CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 18:05 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-2057 | DL Debian Linux Debian | 3.3 | Apr 13 | lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary… |
| CVE-2015-5313 | LI Libvirt Redhat | 2.5 | Apr 11 | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are… |
| CVE-2016-2513 | DJ Django Djangoproject | 3.1 | Apr 8 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login… |
| CVE-2016-1773 | MO Mac OS X Apple | 3.3 | Mar 24 | The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via… |
| CVE-2016-1763 | IO iOS Apple | 3.5 | Mar 24 | Messages in Apple iOS before 9.3 does not ensure that an auto-fill action applies to the intended message thread, which allows remote authenticated users to obtain sensitive… |
| CVE-2016-1758 | IO iOS Apple | 3.3 | Mar 24 | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a… |
| CVE-2016-1748 | IO iOS Apple | 3.3 | Mar 24 | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a… |
| CVE-2016-3155 | AI Apogee Insight Siemens | 3.4 | Mar 18 | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors |
| CVE-2016-0208 | WC Websphere Commerce Ibm | 3.7 | Mar 14 | IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via… |
| CVE-2016-0125 | ED Edge Microsoft | 3.1 | Mar 9 | Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka… |
| CVE-2016-1356 | FS Firesight System Software Cisco | 3.7 | Mar 3 | Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by… |
| CVE-2015-7490 | II Infosphere Information Server Ibm | 3.1 | Mar 3 | IBM InfoSphere Information Server 8.5 through FP3, 8.7 through FP2, 9.1 through 9.1.2.0, 11.3 through 11.3.1.2, and 11.5 allows remote authenticated users to bypass intended… |
| CVE-2015-7455 | WP Websphere Portal Ibm | 3.1 | Feb 29 | IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated… |
| CVE-2015-7576 | RA Rails Rubyonrails | 3.7 | Feb 16 | The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on… |
| CVE-2016-0701 | OP Openssl Openssl | 3.7 | Feb 15 | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which… |
| CVE-2015-7408 | TS Tivoli Storage Manager Ibm | 3.7 | Feb 15 | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which… |
| CVE-2016-2091 | LI Libdwarf Libdwarf Project | 3.3 | Feb 8 | The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file |
| CVE-2016-1900 | CG Cgit Cgit Project | 3.7 | Jan 20 | CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject… |
| CVE-2016-1899 | CG Cgit Cgit Project | 3.7 | Jan 20 | CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or… |
| CVE-2015-7886 | DO Data Ontap Netapp | 3.7 | Jan 18 | NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors |
| CVE-2015-4958 | IM Infosphere Master Data Management Ibm | 3.3 | Jan 17 | IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly… |
| CVE-2016-1133 | H2 H2o Dena | 3.7 | Jan 16 | CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP… |
| CVE-2015-7759 | BA Big-ip Access Policy Manager F5 | 3.7 | Jan 12 | BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache… |
| CVE-2015-7548 | NO Nova Openstack | 3.5 | Jan 12 | OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote… |
| CVE-2015-7466 | JR Jazz Reporting Service Ibm | 3.1 | Jan 10 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and… |
| CVE-2016-1500 | OW Owncloud Owncloud | 3.1 | Jan 8 | ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return… |
| CVE-2015-8481 | JI Jira Atlassian | 3.1 | Jan 8 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with… |
| CVE-2015-7758 | GU Gummi Gummi Project | 3.3 | Jan 8 | Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out,… |
| CVE-2015-7519 | PP Phusion Passenger Phusionpassenger | 3.7 | Jan 8 | agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering… |
| CVE-2015-6644 | AN Android Google | 3.3 | Jan 6 | Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146 |
| CVE-2015-6641 | AN Android Google | 3.1 | Jan 6 | Bluetooth in Android 6.0 before 2016-01-01 allows remote attackers to obtain sensitive Contacts information by leveraging pairing, aka internal bug 23607427 |
| CVE-2015-6858 | IM Insight Management HP | 3.7 | Jan 5 | HP Insight Control server provisioning before 7.5.0 RabbitMQ allows remote attackers to obtain sensitive information via unspecified vectors |
| CVE-2015-8509 | BU Bugzilla Mozilla | 3.5 | Jan 3 | Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote… |
| CVE-2015-4962 | RC Rational Collaborative Lifecycle Management Ibm | 3.5 | Jan 3 | Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational… |
| CVE-2015-4946 | RC Rational Collaborative Lifecycle Management Ibm | 3.3 | Jan 3 | Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x… |
| CVE-2015-7436 | TC Tivoli Common Reporting Ibm | 2.5 | Jan 2 | IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and… |
| CVE-2015-7435 | TC Tivoli Common Reporting Ibm | 2.5 | Jan 2 | IBM Tivoli Common Reporting (TCR) 2.1 before IF14, 2.1.1 before IF22, 2.1.1.2 before IF9, 3.1.0.0 through 3.1.2 as used in Cognos Business Intelligence before 10.2 IF16, and… |
| CVE-2015-4989 | TC Tealeaf Customer Experience Ibm | 3.7 | Jan 2 | The portal in IBM Tealeaf Customer Experience before 8.7.1.8814, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095,… |
| CVE-2015-7421 | MA MQ Appliance M2000 Ibm | 3.7 | Jan 1 | Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability… |
| CVE-2015-7420 | MA MQ Appliance M2000 Ibm | 3.7 | Jan 1 | Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability… |
| CVE-2014-4876 | 4O 4690 Operating System Toshiba | 3.7 | Dec 31 | Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment… |
| CVE-2015-8569 | KE Kernel Linux | 2.3 | Dec 28 | The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain… |
| CVE-2015-7885 | KE Kernel Linux | 2.3 | Dec 28 | The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to… |
| CVE-2015-7884 | KE Kernel Linux | 2.3 | Dec 28 | The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users… |
| CVE-2015-8253 | FP Frontel Protocol Rsi Video Technologies | 3.7 | Dec 27 | The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain… |
| CVE-2015-4000 | IO iOS Apple | 3.7 | May 21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows… |
| CVE-2015-2808 | UL Ubuntu Linux Canonical | 3.7 | Apr 1 | The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for… |
| CVE-2014-8134 | KE Kernel Linux | 3.3 | Dec 12 | The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier… |
| CVE-2014-3566 | MO Mac OS X Apple | 3.4 | Oct 15 | The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain… |
| CVE-2014-4407 | IO iOS Apple | 3.3 | Sep 18 | IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an… |