CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 18:08 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-8286 | MY MySQL Oracle | 3.1 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges |
| CVE-2016-8284 | MY MySQL Oracle | 1.8 | Oct 25 | Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication |
| CVE-2016-5618 | DI Data Integrator Oracle | 3.1 | Oct 25 | Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 12.1.2.0.0, 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows… |
| CVE-2016-5615 | SO Solaris Oracle | 3.3 | Oct 25 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows local users to affect availability via vectors related to Lynx |
| CVE-2016-5561 | SO Solaris Oracle | 3.1 | Oct 25 | Unspecified vulnerability in Oracle Sun Solaris 11.3 allows remote attackers to affect availability via vectors related to IKE |
| CVE-2016-5542 | JD Jdk Oracle | 3.1 | Oct 25 | Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries |
| CVE-2016-5525 | SC Solaris Cluster Oracle | 3.3 | Oct 25 | Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 3.3 and 4.3 allows local users to affect integrity via vectors related to Cluster… |
| CVE-2016-5508 | SC Solaris Cluster Oracle | 3.3 | Oct 25 | Unspecified vulnerability in the Solaris Cluster component in Oracle Sun Systems Products Suite 4.3 allows local users to affect confidentiality via vectors related to Cluster Geo |
| CVE-2016-5506 | IM Identity Manager Oracle | 3.1 | Oct 25 | Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware allows local users to affect confidentiality and integrity via vectors related to… |
| CVE-2016-5499 | DS Database Server Oracle | 3.3 | Oct 25 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidentiality via unknown vectors, a… |
| CVE-2016-5498 | DS Database Server Oracle | 3.3 | Oct 25 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows local users to affect confidentiality via unknown vectors, a… |
| CVE-2016-5490 | FU Flexcube Universal Banking Oracle | 3.3 | Oct 25 | Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Applications 11.4.0 allows local users to affect confidentiality via… |
| CVE-2016-5481 | SZ Sun Zfs Storage Appliance Kit Oracle | 3.7 | Oct 25 | Unspecified vulnerability in the Sun ZFS Storage Appliance Kit (AK) component in Oracle Sun Systems Products Suite AK 2013 allows remote attackers to affect confidentiality via… |
| CVE-2016-5480 | SO Solaris Oracle | 2.8 | Oct 25 | Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect integrity via vectors related to Bash |
| CVE-2016-3562 | DS Database Server Oracle | 2.4 | Oct 25 | Unspecified vulnerability in the RDBMS Security and SQL*Plus components in Oracle Database Server 11.2.0.4 and 12.1.0.2 allows remote administrators to affect confidentiality via… |
| CVE-2016-1000033 | SH Shotwell Gnome | 3.7 | Oct 25 | Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks |
| CVE-2016-0240 | SG Security Guardium Database Activity Monitor Ibm | 3.7 | Oct 22 | IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 does not enable the HSTS protection mechanism,… |
| CVE-2016-7437 | NE Netweaver Sap | 3.3 | Oct 13 | SAP Netweaver 7.40 improperly logs (1) DUI and (2) DUJ events in the SAP Security Audit Log as non-critical, which might allow local users to hide rejected attempts to execute RFC… |
| CVE-2016-7960 | SS Simatic Step 7 Siemens | 2.5 | Oct 13 | Siemens SIMATIC STEP 7 (TIA Portal) before 14 uses an improper format for managing TIA project files during version updates, which makes it easier for local users to obtain… |
| CVE-2016-5432 | EV Enterprise Virtualization Redhat | 3.3 | Oct 3 | The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log… |
| CVE-2016-0379 | WM Websphere MQ Ibm | 3.1 | Sep 26 | IBM WebSphere MQ 7.5 before 7.5.0.7 and 8.0 before 8.0.0.5 mishandles protocol flows, which allows remote authenticated users to cause a denial of service (channel outage) by… |
| CVE-2016-0248 | SG Security Guardium Ibm | 3.7 | Sep 26 | IBM Security Guardium 9.0 before p700 and 10.0 before p100 allows man-in-the-middle attackers to obtain sensitive query-string information from SSL sessions via unspecified… |
| CVE-2016-4751 | SA Safari Apple | 3.5 | Sep 25 | The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site |
| CVE-2016-4739 | MO Mac OS X Apple | 3.7 | Sep 25 | mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows remote attackers to obtain sensitive… |
