By publication date

Exploited and new serious CVEs: December 2015

96 records · 4 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
38Monitor	CVE-2015-3193No exploit	The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by thopenssl · openssl · CWE-200 Pre-auth Info leak	High7.5	—	25.1%	Dec 6, 2015
43Plan	CVE-2015-3194Proof of concept	crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL poiopenssl · openssl · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	44.0%	Dec 6, 2015
33Monitor	CVE-2015-3195Proof of concept	The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.openssl · openssl · CWE-200 Pre-auth Info leak Denial of service	Medium5.3	—	38.7%	Dec 6, 2015
21Monitor	CVE-2015-3196No exploit	ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes thopenssl · openssl · CWE-362 Pre-auth Race condition Denial of service	Medium4.3	—	13.5%	Dec 6, 2015
63This week	CVE-2015-5287Weaponized	The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privredhat · automatic bug reporting tool · CWE-59 Local privilege escalation	High7.8	KEV	5.0%	Dec 7, 2015
57Plan	CVE-2015-3628Weaponized	The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6,f5 · big-iq security · CWE-264	Critical9.0	—	69.2%	Dec 7, 2015
41Plan	CVE-2015-6040No exploit	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remomicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.6%	Dec 9, 2015
43Plan	CVE-2015-6083No exploit	Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
42Plan	CVE-2015-6106No exploit	The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Bmicrosoft · live meeting · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	17.3%	Dec 9, 2015
42Plan	CVE-2015-6107No exploit	The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows microsoft · live meeting · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.2%	Dec 9, 2015
45Plan	CVE-2015-6108No exploit	The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows microsoft · live meeting · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	25.9%	Dec 9, 2015
23Monitor	CVE-2015-6114No exploit	Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Micmicrosoft · silverlight · CWE-200 Pre-auth Info leak	Medium4.3	—	19.1%	Dec 9, 2015
41Plan	CVE-2015-6118No exploit	Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoftmicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.6%	Dec 9, 2015
41Plan	CVE-2015-6122No exploit	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.6%	Dec 9, 2015
41Plan	CVE-2015-6124No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attmicrosoft · office · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.7%	Dec 9, 2015
46Plan	CVE-2015-6125No exploit	Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote attmicrosoft · windows server 2008 pre-auth RCE	Critical9.3	—	29.6%	Dec 9, 2015
40Plan	CVE-2015-6127Weaponized	Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary filmicrosoft · windows 7 · CWE-200 Pre-auth Info leak	Medium4.3	—	46.0%	Dec 9, 2015
53Plan	CVE-2015-6128Weaponized	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gamicrosoft · windows 7 · CWE-20 RCE Local privilege escalation	High7.2	—	81.8%	Dec 9, 2015
43Plan	CVE-2015-6130No exploit	Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code vmicrosoft · windows 7 · CWE-189 pre-auth RCE	Critical9.3	—	20.7%	Dec 9, 2015
46Plan	CVE-2015-6131Proof of concept	Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary microsoft · windows 7 · CWE-20 pre-auth RCE	Critical9.3	—	30.5%	Dec 9, 2015
53Plan	CVE-2015-6132Weaponized	Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Winmicrosoft · windows 10 · CWE-264 RCE Local privilege escalation	High7.2	—	84.7%	Dec 9, 2015
48Plan	CVE-2015-6133Weaponized	Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library lmicrosoft · windows 10 · CWE-264 RCE Local privilege escalation	High7.2	—	66.5%	Dec 9, 2015
43Plan	CVE-2015-6134No exploit	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
27Monitor	CVE-2015-6135No exploit	The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, almicrosoft · jscript · CWE-200 Pre-auth Info leak	Medium5.0	—	23.4%	Dec 9, 2015
44Plan	CVE-2015-6136No exploit	The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, almicrosoft · jscript · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	24.7%	Dec 9, 2015
21Monitor	CVE-2015-6138No exploit	Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site microsoft · internet explorer · CWE-79 Pre-auth XSS	Medium4.3	—	12.0%	Dec 9, 2015
42Plan	CVE-2015-6139No exploit	Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in microsoft · edge · CWE-264 pre-auth RCE	Critical9.3	—	15.4%	Dec 9, 2015
42Plan	CVE-2015-6140No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Dec 9, 2015
43Plan	CVE-2015-6141No exploit	Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craftmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
43Plan	CVE-2015-6142No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.5%	Dec 9, 2015
43Plan	CVE-2015-6143No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
21Monitor	CVE-2015-6144No exploit	Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to bymicrosoft · internet explorer · CWE-79 Pre-auth XSS	Medium4.3	—	13.4%	Dec 9, 2015
