium 6.5 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." Assigned by microsoft | Sep 14, 2016 |
| CVE-2016-6415 Known exploited | High 7.5 | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain… Assigned by cisco | Sep 19, 2016 |
| CVE-2016-4658 | Critical 9.8 | xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, wh… Assigned by apple | Sep 25, 2016 |
| CVE-2016-7193 Known exploited | High 7.8 | Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on Sha… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-3393 Known exploited | High 7.8 | Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Window… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-3298 Known exploited | Medium 6.5 | Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence o… Assigned by microsoft | Oct 14, 2016 |
| CVE-2016-1000031 | Critical 9.8 | Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution | Oct 25, 2016 |
| CVE-2016-7855 Known exploited | High 8.8 | Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as… Assigned by adobe | Nov 1, 2016 |
| CVE-2016-7244 | Medium 5.5 | Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial of Service Vulnerability." Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7256 Known exploited | High 8.8 | atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold,… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7255 Known exploited | High 7.8 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 160… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7201 Known exploited | High 8.8 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-7200 Known exploited | High 8.8 | The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engi… Assigned by microsoft | Nov 10, 2016 |
| CVE-2016-5195 Known exploited | High 7.0 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-… Assigned by Chrome | Nov 10, 2016 |
| CVE-2016-9318 | Medium 5.5 | libxml2 2.9.4 and earlier, as used in XMLSec 1.2.23 and earlier and other products, does not offer a flag directly indicating that the current document may be read but other files may not be opened,… Assigned by mitre | Nov 16, 2016 |
| CVE-2016-8562 Known exploited | High 7.5 | A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Assigned by mitre | Nov 18, 2016 |
| CVE-2016-9563 Known exploited | Medium 6.5 | BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Se… Assigned by mitre | Nov 23, 2016 |
| CVE-2016-6277 Known exploited | High 8.8 | NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before… Assigned by mitre | Dec 14, 2016 |
