October 2016

7 results · Clear filters · Feed

• Critical 9.8
  CVE-2016-1000031 EPSS 33%

  Improper Access Control in commons-fileupload

  Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

  tomcat8 tomcat7 tomcat6 commons-fileupload:commons-fileupload Debian Ubuntu Maven
  Oct 25, 2016
• Critical 9.1
  CVE-2014-5415

  Beckhoff Embedded PC Images and TwinCAT Components Exposed Dangerous Method or Function

  Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.

  Beckhoff Embedded PC Images TwinCAT Components featuring Automation Device Specification (ADS) communication ICS / OT
  Oct 5, 2016
• Critical 9.1
  CVE-2014-5414

  Beckhoff Embedded PC Images and TwinCAT Components Improper Restriction of Excessive Authentication Attempts

  Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components do not restrict the number of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.

  Beckhoff TwinCAT Components featuring Automation Device Specification (ADS) communication Embedded PC Images ICS / OT
  Oct 5, 2016
• Critical 9.1
  CVE-2015-1832 EPSS 12%

  Improper Restriction of XML External Entity Reference in Apace Derby

  XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via v…

  org.apache.derby:derby derby derby Debian Ubuntu Maven
  Oct 3, 2016
• Critical 9.8
  CVE-2016-7405

  ADOdb Library SQL Injection

  The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.

  libphp-adodb libphp-adodb adodb/adodb-php Debian Ubuntu Packagist
  Oct 3, 2016
• Critical 9.8
  CVE-2016-5019

  Apache MyFaces Trinidad Deserialization Vulnerability

  CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.

  org.apache.myfaces.trinidad:trinidad Maven
  Oct 3, 2016
• Critical 9.8
  CVE-2016-4436

  Apache Struts improper action name cleanup

  Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up.

  org.apache.struts:struts2-core Maven
  Oct 3, 2016