Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2016

54 records · 2 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2015-7450
    98Now

    Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allo

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    ibm · sterling b2b integratorJan 2, 2016

  • CVE-2015-5254
    50Plan

    Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execu

    CriticalCVSS 9.8Proof of conceptEPSS 38%

    apache · activemqJan 8, 2016

  • CVE-2015-5259
    51Plan

    Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to e

    HighCVSS 8.6No exploitEPSS 57%

    apache · subversionJan 8, 2016

  • CVE-2015-8612
    40Plan

    The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges

    HighCVSS 8.4WeaponizedEPSS 6%

    blueman project · bluemanJan 8, 2016

  • CVE-2015-8668
    43Plan

    Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attack

    CriticalCVSS 9.8No exploitEPSS 13%

    libtiff · libtiffJan 8, 2016

  • CVE-2015-4694
    39Monitor

    Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read a

    HighCVSS 8.6Proof of conceptEPSS 15%

    zip attachments project · zip attachmentsJan 8, 2016

  • CVE-2015-5471
    31Monitor

    Absolute path traversal vulnerability in include/user/download.php in the Swim Team plugin 1.44.10777 for WordPress allows remote attackers

    MediumCVSS 5.3Proof of conceptEPSS 32%

    swim team project · swim teamJan 12, 2016

  • CVE-2015-8396
    45Plan

    Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICO

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    malaterre · grassroots dicomJan 12, 2016

  • CVE-2016-0002
    37Monitor

    The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al

    HighCVSS 7.5No exploitEPSS 23%

    microsoft · jscriptJan 13, 2016

  • CVE-2016-0003
    49Plan

    Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Microsoft Edge Memory Corruption Vulnerabilit

    CriticalCVSS 9.6No exploitEPSS 37%

    microsoft · edgeJan 13, 2016

  • CVE-2016-0005
    25Monitor

    Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Exp

    MediumCVSS 4.3No exploitEPSS 27%

    microsoft · internet explorerJan 13, 2016

  • CVE-2016-0008
    21Monitor

    The graphics device interface in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Win

    MediumCVSS 4.3No exploitEPSS 13%

    microsoft · windows 7Jan 13, 2016

  • CVE-2016-0009
    40Plan

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 10 Gold and 1511 allow remote attackers to execu

    HighCVSS 8.8No exploitEPSS 15%

    microsoft · windows 10Jan 13, 2016

  • CVE-2016-0015
    46Plan

    DirectShow in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go

    HighCVSS 7.8Proof of conceptEPSS 49%

    microsoft · windows 10Jan 13, 2016

  • CVE-2016-0016
    40Plan

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Win

    HighCVSS 7.8Proof of conceptEPSS 29%

    microsoft · windows 10Jan 13, 2016

  • CVE-2016-0018
    33Monitor

    Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows lo

    HighCVSS 7.3No exploitEPSS 13%

    microsoft · windows 10Jan 13, 2016

  • CVE-2016-0019
    36Monitor

    The Remote Desktop Protocol (RDP) service implementation in Microsoft Windows 10 Gold and 1511 allows remote attackers to bypass intended ac

    HighCVSS 8.1No exploitEPSS 12%

    microsoft · windows 10Jan 13, 2016

  • CVE-2016-0024
    40Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Scripting Eng

    HighCVSS 8.8No exploitEPSS 17%

    microsoft · edgeJan 13, 2016

  • CVE-2016-0034
    86Now

    Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary c

    HighCVSS 8.8KEVWeaponizedEPSS 69%

    microsoft · silverlightJan 13, 2016

  • CVE-2016-0010
    37Monitor

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Excel for Mac 2011, PowerPoint for Mac 2011, W

