By publication date

Exploited and new serious CVEs: March 2016

66 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
60This week	CVE-2016-0800Weaponized	The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify meopenssl · openssl · CWE-200 Pre-auth Info leak	Medium5.9	—	82.1%	Mar 1, 2016
32Monitor	CVE-2016-2278Proof of concept	Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticateschneider-electric · struxureware building operations automation server as · CWE-284 RCE Broken access control (IDOR)	High7.2	—	13.4%	Mar 2, 2016
47Plan	CVE-2016-0705No exploit	Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g aopenssl · openssl Pre-auth	Critical9.8	—	26.3%	Mar 3, 2016
38Monitor	CVE-2016-0797No exploit	Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap openssl · openssl Pre-auth Denial of service	High7.5	—	27.0%	Mar 3, 2016
37Monitor	CVE-2016-0798No exploit	Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to caopenssl · openssl · CWE-399 Pre-auth Denial of service	High7.5	—	24.9%	Mar 3, 2016
49Plan	CVE-2016-0799No exploit	The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, whiopenssl · openssl · CWE-119 Pre-auth Memory safety	Critical9.8	—	32.4%	Mar 3, 2016
55Plan	CVE-2016-2842No exploit	The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memoropenssl · openssl · CWE-119 Pre-auth Memory safety	Critical9.8	—	53.6%	Mar 3, 2016
38Monitor	CVE-2016-0021No exploit	Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Mimicrosoft · infopath · CWE-119 RCE Memory safety	High7.8	—	23.9%	Mar 9, 2016
38Monitor	CVE-2016-0091No exploit	OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windowsmicrosoft · windows 10 · CWE-20 RCE	High7.8	—	23.1%	Mar 9, 2016
48Plan	CVE-2016-0092No exploit	OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windowsmicrosoft · windows 10 · CWE-20 RCE	High7.8	—	57.3%	Mar 9, 2016
41Plan	CVE-2016-0098No exploit	Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remomicrosoft · windows 10 · CWE-20 pre-auth RCE	High8.8	—	19.6%	Mar 9, 2016
72This week	CVE-2016-0099Weaponized	The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2microsoft · windows 10 1507 · CWE-120 Local privilege escalation Memory safety	High7.8	KEV	37.0%	Mar 9, 2016
50Plan	CVE-2016-0100Weaponized	Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted applicamicrosoft · windows server 2008 · CWE-20 RCE Local privilege escalation	High8.4	—	57.1%	Mar 9, 2016
41Plan	CVE-2016-0101No exploit	Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1microsoft · windows 10 · CWE-20 pre-auth RCE	High8.8	—	19.6%	Mar 9, 2016
35Monitor	CVE-2016-0102No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.3%	Mar 9, 2016
34Monitor	CVE-2016-0103No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.1%	Mar 9, 2016
34Monitor	CVE-2016-0104No exploit	Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.0%	Mar 9, 2016
34Monitor	CVE-2016-0105No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.7%	Mar 9, 2016
35Monitor	CVE-2016-0106No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
35Monitor	CVE-2016-0107No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
42Plan	CVE-2016-0108Proof of concept	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	39.1%	Mar 9, 2016
35Monitor	CVE-2016-0109No exploit	Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corrmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.3%	Mar 9, 2016
34Monitor	CVE-2016-0110No exploit	Microsoft Internet Explorer 10 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (microsoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.7%	Mar 9, 2016
42Plan	CVE-2016-0111Proof of concept	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	39.4%	Mar 9, 2016
35Monitor	CVE-2016-0112No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
35Monitor	CVE-2016-0113No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
35Monitor	CVE-2016-0114No exploit	Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafmicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
53Plan	CVE-2016-0117No exploit	The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackmicrosoft · windows 10 · CWE-20 RCE	High7.8	—	71.9%	Mar 9, 2016
41Plan	CVE-2016-0118No exploit	The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Winmicrosoft · windows 10 · CWE-20 RCE	High7.8	—	32.9%	Mar 9, 2016
37Monitor	CVE-2016-0120Proof of concept	The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Servemicrosoft · windows 10 · CWE-20 Pre-auth Denial of service	Medium6.5	—	36.7%	Mar 9, 2016
47Plan	CVE-2016-0121Proof of concept	The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Servemicrosoft · windows 10 · CWE-20 pre-auth RCE	High8.8	—	38.8%	Mar 9, 2016
35Monitor	CVE-2016-0123No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	16.2%	Mar 9, 2016
34Monitor	CVE-2016-0124No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.0%	Mar 9, 2016
