Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-30 00:51Z
2016-02-25
2016-02-25 01:59Z
HIGH

CVE-2016-0714 — Apache Tomcat: The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0714

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. CVSSv3.1 8.8 (HIGH) · EPSS 96th percentile

CWECWE 264VNDApacheTYPVulnerability
8.8
CVSS v3.1
98
Edit Score
2016-02-25
2016-02-25 01:59Z
HIGH

CVE-2015-5351 — Apache Tomcat: The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-5351

The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token. CVSSv3.1 8.8 (HIGH) · EPSS 95th percentile

CWECWE 352VNDApacheVNDManagerTYPVulnerability
8.8
CVSS v3.1
97
Edit Score
2016-02-25
2016-02-25 01:59Z
HIGH

CVE-2015-5346 — Apache Tomcat: Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-5346

Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. CVSSv3.1 8.1 (HIGH) · EPSS 96th percentile

VNDApacheTYPVulnerability
8.1
CVSS v3.1
94
Edit Score
2016-02-25
2016-02-25 01:59Z
MED

CVE-2015-5345 — Debian Debian_linux: The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-5345

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. CVSSv3.1 5.3 (MEDIUM) · EPSS 97th percentile

CWECWE 22VNDApacheVNDMapperTYPVulnerability
5.3
CVSS v3.1
82
Edit Score
2016-02-25
2016-02-25 01:59Z
MED

CVE-2015-5174 — Debian Debian_linux: Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-5174

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. CVSSv3.1 4.3 (MEDIUM) · EPSS 96th percentile

CWECWE 22VNDApacheTYPVulnerability
4.3
CVSS v3.1
75
Edit Score
2016-02-10
2016-02-10 11:59Z
HIGH

CVE-2016-0055 — Microsoft Office: 2007 SP3 allows remote attackers to execute arbitrary code via a crafted

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0055

Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." CVSSv3.1 7.8 (HIGH) · EPSS 97th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
94
Edit Score
2016-01-21
2016-01-21 03:00Z
INFO

CVE-2016-0483 — Oracle Jdk: Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0483

Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a heap-based buffer overflow in the readImage function, which allows remote attackers to execute arbitrary code via crafted image data. EPSS 97th percentile

VNDOracleVNDUnspecifiedTYPVulnerability
54
Edit Score
728 × 90 / responsive · programmatic ad slot
2016-01-14
2016-01-14 22:59Z
HIGH

CVE-2016-0778 — Oracle Linux: The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0778

The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certain proxy and forward options are enabled, do not properly maintain connection file descriptors, which allows remote servers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact by requesting many forwardings. CVSSv3.1 8.1 (HIGH) · EPSS 78th percentile

CWECWE 119VNDOracleTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2016-01-14
2016-01-14 22:59Z
MED

CVE-2016-0777 — Sophos Unified_threat_management_software: The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0777

The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by requesting transmission of an entire buffer, as demonstrated by reading a private key. CVSSv3.1 6.5 (MEDIUM) · EPSS 99th percentile

CWECWE 200VNDOracleVNDSophosTYPVulnerability
6.5
CVSS v3.1
100
Edit Score
2016-01-13
2016-01-13 05:59Z
HIGH

CVE-2016-0035 — Microsoft Excel: 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0035

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." CVSSv3.1 7.8 (HIGH) · EPSS 98th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
96
Edit Score
2016-01-13
2016-01-13 05:59Z
MED

CVE-2016-0012 — Microsoft Excel: Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0012

Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office 2016, Excel 2016, PowerPoint 2016, Visio 2016, Word 2016, and Visual Basic 6.0 Runtime allow remote attackers to bypass the ASLR protection mechani CVSSv3.1 4.3 (MEDIUM) · EPSS 96th percentile

CWECWE 200VNDMicrosoftTYPVulnerability
4.3
CVSS v3.1
75
Edit Score
2016-01-13
2016-01-13 05:59Z
HIGH

CVE-2016-0010 — Microsoft Excel_for_mac: Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2016-0010

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." CVSSv3.1 7.8 (HIGH) · EPSS 98th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
7.8
CVSS v3.1
95
Edit Score
2015-12-15
2015-12-15 05:59Z
CRIT

CVE-2015-6420 — Apache Commons_collections: Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-6420

Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attacker CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile

CWECWE 502VNDApacheVNDSerializedTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2015-12-07
2015-12-07 18:59Z
HIGH

CVE-2015-5287 — Redhat Automatic_bug_reporting_tool: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-5287in the wild

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump. CVSSv3.1 7.8 (HIGH) · EPSS 88th percentile

CWECWE 59VNDOracleTYPVulnerabilitySTAitw exploited
7.8
CVSS v3.1
90
Edit Score
2015-11-13
2015-11-13 03:59Z
INFO

CVE-2015-8126 — Libpng Libpng: Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-8126

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. EPSS 96th percentile

CWECWE 120VNDFedoraprojectVNDLibpngTYPVulnerability
53
Edit Score
2015-11-11
2015-11-11 12:59Z
INFO

CVE-2015-6093 — Microsoft Office: 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-6093

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." EPSS 98th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
56
Edit Score
2015-10-28
2015-10-28 10:59Z
CRIT

CVE-2015-6490 — Rockwellautomation Micrologix_1100_firmware: Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-6490

Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via unspecified vectors. CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile

CWECWE 121CWECWE 119VNDStackVNDRockwellautomationTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2015-10-21
2015-10-21 23:59Z
INFO

CVE-2015-4843 — Oracle Jdk: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-4843

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. EPSS 96th percentile

VNDOracleVNDUnspecifiedTYPVulnerability
53
Edit Score
2015-10-18
2015-10-18 19:59Z
MED

CVE-2015-6477 — Nordex Nordex_control_2_scada: Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-6477

Multiple cross-site scripting (XSS) vulnerabilities in the Wind Farm Portal application in Nordex Control 2 (NC2) SCADA 16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. CVSSv3.1 6.1 (MEDIUM) · EPSS 97th percentile

CWECWE 79VNDXssVNDNordexTYPVulnerability
6.1
CVSS v3.1
90
Edit Score
2015-10-06
2015-10-06 01:59Z
CRIT

CVE-2015-0987 — Omron Cx-programmer: CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-0987

Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request. CVSSv3.1 10.0 (CRITICAL) · EPSS 67th percentile

CWECWE 319CWECWE 200VNDOmronTYPVulnerability
10.0
CVSS v3.1
100
Edit Score
2015-09-29
2015-09-29 19:59Z
INFO

CVE-2015-7601 — Pcman Ftp_server: Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-7601

Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double slash) in a RETR command. EPSS 99th percentile

CWECWE 22VNDPcmanTYPVulnerability
68
Edit Score
2015-08-15
2015-08-15 00:59Z
INFO

CVE-2015-2477 — Microsoft Office: 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-2477

Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." EPSS 96th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
54
Edit Score
2015-08-15
2015-08-15 00:59Z
INFO

CVE-2015-2470 — Microsoft Office: Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-2470

Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability." EPSS 98th percentile

CWECWE 189VNDMicrosoftTYPVulnerability
58
Edit Score
2015-08-15
2015-08-15 00:59Z
INFO

CVE-2015-2469 — Microsoft Office: Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-2469

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." EPSS 98th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
58
Edit Score
2015-08-15
2015-08-15 00:59Z
INFO

CVE-2015-2468 — Microsoft Office: Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2015-2468

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." EPSS 98th percentile

CWECWE 119VNDMicrosoftTYPVulnerability
59
Edit Score