Archive
April 2016
Vulnerabilities first published in this month (UTC), newest first.
58 results · Clear filters · Feed
-
Unscored —CVE-2015-7515 Public exploit
The aiptek_probe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate a…
-
Unscored —CVE-2016-3135 Public exploit
Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 3…
-
Unscored —CVE-2016-3672 Public exploit
The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize …
-
Unscored —CVE-2016-3139 Public exploit
The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximat…
-
Unscored —CVE-2016-3134 Public exploit
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local u…
-
Unscored —CVE-2016-2384 Public exploit
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows …
-
Unscored —CVE-2016-2782 Public exploit
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attac…
-
Unscored —CVE-2016-2184 Public exploit
The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5…
-
High 8.1
Apache Struts RCE Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
KEV Oct 8, 2026 -
Unscored —
Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial o…
-
Unscored —CVE-2016-2203 Public exploit
The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discov…
-
Unscored —
Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remo…
-
Unscored —CVE-2016-1595 Public exploit
LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows re…
-
Unscored —CVE-2016-1596 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenti…
-
Unscored —CVE-2016-1594 Public exploit
Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a reques…
-
Unscored —
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, a…
-
Unscored —
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary co…
-
Unscored —CVE-2016-0891 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow rem…
-
Unscored —CVE-2015-7378 Public exploit
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and instal…
-
Unscored —CVE-2016-3943 Public exploit
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a…
-
Unscored —CVE-2016-0846 Public exploit
libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5…
-
Unscored —CVE-2016-2417 Public exploit
media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x bef…
-
Unscored —CVE-2015-8550 Public exploit
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (ho…
-
Unscored —CVE-2016-4014 Public exploit
XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to c…
-
Unscored —
xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files…
-
Unscored —
xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands vi…
-
Unscored —
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.…
-
Unscored —
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Window…
-
Unscored —
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Word 2016 for Mac, Office Comp…
-
High 7.8
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, …
KEV Jun 22, 2023 -
Unscored —CVE-2016-0143 Public exploit
The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, …
-
High 7.8
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1,…
KEV Mar 28, 2022 -
Unscored —
The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x befo…
-
Unscored —CVE-2015-5347 Public exploit
Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.m…
-
Unscored —CVE-2016-4004 Public exploit
Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated admini…
-
Unscored —CVE-2015-8710 Public exploit
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a deni…
-
Unscored —
Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName …
-
Unscored —CVE-2015-8398 Public exploit
Cross-site scripting (XSS) vulnerability in Atlassian Confluence before 5.8.17 allows remote attackers to inject arbitr…
-
Unscored —
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER …
-
High 8.8
Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.