CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:43 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-4645 | MO Mac OS X Apple | 3.3 | Jul 22 | CFNetwork in Apple OS X before 10.11.6 uses weak permissions for web-browser cookies, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4593 | IO iOS Apple | 2.4 | Jul 22 | The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors |
| CVE-2016-4583 | WE Webkit Apple | 3.1 | Jul 22 | WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web… |
| CVE-2016-5473 | AP Agile Product Lifecycle Management Oracle | 3.1 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… |
| CVE-2016-5466 | SC Siebel Core-server Framework Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect… |
| CVE-2016-5462 | SC Siebel Core-server Framework Oracle | 2.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote administrators to affect… |
| CVE-2016-5460 | SC Siebel Core-server Framework Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect… |
| CVE-2016-5444 | MY MySQL Oracle | 3.7 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… |
| CVE-2016-3531 | AP Agile Product Lifecycle Management Oracle | 3.5 | Jul 21 | Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote authenticated users to affect confidentiality via… |
| CVE-2016-3516 | EC Enterprise Communications Broker Oracle | 3.1 | Jul 21 | Unspecified vulnerability in the Oracle Enterprise Communications Broker component in Oracle Communications Applications before PCz 2.0.0m4p1 allows remote authenticated users to… |
| CVE-2016-3490 | TM Transportation Management Oracle | 3.0 | Jul 21 | Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.4.0,… |
| CVE-2016-3485 | JD Jdk Oracle | 2.9 | Jul 21 | Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows local users to affect integrity via vectors related to… |
| CVE-2016-3484 | DA Database Oracle | 3.4 | Jul 21 | Unspecified vulnerability in the Database Vault component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality and integrity via… |
| CVE-2016-3482 | HS Http Server Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 and 12.1.3.0 allows remote attackers to affect confidentiality via vectors… |
| CVE-2016-3474 | BI Business Intelligence Publisher Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote attackers to… |
| CVE-2016-3469 | SC Siebel Core-server Framework Oracle | 3.3 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows local users to affect… |
| CVE-2016-3452 | MY MySQL Oracle | 3.7 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… |
| CVE-2016-3450 | SC Siebel Core-server Framework Oracle | 3.7 | Jul 21 | Unspecified vulnerability in the Siebel Core - Server Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, IP2014, IP2015, and IP2016 allows remote attackers to affect… |
| CVE-2016-3276 | IE Internet Explorer Microsoft | 3.1 | Jul 13 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing Vulnerability." |
| CVE-2016-3274 | ED Edge Microsoft | 3.1 | Jul 13 | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to conduct content-spoofing attacks via a crafted URL, aka "Microsoft Browser Spoofing… |
| CVE-2016-3272 | WI Windows Microsoft | 2.8 | Jul 13 | The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which allows local users to… |
| CVE-2016-3251 | WI Windows Microsoft | 2.8 | Jul 13 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,… |
| CVE-2016-3763 | AN Android Google | 3.3 | Jul 11 | net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure… |
| CVE-2016-3759 | AN Android Google | 3.3 | Jul 11 | The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages… |
| CVE-2016-5849 | SP Sicam Pas/pqs Siemens | 2.5 | Jul 4 | Siemens SICAM PAS through 8.07 allows local users to obtain sensitive configuration information by leveraging database stoppage |
| CVE-2016-2894 | TS Tivoli Storage Manager Ibm | 2.5 | Jul 3 | IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 through 6.3 before 6.3.2.6, 6.4 before 6.4.3.3, and 7.1 before 7.1.6 allows local users to obtain sensitive retrieved… |