16Monitor	CVE-2016-0125No exploit	Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via microsoft · edge · CWE-200 Pre-auth Info leak	Low3.1	—	11.8%	Mar 9, 2016
34Monitor	CVE-2016-0129No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.0%	Mar 9, 2016
34Monitor	CVE-2016-0130No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.0%	Mar 9, 2016
45Plan	CVE-2016-0132No exploit	Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XMLmicrosoft · .net framework · CWE-20 Pre-auth	Critical9.8	—	21.4%	Mar 9, 2016
38Monitor	CVE-2016-0134No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Omicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	22.2%	Mar 9, 2016
44Plan	CVE-2016-0954Proof of concept	Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecifadobe · digital editions · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	18.2%	Mar 9, 2016
45Plan	CVE-2016-2774No exploit	ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remisc · dhcp · CWE-20 Pre-auth Denial of service	Medium5.9	—	73.6%	Mar 9, 2016
36Monitor	CVE-2015-6184No exploit	The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause microsoft · internet explorer pre-auth RCE	High8.1	—	13.9%	Mar 9, 2016
45Plan	CVE-2016-1285No exploit	named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, isc · bind Pre-auth Denial of service	Medium6.8	—	59.1%	Mar 9, 2016
53Plan	CVE-2016-1286No exploit	named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure anisc · bind Pre-auth Denial of service	High8.6	—	62.1%	Mar 9, 2016
34Monitor	CVE-2016-2088No exploit	resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service isc · bind · CWE-20 Pre-auth Denial of service	Medium6.8	—	22.7%	Mar 9, 2016
44Plan	CVE-2016-0997Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	—	28.5%	Mar 12, 2016
43Plan	CVE-2016-0998Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	—	28.3%	Mar 12, 2016
44Plan	CVE-2016-0999Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	—	28.5%	Mar 12, 2016
44Plan	CVE-2016-1000Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before adobe · flash player · CWE-416 pre-auth RCE Memory safety	High8.8	—	28.5%	Mar 12, 2016
43Plan	CVE-2016-1001Proof of concept	Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11adobe · flash player · CWE-787 pre-auth RCE Memory safety	High8.8	—	25.0%	Mar 12, 2016
41Plan	CVE-2016-1002Proof of concept	Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIRadobe · flash player · CWE-119 pre-auth RCE Memory safety	High8.8	—	19.6%	Mar 12, 2016
71This week	CVE-2016-1010Weaponized	Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577adobe · flash player · CWE-190 pre-auth RCE Memory safety	High8.8	KEV	19.3%	Mar 12, 2016
44Plan	CVE-2016-1960Proof of concept	Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7mozilla · firefox pre-auth RCE	High8.8	—	30.9%	Mar 13, 2016
30Monitor	CVE-2015-7560No exploit	The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allowssamba · samba · CWE-284 Broken access control (IDOR)	Medium6.5	—	12.9%	Mar 13, 2016
42Plan	CVE-2016-1988No exploit	HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive ihp · network automation pre-auth RCE	Critical9.8	—	10.5%	Mar 14, 2016
42Plan	CVE-2016-1989No exploit	HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive ihp · network automation pre-auth RCE	Critical9.8	—	10.5%	Mar 14, 2016
36Monitor	CVE-2016-2342No exploit	The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 confquagga · quagga · CWE-119 pre-auth RCE Memory safety	High8.1	—	13.3%	Mar 17, 2016
54Plan	CVE-2016-2345Proof of concept	Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to exedameware · mini remote control · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	51.2%	Mar 17, 2016
42Plan	CVE-2016-1995No exploit	HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.hp · system management homepage pre-auth RCE	Critical9.8	—	10.2%	Mar 18, 2016
36Monitor	CVE-2016-3115Proof of concept	Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended sheopenbsd · openssh · CWE-93	Medium6.4	—	35.5%	Mar 22, 2016
31Monitor	CVE-2016-3116Proof of concept	CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions dropbear ssh project · dropbear ssh	Medium6.4	—	19.3%	Mar 22, 2016
42Plan	CVE-2016-1741Proof of concept	The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged apple · mac os x · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	11.5%	Mar 23, 2016
32Monitor	CVE-2016-1757Proof of concept	Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged contapple · iphone os · CWE-362 RCE Local privilege escalation Race condition	High7.0	—	12.6%	Mar 23, 2016
36Monitor	CVE-2016-1768Proof of concept	QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viapple · mac os x · CWE-119 RCE Memory safety	High7.8	—	16.9%	Mar 23, 2016
33Monitor	CVE-2016-3119No exploit	The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5mit · kerberos 5 Denial of service	Medium5.3	—	39.8%	Mar 25, 2016
