By publication date

Exploited and new serious CVEs: November 2015

58 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2015-5470No exploit	The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 powerdns · authoritative · CWE-399 Pre-auth Denial of service	High7.8	—	11.2%	Nov 2, 2015
42Plan	CVE-2015-7182No exploit	Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as usedmozilla · firefox · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	10.2%	Nov 5, 2015
19Monitor	CVE-2014-9749No exploit	Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access squid-cache · squid · CWE-264	Medium4.0	—	11.4%	Nov 6, 2015
28Monitor	CVE-2015-7254Proof of concept	Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a ..huawei · hg532e · CWE-22 Pre-auth Path traversal	Medium5.0	—	27.5%	Nov 6, 2015
21Monitor	CVE-2015-4551No exploit	LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format libreoffice · libreoffice · CWE-200 Pre-auth Info leak	Medium4.3	—	13.8%	Nov 10, 2015
31Monitor	CVE-2015-5213No exploit	Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memoryapache · openoffice · CWE-189 pre-auth RCE	Medium6.8	—	12.8%	Nov 10, 2015
41Plan	CVE-2015-2427No exploit	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
42Plan	CVE-2015-2503No exploit	Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Vmicrosoft · access · CWE-264 Pre-auth	Critical9.3	—	16.5%	Nov 11, 2015
48Plan	CVE-2015-6038No exploit	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	35.6%	Nov 11, 2015
21Monitor	CVE-2015-6061No exploit	Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room Sysmicrosoft · lync · CWE-79 Pre-auth XSS	Medium4.3	—	12.8%	Nov 11, 2015
43Plan	CVE-2015-6064No exploit	Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memomicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.8%	Nov 11, 2015
43Plan	CVE-2015-6065No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Nov 11, 2015
41Plan	CVE-2015-6066No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
42Plan	CVE-2015-6068No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.6%	Nov 11, 2015
41Plan	CVE-2015-6069No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
41Plan	CVE-2015-6070No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
43Plan	CVE-2015-6071No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	21.2%	Nov 11, 2015
41Plan	CVE-2015-6072No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
42Plan	CVE-2015-6073No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Nov 11, 2015
41Plan	CVE-2015-6074No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
43Plan	CVE-2015-6075No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Nov 11, 2015
43Plan	CVE-2015-6076No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Nov 11, 2015
43Plan	CVE-2015-6077No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Nov 11, 2015
42Plan	CVE-2015-6078No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Nov 11, 2015
41Plan	CVE-2015-6079No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
41Plan	CVE-2015-6080No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
43Plan	CVE-2015-6081No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Nov 11, 2015
41Plan	CVE-2015-6082No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
42Plan	CVE-2015-6084No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.6%	Nov 11, 2015
42Plan	CVE-2015-6085No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	15.6%	Nov 11, 2015
25Monitor	CVE-2015-6086Proof of concept	Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site,microsoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	25.5%	Nov 11, 2015
41Plan	CVE-2015-6087No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
26Monitor	CVE-2015-6088No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted webmicrosoft · edge · CWE-200 Pre-auth Info leak	Medium4.3	—	30.5%	Nov 11, 2015
41Plan	CVE-2015-6089No exploit	The Microsoft (1) VBScript and (2) JScript engines, as used in Internet Explorer 8 through 11, allow remote attackers to execute arbitrary cmicrosoft · jscript · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Nov 11, 2015
41Plan	CVE-2015-6091No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Word Viewer allow remote attackers microsoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	14.5%	Nov 11, 2015
41Plan	CVE-2015-6092No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, and Wordmicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	14.5%	Nov 11, 2015
43Plan	CVE-2015-6094No exploit	Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on Sharemicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.5%	Nov 11, 2015
35Monitor	CVE-2015-6096No exploit	The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary microsoft · .net framework · CWE-200 Pre-auth XXE Info leak	Medium4.3	—	61.0%	Nov 11, 2015
43Plan	CVE-2015-6097No exploit	Heap-based buffer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows rmicrosoft · windows 7 · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.6%	Nov 11, 2015
31Monitor	CVE-2015-6099No exploit	Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to injmicrosoft · .net framework · CWE-79 Pre-auth XSS	Medium4.3	—	47.5%	Nov 11, 2015
48Plan	CVE-2015-6103Proof of concept	The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wimicrosoft · windows 10 · CWE-20 pre-auth RCE	Critical9.3	—	35.2%	Nov 11, 2015
