CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 19:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-3276 | IE Internet Explorer Microsoft | 3.1 | Jul 13 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability." |
| CVE-2016-3274 | ED Edge Microsoft | 3.1 | Jul 13 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing… |
| CVE-2016-3272 | WI Windows Microsoft | 2.8 | Jul 13 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which allows local users to… |
| CVE-2016-3251 | WI Windows Microsoft | 2.8 | Jul 13 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,… |
| CVE-2016-3763 | AN Android Google | 3.3 | Jul 11 | net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure… |
| CVE-2016-3759 | AN Android Google | 3.3 | Jul 11 | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages… |
| CVE-2016-5849 | SP Sicam Pas/pqs Siemens | 2.5 | Jul 4 | Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage |
| CVE-2016-2894 | TS Tivoli Storage Manager Ibm | 2.5 | Jul 3 | IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved… |
| CVE-2016-5702 | PH Phpmyadmin Phpmyadmin | 3.7 | Jul 3 | phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI |
| CVE-2016-2870 | WD Websphere Datapower Xc10 Appliance Firmware Ibm | 2.7 | Jul 2 | Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors |
| CVE-2016-2868 | QS Qradar Security Information And Event Manager Ibm | 2.7 | Jul 2 | IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in… |
| CVE-2016-2861 | WE Websphere Extreme Scale Ibm | 3.7 | Jul 2 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote… |
| CVE-2015-8801 | EP Endpoint Protection Manager Symantec | 2.9 | Jun 30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting… |
| CVE-2016-0259 | WM Websphere MQ Ibm | 2.5 | Jun 26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display… |
| CVE-2015-7473 | WM Websphere MQ Ibm | 2.5 | Jun 26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp |
| CVE-2016-1862 | MO Mac OS X Apple | 3.3 | Jun 19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than… |
| CVE-2016-1860 | MO Mac OS X Apple | 3.3 | Jun 19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than… |
| CVE-2016-1183 | TS Terasoluna Server Framework For Java Web Nttdata | 3.7 | Jun 19 | NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers… |
| CVE-2016-5233 | M8 Mate 8 Firmware Huawei | 3.7 | Jun 10 | Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182… |
| CVE-2016-4527 | PC Pcm600 Abb | 3.3 | Jun 10 | ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4516 | PC Pcm600 Abb | 3.3 | Jun 10 | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4511 | PC Pcm600 Abb | 2.8 | Jun 10 | ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by… |
| CVE-2016-3711 | OP Openshift Redhat | 3.3 | Jun 8 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID"… |
| CVE-2016-1212 | MF MP Form Mail Cgi Futomi | 2.7 | Jun 5 | Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via… |
| CVE-2016-4486 | KE Kernel Linux | 3.3 | May 23 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain… |
| CVE-2016-1852 | IO iOS Apple | 2.4 | May 20 | Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and… |
| CVE-2016-1849 | IO iOS Apple | 3.3 | May 20 | The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might… |
| CVE-2016-1798 | MO Mac OS X Apple | 3.3 | May 20 | Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app |
| CVE-2016-1796 | MO Mac OS X Apple | 3.3 | May 20 | Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds memory… |
| CVE-2016-1791 | MO Mac OS X Apple | 3.3 | May 20 | The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app |
| CVE-2016-1790 | IO iOS Apple | 3.3 | May 20 | Buffer overflow in the Accessibility component in Apple iOS before 9.3.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app |
| CVE-2016-0707 | AM Ambari Apache | 3.3 | May 18 | The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to… |
| CVE-2016-0175 | WI Windows Microsoft | 3.3 | May 11 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and… |
| CVE-2015-0858 | DL Debian Linux Debian | 3.3 | May 6 | Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory |
| CVE-2016-4534 | WI Windows Microsoft | 3.0 | May 5 | The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local administrators to bypass intended… |
| CVE-2016-3716 | UL Ubuntu Linux Canonical | 3.3 | May 5 | The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image |
| CVE-2016-1185 | KI Kintone Cybozu | 2.5 | Apr 25 | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application |
| CVE-2016-4053 | UL Ubuntu Linux Canonical | 3.7 | Apr 25 | Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to… |
| CVE-2016-3428 | AE Agile Engineering Data Management Oracle | 3.1 | Apr 21 | Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect… |
| CVE-2016-3426 | JD Jdk Oracle | 3.1 | Apr 21 | Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE |
| CVE-2016-3419 | SO Solaris Oracle | 3.3 | Apr 21 | Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect availability via vectors related to Filesystem |
| CVE-2016-0691 | DA Database Oracle | 3.3 | Apr 21 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a… |
| CVE-2016-0690 | DA Database Oracle | 3.3 | Apr 21 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a… |
| CVE-2016-0688 | WS WebLogic Server Oracle | 3.7 | Apr 21 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors… |
| CVE-2016-0671 | HS Http Server Oracle | 3.7 | Apr 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL… |
| CVE-2016-0643 | MY MySQL Oracle | 3.3 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… |
| CVE-2015-8842 | OP Opensuse Opensuse | 3.3 | Apr 20 | tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the… |
| CVE-2014-9770 | OP Opensuse Opensuse | 3.3 | Apr 20 | tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain… |
| CVE-2015-7511 | UL Ubuntu Linux Canonical | 2.0 | Apr 19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH… |
| CVE-2016-3972 | DO Dotcms Dotcms | 2.7 | Apr 18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a |