CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 13:46 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-0175 | WI Windows Microsoft | 3.3 | May 11 | The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and… |
| CVE-2015-0858 | DL Debian Linux Debian | 3.3 | May 6 | Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory |
| CVE-2016-4534 | WI Windows Microsoft | 3.0 | May 5 | The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local administrators to bypass intended… |
| CVE-2016-3716 | UL Ubuntu Linux Canonical | 3.3 | May 5 | The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image |
| CVE-2016-1185 | KI Kintone Cybozu | 2.5 | Apr 25 | The Cybozu kintone mobile application 1.x before 1.0.6 for Android allows attackers to discover an authentication token via a crafted application |
| CVE-2016-4053 | UL Ubuntu Linux Canonical | 3.7 | Apr 25 | Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to… |
| CVE-2016-3428 | AE Agile Engineering Data Management Oracle | 3.1 | Apr 21 | Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect… |
| CVE-2016-3426 | JD Jdk Oracle | 3.1 | Apr 21 | Unspecified vulnerability in Oracle Java SE 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality via vectors related to JCE |
| CVE-2016-3419 | SO Solaris Oracle | 3.3 | Apr 21 | Unspecified vulnerability in Oracle Sun Solaris 10 and 11.3 allows local users to affect availability via vectors related to Filesystem |
| CVE-2016-0691 | DA Database Oracle | 3.3 | Apr 21 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a… |
| CVE-2016-0690 | DA Database Oracle | 3.3 | Apr 21 | Unspecified vulnerability in the RDBMS Security component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect integrity via unknown vectors, a… |
| CVE-2016-0688 | WS WebLogic Server Oracle | 3.7 | Apr 21 | Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via vectors… |
| CVE-2016-0671 | HS Http Server Oracle | 3.7 | Apr 21 | Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 12.1.2.0 allows remote attackers to affect confidentiality via vectors related to OSSL… |
| CVE-2016-0643 | MY MySQL Oracle | 3.3 | Apr 21 | Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before… |
| CVE-2015-8842 | OP Opensuse Opensuse | 3.3 | Apr 20 | tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the… |
| CVE-2014-9770 | OP Opensuse Opensuse | 3.3 | Apr 20 | tmpfiles.d/systemd.conf in systemd before 214 uses weak permissions for journal files under (1) /run/log/journal/%m and (2) /var/log/journal/%m, which allows local users to obtain… |
| CVE-2015-7511 | UL Ubuntu Linux Canonical | 2.0 | Apr 19 | Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH… |
| CVE-2016-3972 | DO Dotcms Dotcms | 2.7 | Apr 18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a |
| CVE-2016-3159 | DL Debian Linux Debian | 3.8 | Apr 13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS… |
| CVE-2016-3158 | FE Fedora Fedoraproject | 3.8 | Apr 13 | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users… |
| CVE-2016-2057 | DL Debian Linux Debian | 3.3 | Apr 13 | lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary… |
| CVE-2015-5313 | LI Libvirt Redhat | 2.5 | Apr 11 | Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are… |
| CVE-2016-2513 | DJ Django Djangoproject | 3.1 | Apr 8 | The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login… |
| CVE-2016-1773 | MO Mac OS X Apple | 3.3 | Mar 24 | The code-signing subsystem in Apple OS X before 10.11.4 does not properly verify file ownership, which allows local users to determine the existence of arbitrary files via… |
| CVE-2016-1763 | IO iOS Apple | 3.5 | Mar 24 | Messages in Apple iOS before 9.3 does not ensure that an auto-fill action applies to the intended message thread, which allows remote authenticated users to obtain sensitive… |
| CVE-2016-1758 | IO iOS Apple | 3.3 | Mar 24 | The kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to obtain sensitive memory-layout information or cause a denial of service (out-of-bounds read) via a… |
| CVE-2016-1748 | IO iOS Apple | 3.3 | Mar 24 | IOHIDFamily in Apple iOS before 9.3, OS X before 10.11.4, tvOS before 9.2, and watchOS before 2.2 allows attackers to obtain sensitive kernel memory-layout information via a… |
| CVE-2016-3155 | AI Apogee Insight Siemens | 3.4 | Mar 18 | Siemens APOGEE Insight uses weak permissions for the application folder, which allows local users to obtain sensitive information or modify data via unspecified vectors |
| CVE-2016-0208 | WC Websphere Commerce Ibm | 3.7 | Mar 14 | IBM WebSphere Commerce 6.x through 6.0.0.11, 7.x through 7.0.0.9, and 8.x before 8.0.0.3 allows remote attackers to cause a denial of service (order-processing outage) via… |
| CVE-2016-0125 | ED Edge Microsoft | 3.1 | Mar 9 | Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via a crafted HTTPS web site, aka… |
| CVE-2016-1356 | FS Firesight System Software Cisco | 3.7 | Mar 3 | Cisco FireSIGHT System Software 6.1.0 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to enumerate valid usernames by… |
| CVE-2015-7490 | II Infosphere Information Server Ibm | 3.1 | Mar 3 | IBM InfoSphere Information Server 8.5 through FP3, 8.7 through FP2, 9.1 through 9.1.2.0, 11.3 through 11.3.1.2, and 11.5 allows remote authenticated users to bypass intended… |
| CVE-2015-7455 | WP Websphere Portal Ibm | 3.1 | Feb 29 | IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated… |
| CVE-2015-7576 | RA Rails Rubyonrails | 3.7 | Feb 16 | The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on… |
| CVE-2016-0701 | OP Openssl Openssl | 3.7 | Feb 15 | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which… |
| CVE-2015-7408 | TS Tivoli Storage Manager Ibm | 3.7 | Feb 15 | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which… |
| CVE-2016-2091 | LI Libdwarf Libdwarf Project | 3.3 | Feb 8 | The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file |
| CVE-2016-1900 | CG Cgit Cgit Project | 3.7 | Jan 20 | CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject… |
| CVE-2016-1899 | CG Cgit Cgit Project | 3.7 | Jan 20 | CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or… |
| CVE-2015-7886 | DO Data Ontap Netapp | 3.7 | Jan 18 | NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors |
| CVE-2015-4958 | IM Infosphere Master Data Management Ibm | 3.3 | Jan 17 | IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 before 11.4.0.4 IF1 does not properly… |
| CVE-2016-1133 | H2 H2o Dena | 3.7 | Jan 16 | CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP… |
| CVE-2015-7759 | BA Big-ip Access Policy Manager F5 | 3.7 | Jan 12 | BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache… |
| CVE-2015-7548 | NO Nova Openstack | 3.5 | Jan 12 | OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote… |
| CVE-2015-7466 | JR Jazz Reporting Service Ibm | 3.1 | Jan 10 | Lifecycle Query Engine (LQE) in IBM Jazz Reporting Service (JRS) 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to conduct LDAP injection attacks, and… |
| CVE-2016-1500 | OW Owncloud Owncloud | 3.1 | Jan 8 | ownCloud Server before 7.0.12, 8.0.x before 8.0.10, 8.1.x before 8.1.5, and 8.2.x before 8.2.2, when the "file_versions" application is enabled, does not properly check the return… |
| CVE-2015-8481 | JI Jira Atlassian | 3.1 | Jan 8 | Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with… |
| CVE-2015-7758 | GU Gummi Gummi Project | 3.3 | Jan 8 | Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out,… |
| CVE-2015-7519 | PP Phusion Passenger Phusionpassenger | 3.7 | Jan 8 | agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering… |
| CVE-2015-6644 | AN Android Google | 3.3 | Jan 6 | Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146 |