41Plan	CVE-2015-6145No exploit	Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Dec 9, 2015
41Plan	CVE-2015-6146No exploit	Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Dec 9, 2015
43Plan	CVE-2015-6147No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
43Plan	CVE-2015-6148No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Dec 9, 2015
43Plan	CVE-2015-6149No exploit	Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via amicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
43Plan	CVE-2015-6150No exploit	Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
43Plan	CVE-2015-6151No exploit	Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Dec 9, 2015
47Plan	CVE-2015-6152Proof of concept	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	34.4%	Dec 9, 2015
42Plan	CVE-2015-6153No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Dec 9, 2015
42Plan	CVE-2015-6154No exploit	Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Dec 9, 2015
42Plan	CVE-2015-6155No exploit	Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memomicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Dec 9, 2015
41Plan	CVE-2015-6156No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Dec 9, 2015
22Monitor	CVE-2015-6157No exploit	Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Intemicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	16.3%	Dec 9, 2015
42Plan	CVE-2015-6158No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	16.5%	Dec 9, 2015
43Plan	CVE-2015-6159No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	19.4%	Dec 9, 2015
43Plan	CVE-2015-6160No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	18.4%	Dec 9, 2015
23Monitor	CVE-2015-6161No exploit	Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted webmicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium4.3	—	19.3%	Dec 9, 2015
41Plan	CVE-2015-6162No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.0%	Dec 9, 2015
31Monitor	CVE-2015-6164No exploit	Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attackmicrosoft · internet explorer · CWE-20 Pre-auth XSS	Medium6.8	—	11.6%	Dec 9, 2015
22Monitor	CVE-2015-6165No exploit	Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Micmicrosoft · silverlight · CWE-200 Pre-auth Info leak	Medium4.3	—	16.3%	Dec 9, 2015
41Plan	CVE-2015-6166No exploit	Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds remicrosoft · silverlight · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	14.1%	Dec 9, 2015
46Plan	CVE-2015-6168Proof of concept	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	30.7%	Dec 9, 2015
53Plan	CVE-2015-6172No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allowmicrosoft · office · CWE-20 pre-auth RCE	Critical9.3	—	53.8%	Dec 9, 2015
63This week	CVE-2015-6175Weaponized	The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevatiomicrosoft · windows 10 1507 Local privilege escalation	High7.8	KEV	5.1%	Dec 9, 2015
21Monitor	CVE-2015-6176Proof of concept	Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protectionmicrosoft · edge · CWE-79 Pre-auth XSS	Medium4.3	—	14.1%	Dec 9, 2015
41Plan	CVE-2015-6177No exploit	Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Offmicrosoft · excel · CWE-119 pre-auth RCE Memory safety	Critical9.3	—	13.6%	Dec 9, 2015
49Plan	CVE-2015-8048Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air sdk pre-auth RCE	Critical10.0	—	31.6%	Dec 10, 2015
49Plan	CVE-2015-8410Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	31.6%	Dec 10, 2015
49Plan	CVE-2015-8411Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	31.6%	Dec 10, 2015
49Plan	CVE-2015-8412Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air pre-auth RCE	Critical10.0	—	31.6%	Dec 10, 2015
49Plan	CVE-2015-8413Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air pre-auth RCE	Critical10.0	—	31.6%	Dec 10, 2015
53Plan	CVE-2015-8420Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8421Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8422Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8423Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air sdk pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8424Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8425Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8426Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8427Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8428Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8429Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8430Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · air pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8431Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
53Plan	CVE-2015-8434Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	Critical10.0	—	43.4%	Dec 10, 2015
30Monitor	CVE-2015-7039Proof of concept	Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to exeapple · tvos · CWE-119 pre-auth RCE Memory safety	Medium6.8	—	11.2%	Dec 11, 2015
30Monitor	CVE-2015-7803No exploit	The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial ophp · php Pre-auth	Medium6.8	—	10.2%	Dec 11, 2015