48Plan	CVE-2015-6104Proof of concept	The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wimicrosoft · windows 10 · CWE-20 pre-auth RCE	Critical9.3	—	35.2%	Nov 11, 2015
21Monitor	CVE-2015-6115No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, akamicrosoft · .net framework · CWE-200 Pre-auth Info leak	Medium4.3	—	13.4%	Nov 11, 2015
20Monitor	CVE-2015-6123No exploit	Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary microsoft · excel for mac · CWE-79 Pre-auth XSS	Medium4.3	—	11.1%	Nov 11, 2015
44Plan	CVE-2015-7652Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 adobe · flash player pre-auth RCE	Critical9.3	—	24.6%	Nov 11, 2015
49Plan	CVE-2015-8043Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 adobe · air pre-auth RCE	Critical10.0	—	29.4%	Nov 11, 2015
52Plan	CVE-2015-8044Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 adobe · air pre-auth RCE	Critical10.0	—	40.6%	Nov 11, 2015
49Plan	CVE-2015-8046Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 adobe · air pre-auth RCE	Critical10.0	—	29.9%	Nov 11, 2015
43Plan	CVE-2015-6093No exploit	Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server microsoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	20.9%	Nov 11, 2015
43Plan	CVE-2015-6045No exploit	Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbimicrosoft · internet explorer pre-auth RCE	Critical9.3	—	19.3%	Nov 12, 2015
33Monitor	CVE-2015-8126No exploit	Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3libpng · libpng · CWE-120 Pre-auth Memory safety	High7.5	—	10.3%	Nov 13, 2015
40Plan	CVE-2015-5311No exploit	PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and servpowerdns · authoritative · CWE-20 Pre-auth Denial of service	Medium5.0	—	67.4%	Nov 17, 2015
41Plan	CVE-2015-7805Proof of concept	Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in opensuse · opensuse · CWE-119 Pre-auth Memory safety	Critical9.3	—	14.2%	Nov 17, 2015
97Now	CVE-2015-4852Weaponized	The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitraryoracle · virtual desktop infrastructure · CWE-502 pre-auth RCE Deserialization	Critical9.8	KEV	94.9%	Nov 18, 2015
42Plan	CVE-2015-7036No exploit	The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitraryapple · mac os x · CWE-20 pre-auth RCE	High7.5	—	39.2%	Nov 21, 2015
54Plan	CVE-2015-7808Weaponized	The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection avbulletin · vbulletin · CWE-20 pre-auth RCE	High7.5	—	80.6%	Nov 24, 2015
67This week	CVE-2015-5317Weaponized	The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name injenkins · jenkins · CWE-200 Pre-auth Info leak	High7.5	KEV	23.0%	Nov 25, 2015
65This week	CVE-2015-8103Weaponized	The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serjenkins · jenkins · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	86.7%	Nov 25, 2015

CVE-2015-5470
34Monitor
The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3
HighCVSS 7.8No exploitEPSS 11%
- Pre-auth
- Denial of service
powerdns · authoritativeNov 2, 2015
CVE-2015-7182
42Plan
Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
- Memory safety
mozilla · firefoxNov 5, 2015
CVE-2014-9749
19Monitor
Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access
MediumCVSS 4.0No exploitEPSS 11%
squid-cache · squidNov 6, 2015
CVE-2015-7254
28Monitor
Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a ..
MediumCVSS 5.0Proof of conceptEPSS 27%
- Pre-auth
- Path traversal
huawei · hg532eNov 6, 2015
CVE-2015-4551
21Monitor
LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 uses the stored LinkUpdateMode configuration information in OpenDocument Format
MediumCVSS 4.3No exploitEPSS 13%
- Pre-auth
- Info leak
libreoffice · libreofficeNov 10, 2015
CVE-2015-5213
31Monitor
Integer overflow in LibreOffice before 4.4.5 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (memory
MediumCVSS 6.8No exploitEPSS 12%
- pre-auth RCE
apache · openofficeNov 10, 2015
CVE-2015-2427
41Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-2503
42Plan
Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, V
CriticalCVSS 9.3No exploitEPSS 16%
- Pre-auth
microsoft · accessNov 11, 2015
CVE-2015-6038
48Plan
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp
CriticalCVSS 9.3No exploitEPSS 35%
- pre-auth RCE
- Memory safety
microsoft · excelNov 11, 2015
CVE-2015-6061
21Monitor
Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room Sys
MediumCVSS 4.3No exploitEPSS 12%
- Pre-auth
- XSS
microsoft · lyncNov 11, 2015
CVE-2015-6064
43Plan
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · edgeNov 11, 2015
CVE-2015-6065
43Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6066
41Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6068
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6069
41Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6070
41Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6071
43Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6072
41Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6073
42Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeNov 11, 2015
CVE-2015-6074
41Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6075
43Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6076
43Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6077
43Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6078
42Plan
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeNov 11, 2015
CVE-2015-6079
41Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6080
41Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6081
43Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6082
41Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6084
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6085
42Plan
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6086
25Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site,
MediumCVSS 4.3Proof of conceptEPSS 25%
- Pre-auth
- Info leak
microsoft · internet explorerNov 11, 2015
CVE-2015-6087
41Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerNov 11, 2015
CVE-2015-6088
26Monitor
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web
MediumCVSS 4.3No exploitEPSS 30%
- Pre-auth
- Info leak
microsoft · edgeNov 11, 2015
CVE-2015-6089
41Plan
The Microsoft (1) VBScript and (2) JScript engines, as used in Internet Explorer 8 through 11, allow remote attackers to execute arbitrary c
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · jscriptNov 11, 2015
CVE-2015-6091
41Plan
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, and Word Viewer allow remote attackers
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · officeNov 11, 2015
CVE-2015-6092
41Plan
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Office Compatibility Pack SP3, and Word
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · officeNov 11, 2015
CVE-2015-6094
43Plan
Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on Share
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · excelNov 11, 2015
CVE-2015-6096
35Monitor
The XML DTD parser in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to read arbitrary
MediumCVSS 4.3No exploitEPSS 61%
- Pre-auth
- XXE
- Info leak
microsoft · .net frameworkNov 11, 2015
CVE-2015-6097
43Plan
Heap-based buffer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows r
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · windows 7Nov 11, 2015
CVE-2015-6099
31Monitor
Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inj
MediumCVSS 4.3No exploitEPSS 47%
- Pre-auth
- XSS
microsoft · .net frameworkNov 11, 2015
CVE-2015-6103
48Plan
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
CriticalCVSS 9.3Proof of conceptEPSS 35%
- pre-auth RCE
microsoft · windows 10Nov 11, 2015
CVE-2015-6104
48Plan
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Wi
CriticalCVSS 9.3Proof of conceptEPSS 35%
- pre-auth RCE
microsoft · windows 10Nov 11, 2015
CVE-2015-6115
21Monitor
Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka
MediumCVSS 4.3No exploitEPSS 13%
- Pre-auth
- Info leak
microsoft · .net frameworkNov 11, 2015
CVE-2015-6123
20Monitor
Cross-site scripting (XSS) vulnerability in Microsoft Excel for Mac 2011 and Excel 2016 for Mac allows remote attackers to inject arbitrary
MediumCVSS 4.3No exploitEPSS 11%
- Pre-auth
- XSS
microsoft · excel for macNov 11, 2015
CVE-2015-7652
44Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548
CriticalCVSS 9.3Proof of conceptEPSS 24%
- pre-auth RCE
adobe · flash playerNov 11, 2015
CVE-2015-8043
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548
CriticalCVSS 10.0Proof of conceptEPSS 29%
- pre-auth RCE
adobe · airNov 11, 2015
CVE-2015-8044
52Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548
CriticalCVSS 10.0Proof of conceptEPSS 40%
- pre-auth RCE
adobe · airNov 11, 2015
CVE-2015-8046
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548
CriticalCVSS 10.0Proof of conceptEPSS 29%
- pre-auth RCE
adobe · airNov 11, 2015
CVE-2015-6093
43Plan
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · officeNov 11, 2015
CVE-2015-6045
43Plan
Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbi
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
microsoft · internet explorerNov 12, 2015
CVE-2015-8126
33Monitor
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3
HighCVSS 7.5No exploitEPSS 10%
- Pre-auth
- Memory safety
libpng · libpngNov 13, 2015
CVE-2015-5311
40Plan
PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and serv
MediumCVSS 5.0No exploitEPSS 67%
- Pre-auth
- Denial of service
powerdns · authoritativeNov 17, 2015
CVE-2015-7805
41Plan
Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in
CriticalCVSS 9.3Proof of conceptEPSS 14%
- Pre-auth
- Memory safety
opensuse · opensuseNov 17, 2015
CVE-2015-4852
97Now
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary
CriticalCVSS 9.8KEVWeaponizedEPSS 94%
- pre-auth RCE
- Deserialization
oracle · virtual desktop infrastructureNov 18, 2015
CVE-2015-7036
42Plan
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary
HighCVSS 7.5No exploitEPSS 39%
- pre-auth RCE
apple · mac os xNov 21, 2015
CVE-2015-7808
54Plan
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection a
HighCVSS 7.5WeaponizedEPSS 80%
- pre-auth RCE
vbulletin · vbulletinNov 24, 2015
CVE-2015-5317
67This week
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name in
HighCVSS 7.5KEVWeaponizedEPSS 23%
- Pre-auth
- Info leak
jenkins · jenkinsNov 25, 2015
CVE-2015-8103
65This week
The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted ser
CriticalCVSS 9.8WeaponizedEPSS 86%
- pre-auth RCE
- Deserialization
jenkins · jenkinsNov 25, 2015