| CVE-2016-5702 | PH Phpmyadmin Phpmyadmin | 3.7 | Jul 3 | phpMyAdmin 4.6.x before 4.6.3, when the environment lacks a PHP_SELF value, allows remote attackers to conduct cookie-attribute injection attacks via a crafted URI |
| CVE-2016-2870 | WD Websphere Datapower Xc10 Appliance Firmware Ibm | 2.7 | Jul 2 | Buffer overflow in the CLI on IBM WebSphere DataPower XC10 appliances 2.1 and 2.5 allows remote authenticated users to cause a denial of service via unspecified vectors |
| CVE-2016-2868 | QS Qradar Security Information And Event Manager Ibm | 2.7 | Jul 2 | IBM Security QRadar SIEM 7.2.x before 7.2.7 allows remote authenticated administrators to read arbitrary files via XML data containing an external entity declaration in… |
| CVE-2016-2861 | WE Websphere Extreme Scale Ibm | 3.7 | Jul 2 | IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3, 7.1.1 before 7.1.1.1, 8.5 before 8.5.0.3, and 8.6 before 8.6.0.8 does not properly encrypt data, which makes it easier for remote… |
| CVE-2015-8801 | EP Endpoint Protection Manager Symantec | 2.9 | Jun 30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting… |
| CVE-2016-0259 | WM Websphere MQ Ibm | 2.5 | Jun 26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass an intended +dsp authority requirement and obtain sensitive information via unspecified display… |
| CVE-2015-7473 | WM Websphere MQ Ibm | 2.5 | Jun 26 | runmqsc in IBM WebSphere MQ 8.x before 8.0.0.5 allows local users to bypass intended queue-manager command access restrictions by leveraging authority for +connect and +dsp |
| CVE-2016-1862 | MO Mac OS X Apple | 3.3 | Jun 19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than… |
| CVE-2016-1860 | MO Mac OS X Apple | 3.3 | Jun 19 | Intel Graphics Driver in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app, a different vulnerability than… |
| CVE-2016-1183 | TS Terasoluna Server Framework For Java Web Nttdata | 3.7 | Jun 19 | NTT Data TERASOLUNA Server Framework for Java(WEB) 2.0.0.1 through 2.0.6.1, as used in Fujitsu Interstage Business Application Server and other products, allows remote attackers… |
| CVE-2016-5233 | M8 Mate 8 Firmware Huawei | 3.7 | Jun 10 | Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182… |
| CVE-2016-4527 | PC Pcm600 Abb | 3.3 | Jun 10 | ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4516 | PC Pcm600 Abb | 3.3 | Jun 10 | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors |
| CVE-2016-4511 | PC Pcm600 Abb | 2.8 | Jun 10 | ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by… |
| CVE-2016-3711 | OP Openshift Redhat | 3.3 | Jun 8 | HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID"… |
| CVE-2016-1212 | MF MP Form Mail Cgi Futomi | 2.7 | Jun 5 | Directory traversal vulnerability in futomi MP Form Mail CGI Professional Edition 3.2.3 and earlier allows remote authenticated administrators to read arbitrary files via… |
| CVE-2016-4486 | KE Kernel Linux | 3.3 | May 23 | The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain… |
| CVE-2016-1852 | IO iOS Apple | 2.4 | May 20 | Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and… |
| CVE-2016-1849 | IO iOS Apple | 3.3 | May 20 | The "Clear History and Website Data" feature in Apple Safari before 9.1.1, as used in iOS before 9.3.2 and other products, mishandles the deletion of browsing history, which might… |
| CVE-2016-1798 | MO Mac OS X Apple | 3.3 | May 20 | Audio in Apple OS X before 10.11.5 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app |
| CVE-2016-1796 | MO Mac OS X Apple | 3.3 | May 20 | Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information or cause a denial of service (out-of-bounds memory… |
| CVE-2016-1791 | MO Mac OS X Apple | 3.3 | May 20 | The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app |
| CVE-2016-1790 | IO iOS Apple | 3.3 | May 20 | Buffer overflow in the Accessibility component in Apple iOS before 9.3.2 allows attackers to obtain sensitive kernel memory-layout information via a crafted app |
| CVE-2016-0707 | AM Ambari Apache | 3.3 | May 18 | The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to… |