Mon, Mar 13 · 06:59 AM CDTCVE-2017-5674
9.8/10 · Must read/watchNVDvuln
Summary
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login p
CVECVE-2017-5674
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 13 · 06:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2017-5648
9.1/10 · Must read/watchNVDvuln
Summary
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for
CVECVE-2017-5648
SeverityCRITICAL
TypeUPDATED
PublishedMon, Apr 17 · 04:59 PM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0483
10.0/10 · Must read/watchNVDvuln
Summary
Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party cl
CVECVE-2016-0483
SeverityHIGH
TypeUPDATED
PublishedThu, Jan 21 · 03:00 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0494
10.0/10 · Must read/watchNVDvuln
Summary
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVECVE-2016-0494
SeverityHIGH
TypeUPDATED
PublishedThu, Jan 21 · 03:00 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0714
8.8/10 · Worth your timeNVDvuln
Summary
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web app
CVECVE-2016-0714
SeverityHIGH
TypeUPDATED
PublishedThu, Feb 25 · 01:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-1182
8.2/10 · Worth your timeNVDvuln
Summary
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
CVECVE-2016-1182
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 04 · 10:59 PM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-1181
8.1/10 · Worth your timeNVDvuln
Summary
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVECVE-2016-1181
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 04 · 10:59 PM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-5388
8.1/10 · Worth your timeNVDvuln
Summary
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound
CVECVE-2016-5388
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 19 · 02:00 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0010
7.8/10 · Worth your timeNVDvuln
Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, Excel 2016 for Mac, PowerPoint 2016 for Mac, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted Office document, ak
CVECVE-2016-0010
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 13 · 05:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0035
7.8/10 · Worth your timeNVDvuln
Summary
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVECVE-2016-0035
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 13 · 05:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0055
7.8/10 · Worth your timeNVDvuln
Summary
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVECVE-2016-0055
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 10 · 11:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-3313
7.8/10 · Worth your timeNVDvuln
Summary
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016, Word 2016 for Mac, and Word Viewer allow remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Office Memory Corruption Vulnerability."
CVECVE-2016-3313
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 09 · 09:59 PM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-3357
7.8/10 · Worth your timeNVDvuln
Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2013 SP1, Excel Automation Services on SharePoint Server 2013 SP1, Word Automation Services on ShareP
CVECVE-2016-3357
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 14 · 10:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0025
7.3/10 · Worth your timeNVDvuln
Summary
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2,
CVECVE-2016-0025
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 16 · 01:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-3233
7.3/10 · Worth your timeNVDvuln
Summary
Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVECVE-2016-3233
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 16 · 01:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-10165
7.1/10 · Worth your timeNVDvuln
Summary
The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggers an out-of-bounds heap read.
CVECVE-2016-10165
SeverityHIGH
TypeUPDATED
PublishedFri, Feb 03 · 07:59 PM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-7276
7.1/10 · Worth your timeNVDvuln
Summary
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office for Mac 2011, and Office 2016 for Mac allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."
CVECVE-2016-7276
SeverityHIGH
TypeUPDATED
PublishedTue, Dec 20 · 06:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0141
6.5/10 · Skim only if relevantNVDvuln
Summary
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."
CVECVE-2016-0141
SeverityMEDIUM
TypeUPDATED
PublishedWed, Sep 14 · 10:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0763
6.3/10 · Skim only if relevantNVDvuln
Summary
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManag
CVECVE-2016-0763
SeverityMEDIUM
TypeUPDATED
PublishedThu, Feb 25 · 01:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0475
5.8/10 · Skim only if relevantNVDvuln
Summary
Unspecified vulnerability in the Java SE, Java SE Embedded, and JRockit components in Oracle Java SE 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.
CVECVE-2016-0475
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jan 21 · 03:00 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-3234
5.5/10 · Skim only if relevantNVDvuln
Summary
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to obtain sensitive in
CVECVE-2016-3234
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jun 16 · 01:59 AM CDT
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-7244
5.5/10 · Skim only if relevantNVDvuln
Summary
Microsoft Office 2007 SP3 allows remote attackers to cause a denial of service (application hang) via a crafted Office document, aka "Microsoft Office Denial of Service Vulnerability."
CVECVE-2016-7244
SeverityMEDIUM
TypeUPDATED
PublishedThu, Nov 10 · 06:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-2016-0011
5.4/10 · Skim only if relevantNVDvuln
Summary
Microsoft SharePoint Server 2013 SP1 and SharePoint Foundation 2013 SP1 allow remote authenticated users to bypass intended Access Control Policy restrictions and conduct cross-site scripting (XSS) attacks by modifying a webpart, aka "Microsoft SharePoint Security Feature Bypass," a different vulnerability than CVE-201
CVECVE-2016-0011
SeverityMEDIUM
TypeUPDATED
PublishedWed, Jan 13 · 05:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
CVE-1999-0632
5.3/10 · Skim only if relevantNVDvuln
Summary
The RPC portmapper service is running.
CVECVE-1999-0632
SeverityMEDIUM
TypeUPDATED
PublishedFri, Jan 01 · 05:00 AM CST
ModifiedThu, Oct 15 · 10:17 PM CDT
CVE-2016-0402
5.0/10 · Skim only if relevantNVDvuln
Summary
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect integrity via unknown vectors related to Networking.
CVECVE-2016-0402
SeverityMEDIUM
TypeUPDATED
PublishedThu, Jan 21 · 02:59 AM CST
ModifiedThu, Oct 15 · 04:17 PM CDT