| CVE-2016-4717 | MO Mac OS X Apple | 3.3 | Sep 25 | The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial of service via a crafted app |
| CVE-2016-4715 | MO Mac OS X Apple | 3.3 | Sep 25 | The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a user's location via a crafted app |
| CVE-2016-4749 | IO iOS Apple | 3.3 | Sep 18 | Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file |
| CVE-2016-4747 | IO iOS Apple | 3.7 | Sep 18 | Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors |
| CVE-2016-4740 | IO iOS Apple | 2.9 | Sep 18 | Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain… |
| CVE-2016-4620 | IO iOS Apple | 3.3 | Sep 18 | The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover… |
| CVE-2016-3354 | WI Windows Microsoft | 3.3 | Sep 14 | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT… |
| CVE-2016-3344 | WI Windows Microsoft | 3.3 | Sep 14 | The Secure Kernel Mode feature in Microsoft Windows 10 Gold and 1511 allows local users to obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode… |
| CVE-2016-3325 | ED Edge Microsoft | 3.1 | Sep 14 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure… |
| CVE-2016-3291 | ED Edge Microsoft | 2.4 | Sep 14 | Microsoft Internet Explorer 11 and Microsoft Edge mishandle cross-origin requests, which allows remote attackers to obtain sensitive information via a crafted web site, aka… |
| CVE-2016-0137 | OF Office Microsoft | 3.3 | Sep 14 | The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft… |
| CVE-2016-3888 | AN Android Google | 2.1 | Sep 11 | internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows physically… |
| CVE-2016-5166 | CH Chrome Google | 3.1 | Sep 11 | The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly restrict saving a file:// URL that is… |
| CVE-2016-4379 | IL Integrated Lights-out 3 Firmware HP | 3.7 | Sep 8 | The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which… |
| CVE-2016-5429 | JO Jose-php Jose-php Project | 3.7 | Sep 3 | jose-php before 2.2.1 does not use constant-time operations for HMAC comparison, which makes it easier for remote attackers to obtain sensitive information via a timing attack,… |
| CVE-2016-2998 | CO Connections Ibm | 3.5 | Sep 1 | Cross-site request forgery (CSRF) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 before CR4, and 5.5 before CR1 allows remote authenticated users to hijack… |
| CVE-2016-0385 | WA Websphere Application Server Ibm | 3.1 | Sep 1 | Buffer overflow in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.10, 9.0 before 9.0.0.1, and Liberty before 16.0.0.3, when… |
| CVE-2016-0370 | FE Forms Experience Builder Ibm | 2.7 | Sep 1 | Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.x and 8.6.x before 8.6.3 allows remote authenticated users to inject arbitrary web script or HTML via… |
| CVE-2016-5812 | OG Oncell G3001 Firmware Moxa | 3.3 | Aug 24 | Moxa OnCell G3100V2 devices before 2.8 and G3111, G3151, G3211, and G3251 devices before 1.7 use cleartext password storage, which makes it easier for local users to obtain… |
| CVE-2013-7458 | RE Redis Redis | 3.3 | Aug 10 | linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file |
| CVE-2016-3321 | IE Internet Explorer Microsoft | 2.5 | Aug 9 | Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via… |
| CVE-2016-2960 | WA Websphere Application Server Ibm | 3.7 | Aug 8 | IBM WebSphere Application Server (WAS) 7.x before 7.0.0.43, 8.0.0.x before 8.0.0.13, 8.5.0.x before 8.5.5.10, 8.5.0.x and 16.0.0.x Liberty before Liberty Fix Pack 16.0.0.3, and… |
| CVE-2016-0380 | SC Sterling Connect:direct Ibm | 3.3 | Aug 8 | IBM Sterling Connect:Direct for Unix 4.1.0 before 4.1.0.4 iFix073 and 4.2.0 before 4.2.0.4 iFix003 uses default file permissions of 0664, which allows local users to obtain… |
| CVE-2016-0281 | AI Aix Ibm | 3.7 | Aug 8 | The mustendd driver in IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x, when the jumbo_frames feature is not enabled, allows remote attackers to cause a denial of service (FC1763 or… |
| CVE-2016-0266 | AI Aix Ibm | 3.7 | Aug 8 | IBM AIX 5.3, 6.1, 7.1, and 7.2 and VIOS 2.2.x do not default to the latest TLS version, which makes it easier for man-in-the-middle attackers to obtain sensitive information via… |
| CVE-2016-6224 | UL Ubuntu Linux Canonical | 3.3 | Jul 22 | ecryptfs-setup-swap in eCryptfs does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning on a (1) NVMe or (2) MMC drive, which… |