45Plan	CVE-2015-6420Proof of concept	Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Serapache · commons collections · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	18.7%	Dec 15, 2015
36Monitor	CVE-2015-8000No exploit	db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE asseisc · bind · CWE-20 Pre-auth Denial of service	Medium5.0	—	54.6%	Dec 16, 2015
59Plan	CVE-2015-8562Weaponized	Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via tjoomla · joomla\! · CWE-20 pre-auth RCE	High7.5	—	98.2%	Dec 16, 2015
33Monitor	CVE-2015-8327No exploit	Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x aredhat · enterprise linux desktop pre-auth RCE	High7.5	—	10.5%	Dec 17, 2015
87Now	CVE-2015-7755Weaponized	Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 beforejuniper · screenos · CWE-287 Pre-auth Auth bypass	Critical9.8	KEV	61.1%	Dec 19, 2015
47Plan	CVE-2015-7919No exploit	SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crasearchblox · searchblox · CWE-264 Pre-auth	Critical10.0	—	21.9%	Dec 21, 2015
40Plan	CVE-2015-8660Weaponized	The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allolinux · linux kernel · CWE-264	Medium6.7	—	22.2%	Dec 28, 2015
43Plan	CVE-2015-8634Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	High8.8	—	25.4%	Dec 28, 2015
43Plan	CVE-2015-8635Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2adobe · flash player pre-auth RCE	High8.8	—	25.4%	Dec 28, 2015
41Plan	CVE-2015-8636Proof of concept	Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR befadobe · air · CWE-119 pre-auth RCE Memory safety	High8.8	—	21.3%	Dec 28, 2015
43Plan	CVE-2015-8644Proof of concept	Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR befadobe · flash player pre-auth RCE	High8.8	—	26.1%	Dec 28, 2015
85Now	CVE-2015-8651Weaponized	Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on adobe · air sdk · CWE-190 pre-auth RCE Memory safety	High8.8	KEV	67.6%	Dec 28, 2015
32Monitor	CVE-2015-5252No exploit	vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relatisamba · samba · CWE-264 Pre-auth	High7.2	—	13.2%	Dec 29, 2015
25Monitor	CVE-2015-5299No exploit	The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3samba · samba · CWE-200 Pre-auth Info leak	Medium5.3	—	13.5%	Dec 29, 2015
35Monitor	CVE-2015-7250Proof of concept	Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackzte · zxhn h108n r1a firmware · CWE-22 Pre-auth Path traversal	High7.5	—	15.5%	Dec 30, 2015
42Plan	CVE-2015-7251Proof of concept	ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attazte · zxhn h108n r1a firmware · CWE-255 Pre-auth Hard-coded credentials	Critical9.8	—	10.6%	Dec 30, 2015
45Plan	CVE-2015-5995Proof of concept	Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administenda · n3 wireless n150 · CWE-264 Pre-auth	Critical9.8	—	19.0%	Dec 31, 2015
45Plan	CVE-2015-6018Proof of concept	The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbizyxel · pmg5318-b20a firmware · CWE-264 pre-auth RCE	Critical9.8	—	20.7%	Dec 31, 2015

CVE-2015-3193
38Monitor
The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by th
HighCVSS 7.5No exploitEPSS 25%
- Pre-auth
- Info leak
openssl · opensslDec 6, 2015
CVE-2015-3194
43Plan
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL poi
HighCVSS 7.5Proof of conceptEPSS 44%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslDec 6, 2015
CVE-2015-3195
33Monitor
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.
MediumCVSS 5.3Proof of conceptEPSS 38%
- Pre-auth
- Info leak
- Denial of service
openssl · opensslDec 6, 2015
CVE-2015-3196
21Monitor
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes th
MediumCVSS 4.3No exploitEPSS 13%
- Pre-auth
- Race condition
- Denial of service
openssl · opensslDec 6, 2015
CVE-2015-5287
63This week
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain priv
HighCVSS 7.8KEVWeaponizedEPSS 5%
- Local privilege escalation
redhat · automatic bug reporting toolDec 7, 2015
CVE-2015-3628
57Plan
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6,
CriticalCVSS 9.0WeaponizedEPSS 69%
f5 · big-iq securityDec 7, 2015
CVE-2015-6040
41Plan
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remo
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · excelDec 9, 2015
CVE-2015-6083
43Plan
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6106
42Plan
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for B
CriticalCVSS 9.3No exploitEPSS 17%
- pre-auth RCE
- Memory safety
microsoft · live meetingDec 9, 2015
CVE-2015-6107
42Plan
The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · live meetingDec 9, 2015
CVE-2015-6108
45Plan
The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows
CriticalCVSS 9.3No exploitEPSS 25%
- pre-auth RCE
- Memory safety
microsoft · live meetingDec 9, 2015
CVE-2015-6114
23Monitor
Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Mic
MediumCVSS 4.3No exploitEPSS 19%
- Pre-auth
- Info leak
microsoft · silverlightDec 9, 2015
CVE-2015-6118
41Plan
Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · officeDec 9, 2015
CVE-2015-6122
41Plan
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to exec
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · excelDec 9, 2015
CVE-2015-6124
41Plan
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote att
