CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 20:24 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-0240 | SG Security Guardium Database Activity Monitor Ibm | 3.7 | Oct 22 | IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism,… |
| CVE-2016-7437 | NE Netweaver Sap | 3.3 | Oct 13 | SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC… |
| CVE-2016-7960 | SS Simatic Step 7 Siemens | 2.5 | Oct 13 | Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain… |
| CVE-2016-5432 | EV Enterprise Virtualization Redhat | 3.3 | Oct 3 | The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log… |
| CVE-2016-0379 | WM Websphere MQ Ibm | 3.1 | Sep 26 | IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by… |
| CVE-2016-0248 | SG Security Guardium Ibm | 3.7 | Sep 26 | IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified… |
| CVE-2016-4751 | SA Safari Apple | 3.5 | Sep 25 | The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site |
| CVE-2016-4739 | MO Mac OS X Apple | 3.7 | Sep 25 | mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to obtain sensitive… |
| CVE-2016-4717 | MO Mac OS X Apple | 3.3 | Sep 25 | The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial of service via a crafted app |
| CVE-2016-4715 | MO Mac OS X Apple | 3.3 | Sep 25 | The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app |
| CVE-2016-4749 | IO iOS Apple | 3.3 | Sep 18 | Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file |
| CVE-2016-4747 | IO iOS Apple | 3.7 | Sep 18 | Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors |
| CVE-2016-4740 | IO iOS Apple | 2.9 | Sep 18 | Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain… |
| CVE-2016-4620 | IO iOS Apple | 3.3 | Sep 18 | The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover… |
| CVE-2016-3354 | WI Windows Microsoft | 3.3 | Sep 14 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
| CVE-2016-3344 | WI Windows Microsoft | 3.3 | Sep 14 | The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode… |
| CVE-2016-3325 | ED Edge Microsoft | 3.1 | Sep 14 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure… |
| CVE-2016-3291 | ED Edge Microsoft | 2.4 | Sep 14 | Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka… |
| CVE-2016-0137 | OF Office Microsoft | 3.3 | Sep 14 | The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft… |
| CVE-2016-3888 | AN Android Google | 2.1 | Sep 11 | internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically… |
| CVE-2016-5166 | CH Chrome Google | 3.1 | Sep 11 | The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is… |
| CVE-2016-4379 | IL Integrated Lights-out 3 Firmware HP | 3.7 | Sep 8 | The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which… |
| CVE-2016-5429 | JO Jose-php Jose-php Project | 3.7 | Sep 3 | jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack,… |
| CVE-2016-2998 | CO Connections Ibm | 3.5 | Sep 1 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack… |
| CVE-2016-0385 | WA Websphere Application Server Ibm | 3.1 | Sep 1 | Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when… |
| CVE-2016-0370 | FE Forms Experience Builder Ibm | 2.7 | Sep 1 | Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via… |
| CVE-2016-5812 | OG Oncell G3001 Firmware Moxa | 3.3 | Aug 24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain… |
| CVE-2013-7458 | RE Redis Redis | 3.3 | Aug 10 | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file |
| CVE-2016-3321 | IE Internet Explorer Microsoft | 2.5 | Aug 9 | Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via… |
| CVE-2016-2960 | WA Websphere Application Server Ibm | 3.7 | Aug 8 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and… |
| CVE-2016-0380 | SC Sterling Connect:direct Ibm | 3.3 | Aug 8 | IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain… |
| CVE-2016-0281 | AI Aix Ibm | 3.7 | Aug 8 | The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or… |
| CVE-2016-0266 | AI Aix Ibm | 3.7 | Aug 8 | IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via… |
| CVE-2016-6224 | UL Ubuntu Linux Canonical | 3.3 | Jul 22 | ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which… |
| CVE-2015-8946 | UL Ubuntu Linux Canonical | 3.3 | Jul 22 | ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd,… |
| CVE-2016-4645 | MO Mac OS X Apple | 3.3 | Jul 22 | CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4593 | IO iOS Apple | 2.4 | Jul 22 | The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors |
| CVE-2016-4583 | WE Webkit Apple | 3.1 | Jul 22 | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web… |
| CVE-2016-5473 | AP Agile Product Lifecycle Management Oracle | 3.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… |
| CVE-2016-5466 | SC Siebel Core-server Framework Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect… |
| CVE-2016-5462 | SC Siebel Core-server Framework Oracle | 2.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote administrators to affect… |
| CVE-2016-5460 | SC Siebel Core-server Framework Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect… |
| CVE-2016-5444 | MY MySQL Oracle | 3.7 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… |
| CVE-2016-3531 | AP Agile Product Lifecycle Management Oracle | 3.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… |
| CVE-2016-3516 | EC Enterprise Communications Broker Oracle | 3.1 | Jul 21 | Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote authenticated users to… |
| CVE-2016-3490 | TM Transportation Management Oracle | 3.0 | Jul 21 | Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0,… |
| CVE-2016-3485 | JD Jdk Oracle | 2.9 | Jul 21 | Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to… |
| CVE-2016-3484 | DA Database Oracle | 3.4 | Jul 21 | Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality and integrity via… |
| CVE-2016-3482 | HS Http Server Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect confidentiality via vectors… |
| CVE-2016-3474 | BI Business Intelligence Publisher Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to… |