    HighCVSS 7.8No exploitEPSS 21%

    microsoft · excel for macJan 13, 2016

  • CVE-2016-0012
    20Monitor

    Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2

    MediumCVSS 4.3No exploitEPSS 10%

    microsoft · excelJan 13, 2016

  • CVE-2016-0035
    38Monitor

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp

    HighCVSS 7.8No exploitEPSS 22%

    microsoft · excelJan 13, 2016

  • CVE-2015-8605
    51Plan

    ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash

    MediumCVSS 6.5No exploitEPSS 82%

    isc · dhcpJan 14, 2016

  • CVE-2016-0777
    45Plan

    The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensit

    MediumCVSS 6.5Proof of conceptEPSS 63%

    sophos · unified threat management softwareJan 14, 2016

  • CVE-2016-0778
    38Monitor

    The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when certa

    HighCVSS 8.1No exploitEPSS 20%

    oracle · linuxJan 14, 2016

  • CVE-2015-8279
    60This week

    Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script

    HighCVSS 8.6WeaponizedEPSS 51%

    samsung · web viewerJan 14, 2016

  • CVE-2016-0854
    62This week

    Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in

    CriticalCVSS 9.8WeaponizedEPSS 77%

    advantech · webaccessJan 14, 2016

  • CVE-2016-0856
    44Plan

    Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vec

    CriticalCVSS 9.8No exploitEPSS 16%

    advantech · webaccessJan 14, 2016

  • CVE-2016-0857
    47Plan

    Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vect

    CriticalCVSS 9.8No exploitEPSS 28%

    advantech · webaccessJan 14, 2016

  • CVE-2016-1897
    26Monitor

    FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the concat protocol in an HTTP Live Str

    MediumCVSS 5.5No exploitEPSS 14%

    ffmpeg · ffmpegJan 14, 2016

  • CVE-2016-1898
    26Monitor

    FFmpeg 2.x allows remote attackers to conduct cross-origin attacks and read arbitrary files by using the subfile protocol in an HTTP Live St

    MediumCVSS 5.5No exploitEPSS 13%

    ffmpeg · ffmpegJan 14, 2016

  • CVE-2016-1909
    60This week

    Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.

    CriticalCVSS 9.8WeaponizedEPSS 71%

    fortinet · fortiosJan 15, 2016

  • CVE-2015-6836
    32Monitor

    The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage

    HighCVSS 7.3No exploitEPSS 10%

    php · phpJan 19, 2016

  • CVE-2015-8617
    46Plan

    Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers t

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    php · phpJan 19, 2016

  • CVE-2016-1907
    25Monitor

    The ssh_packet_read_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds r

    MediumCVSS 5.3No exploitEPSS 14%

    openbsd · opensshJan 19, 2016

  • CVE-2015-8704
    32Monitor

    apl_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service

    MediumCVSS 6.5No exploitEPSS 20%

    isc · bindJan 20, 2016

  • CVE-2016-0476
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · enterprise manager grid controlJan 20, 2016

  • CVE-2016-0477
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0478
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0480
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0481
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · enterprise manager grid controlJan 20, 2016

  • CVE-2016-0482
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 21%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0484
    27Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 22%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0485
    28Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 27%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0486
    28Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 5.0No exploitEPSS 27%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0487
    40Plan

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.4No exploitEPSS 50%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0488
    45Plan

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.4No exploitEPSS 65%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0489
    42Plan

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.5No exploitEPSS 54%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0490
    33Monitor

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.4No exploitEPSS 27%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0491
    49Plan

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.4WeaponizedEPSS 79%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0492
    53Plan

    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2

    MediumCVSS 6.4WeaponizedEPSS 92%

    oracle · application testing suiteJan 20, 2016

  • CVE-2016-0483
    44Plan

    Unspecified vulnerability in Oracle Java SE 6u105, 7u91, and 8u66; Java SE Embedded 8u65; and JRockit R28.3.8 allows remote attackers to aff

    CriticalCVSS 10.0No exploitEPSS 14%

    oracle · jdkJan 21, 2016

  • CVE-2015-8770
    37Monitor

    Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x bef

    HighCVSS 7.5Proof of conceptEPSS 22%

    roundcube · roundcube webmailJan 29, 2016

  • CVE-2016-1879
    34Monitor

    The Stream Control Transmission Protocol (SCTP) module in FreeBSD 9.3 before p33, 10.1 before p26, and 10.2 before p9, when the kernel is co

    HighCVSS 7.5Proof of conceptEPSS 13%

    freebsd · freebsdJan 29, 2016