Archive
April 2016
Vulnerabilities first published in this month (UTC), newest first.
58 results · Clear filters · Feed
-
Medium 6.5
Apache OpenMeetings Directory Traversal vulnerability
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
-
High 7.2
Path Traversal in Apache Jetspeed
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows…
-
Unscored —
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows…
-
Unscored —CVE-2016-1885 Public exploit
Integer signedness error in the amd64_set_ldt function in sys/amd64/amd64/sys_machdep.c in FreeBSD 9.3 before p39, 10.1…
-
Unscored —
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url par…
-
Unscored —CVE-2016-3986 Public exploit
Avast allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via …
-
Unscored —CVE-2016-3984 Public exploit
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0…
-
Unscored —CVE-2016-3963 Public exploit
Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port …
-
Unscored —CVE-2015-6541 Public exploit
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) b…
-
High 8.8
Jenkins allows Deserialization of Untrusted Data via an XML File
Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
-
Unscored —CVE-2016-1531 Public exploit
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
-
High 7.5
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary fi…
KEV Nov 3, 2021 -
Unscored —
Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows …
-
Unscored —
Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of ser…
-
High 7.3
actionpack allows remote code execution via application's unrestricted use of render method
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
-
Unscored —
XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows rem…
-
High 7.5
WildFly has incomplete blacklist vulnerability
Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a…