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · officeDec 9, 2015
CVE-2015-6125
46Plan
Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote att
CriticalCVSS 9.3No exploitEPSS 29%
- pre-auth RCE
microsoft · windows server 2008Dec 9, 2015
CVE-2015-6127
40Plan
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary fil
MediumCVSS 4.3WeaponizedEPSS 46%
- Pre-auth
- Info leak
microsoft · windows 7Dec 9, 2015
CVE-2015-6128
53Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to ga
HighCVSS 7.2WeaponizedEPSS 81%
- RCE
- Local privilege escalation
microsoft · windows 7Dec 9, 2015
CVE-2015-6130
43Plan
Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code v
CriticalCVSS 9.3No exploitEPSS 20%
- pre-auth RCE
microsoft · windows 7Dec 9, 2015
CVE-2015-6131
46Plan
Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary
CriticalCVSS 9.3Proof of conceptEPSS 30%
- pre-auth RCE
microsoft · windows 7Dec 9, 2015
CVE-2015-6132
53Plan
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Win
HighCVSS 7.2WeaponizedEPSS 84%
- RCE
- Local privilege escalation
microsoft · windows 10Dec 9, 2015
CVE-2015-6133
48Plan
Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library l
HighCVSS 7.2WeaponizedEPSS 66%
- RCE
- Local privilege escalation
microsoft · windows 10Dec 9, 2015
CVE-2015-6134
43Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6135
27Monitor
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al
MediumCVSS 5.0No exploitEPSS 23%
- Pre-auth
- Info leak
microsoft · jscriptDec 9, 2015
CVE-2015-6136
44Plan
The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al
CriticalCVSS 9.3No exploitEPSS 24%
- pre-auth RCE
- Memory safety
microsoft · jscriptDec 9, 2015
CVE-2015-6138
21Monitor
Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site
MediumCVSS 4.3No exploitEPSS 12%
- Pre-auth
- XSS
microsoft · internet explorerDec 9, 2015
CVE-2015-6139
42Plan
Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in
CriticalCVSS 9.3No exploitEPSS 15%
- pre-auth RCE
microsoft · edgeDec 9, 2015
CVE-2015-6140
42Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6141
43Plan
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6142
43Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6143
43Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6144
21Monitor
Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to by
MediumCVSS 4.3No exploitEPSS 13%
- Pre-auth
- XSS
microsoft · internet explorerDec 9, 2015
CVE-2015-6145
41Plan
Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6146
41Plan
Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6147
43Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6148
43Plan
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6149
43Plan
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6150
43Plan
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6151
43Plan
Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6152
47Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3Proof of conceptEPSS 34%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6153
42Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6154
42Plan
Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6155
42Plan
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6156
41Plan
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6157
22Monitor
Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Inte
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
- Info leak
microsoft · internet explorerDec 9, 2015
CVE-2015-6158
42Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6159
43Plan
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
CriticalCVSS 9.3No exploitEPSS 19%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6160
43Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6161
23Monitor
Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web
MediumCVSS 4.3No exploitEPSS 19%
- Pre-auth
- Info leak
microsoft · internet explorerDec 9, 2015
CVE-2015-6162
41Plan
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerDec 9, 2015
CVE-2015-6164
31Monitor
Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attack
MediumCVSS 6.8No exploitEPSS 11%
- Pre-auth
- XSS
microsoft · internet explorerDec 9, 2015
CVE-2015-6165
22Monitor
Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Mic
MediumCVSS 4.3No exploitEPSS 16%
- Pre-auth
- Info leak
microsoft · silverlightDec 9, 2015
CVE-2015-6166
41Plan
Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds re
CriticalCVSS 9.3No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · silverlightDec 9, 2015
CVE-2015-6168
46Plan
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
CriticalCVSS 9.3Proof of conceptEPSS 30%
- pre-auth RCE
- Memory safety
microsoft · edgeDec 9, 2015
CVE-2015-6172
53Plan
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow
CriticalCVSS 9.3No exploitEPSS 53%
- pre-auth RCE
microsoft · officeDec 9, 2015
CVE-2015-6175
63This week
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevatio
HighCVSS 7.8KEVWeaponizedEPSS 5%
- Local privilege escalation
microsoft · windows 10 1507Dec 9, 2015
CVE-2015-6176
21Monitor
Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection
MediumCVSS 4.3Proof of conceptEPSS 14%
- Pre-auth
- XSS
microsoft · edgeDec 9, 2015
CVE-2015-6177
41Plan
Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Off
CriticalCVSS 9.3No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · excelDec 9, 2015
CVE-2015-8048
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 31%
- pre-auth RCE
adobe · air sdkDec 10, 2015
CVE-2015-8410
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 31%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8411
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 31%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8412
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 31%
- pre-auth RCE
adobe · airDec 10, 2015
CVE-2015-8413
49Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 31%
- pre-auth RCE
adobe · airDec 10, 2015
CVE-2015-8420
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8421
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8422
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8423
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · air sdkDec 10, 2015
CVE-2015-8424
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8425
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · airDec 10, 2015
CVE-2015-8426
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8427
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8428
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8429
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8430
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · airDec 10, 2015
CVE-2015-8431
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-8434
53Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2
CriticalCVSS 10.0Proof of conceptEPSS 43%
- pre-auth RCE
adobe · flash playerDec 10, 2015
CVE-2015-7039
30Monitor
Buffer overflow in libc in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to exe
MediumCVSS 6.8Proof of conceptEPSS 11%
- pre-auth RCE
- Memory safety
apple · tvosDec 11, 2015
CVE-2015-7803
30Monitor
The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial o
MediumCVSS 6.8No exploitEPSS 10%
- Pre-auth
php · phpDec 11, 2015
CVE-2015-6420
45Plan
Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Ser
CriticalCVSS 9.8Proof of conceptEPSS 18%
- pre-auth RCE
- Deserialization
apache · commons collectionsDec 15, 2015
CVE-2015-8000
36Monitor
db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE asse
MediumCVSS 5.0No exploitEPSS 54%
- Pre-auth
- Denial of service
isc · bindDec 16, 2015
CVE-2015-8562
59Plan
Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via t
HighCVSS 7.5WeaponizedEPSS 98%
- pre-auth RCE
joomla · joomla\!Dec 16, 2015
CVE-2015-8327
33Monitor
Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x a
HighCVSS 7.5No exploitEPSS 10%
- pre-auth RCE
redhat · enterprise linux desktopDec 17, 2015
CVE-2015-7755
87Now
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before
CriticalCVSS 9.8KEVWeaponizedEPSS 61%
- Pre-auth
- Auth bypass
juniper · screenosDec 19, 2015
CVE-2015-7919
47Plan
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application cra
CriticalCVSS 10.0No exploitEPSS 21%
- Pre-auth
searchblox · searchbloxDec 21, 2015
CVE-2015-8660
40Plan
The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allo
MediumCVSS 6.7WeaponizedEPSS 22%
linux · linux kernelDec 28, 2015
CVE-2015-8634
43Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2
HighCVSS 8.8Proof of conceptEPSS 25%
- pre-auth RCE
adobe · flash playerDec 28, 2015
CVE-2015-8635
43Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2
HighCVSS 8.8Proof of conceptEPSS 25%
- pre-auth RCE
adobe · flash playerDec 28, 2015
CVE-2015-8636
41Plan
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 21%
- pre-auth RCE
- Memory safety
adobe · airDec 28, 2015
CVE-2015-8644
43Plan
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR bef
HighCVSS 8.8Proof of conceptEPSS 26%
- pre-auth RCE
adobe · flash playerDec 28, 2015
CVE-2015-8651
85Now
Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on
HighCVSS 8.8KEVWeaponizedEPSS 67%
- pre-auth RCE
- Memory safety
adobe · air sdkDec 28, 2015
CVE-2015-5252
32Monitor
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relati
HighCVSS 7.2No exploitEPSS 13%
- Pre-auth
samba · sambaDec 29, 2015
CVE-2015-5299
25Monitor
The shadow_copy2_get_shadow_copy_data function in modules/vfs_shadow_copy2.c in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3
MediumCVSS 5.3No exploitEPSS 13%
- Pre-auth
- Info leak
samba · sambaDec 29, 2015
CVE-2015-7250
35Monitor
Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attack
HighCVSS 7.5Proof of conceptEPSS 15%
- Pre-auth
- Path traversal
zte · zxhn h108n r1a firmwareDec 30, 2015
CVE-2015-7251
42Plan
ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote atta
CriticalCVSS 9.8Proof of conceptEPSS 10%
- Pre-auth
- Hard-coded credentials
zte · zxhn h108n r1a firmwareDec 30, 2015
CVE-2015-5995
45Plan
Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain adminis
CriticalCVSS 9.8Proof of conceptEPSS 19%
- Pre-auth
tenda · n3 wireless n150Dec 31, 2015
CVE-2015-6018
45Plan
The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbi
CriticalCVSS 9.8Proof of conceptEPSS 20%
- pre-auth RCE
zyxel · pmg5318-b20a firmwareDec 31, 2015