79This week	CVE-2016-1646Weaponized	The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consgoogle · chrome · CWE-125 Pre-auth Memory safety	High8.8	KEV	48.1%	Mar 29, 2016
50Plan	CVE-2016-3141Proof of concept	Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause aphp · php · CWE-119 Pre-auth Deserialization Memory safety	Critical9.8	—	36.0%	Mar 31, 2016

CVE-2016-0800
60This week
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify me
MediumCVSS 5.9WeaponizedEPSS 82%
- Pre-auth
- Info leak
openssl · opensslMar 1, 2016
CVE-2016-2278
32Monitor
Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticate
HighCVSS 7.2Proof of conceptEPSS 13%
- RCE
- Broken access control (IDOR)
schneider-electric · struxureware building operations automation server asMar 2, 2016
CVE-2016-0705
47Plan
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g a
CriticalCVSS 9.8No exploitEPSS 26%
- Pre-auth
openssl · opensslMar 3, 2016
CVE-2016-0797
38Monitor
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap
HighCVSS 7.5No exploitEPSS 27%
- Pre-auth
- Denial of service
openssl · opensslMar 3, 2016
CVE-2016-0798
37Monitor
Memory leak in the SRP_VBASE_get_by_user implementation in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to ca
HighCVSS 7.5No exploitEPSS 24%
- Pre-auth
- Denial of service
openssl · opensslMar 3, 2016
CVE-2016-0799
49Plan
The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, whi
CriticalCVSS 9.8No exploitEPSS 32%
- Pre-auth
- Memory safety
openssl · opensslMar 3, 2016
CVE-2016-2842
55Plan
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memor
CriticalCVSS 9.8No exploitEPSS 53%
- Pre-auth
- Memory safety
openssl · opensslMar 3, 2016
CVE-2016-0021
38Monitor
Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Mi
HighCVSS 7.8No exploitEPSS 23%
- RCE
- Memory safety
microsoft · infopathMar 9, 2016
CVE-2016-0091
38Monitor
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows
HighCVSS 7.8No exploitEPSS 23%
- RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0092
48Plan
OLE in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows
HighCVSS 7.8No exploitEPSS 57%
- RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0098
41Plan
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 allow remo
HighCVSS 8.8No exploitEPSS 19%
- pre-auth RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0099
72This week
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2
HighCVSS 7.8KEVWeaponizedEPSS 37%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Mar 9, 2016
CVE-2016-0100
50Plan
Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted applica
HighCVSS 8.4WeaponizedEPSS 57%
- RCE
- Local privilege escalation
microsoft · windows server 2008Mar 9, 2016
CVE-2016-0101
41Plan
Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1
HighCVSS 8.8No exploitEPSS 19%
- pre-auth RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0102
35Monitor
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0103
34Monitor
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0104
34Monitor
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0105
34Monitor
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0106
35Monitor
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0107
35Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0108
42Plan
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 7.5Proof of conceptEPSS 39%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0109
35Monitor
Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0110
34Monitor
Microsoft Internet Explorer 10 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0111
42Plan
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
HighCVSS 7.5Proof of conceptEPSS 39%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0112
35Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0113
35Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0114
35Monitor
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · internet explorerMar 9, 2016
CVE-2016-0117
53Plan
The PDF library in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attack
HighCVSS 7.8No exploitEPSS 71%
- RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0118
41Plan
The PDF library in Microsoft Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted PDF document, aka "Win
HighCVSS 7.8No exploitEPSS 32%
- RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0120
37Monitor
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Serve
MediumCVSS 6.5Proof of conceptEPSS 36%
- Pre-auth
- Denial of service
microsoft · windows 10Mar 9, 2016
CVE-2016-0121
47Plan
The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Serve
HighCVSS 8.8Proof of conceptEPSS 38%
- pre-auth RCE
microsoft · windows 10Mar 9, 2016
CVE-2016-0123
35Monitor
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 7.5No exploitEPSS 16%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0124
34Monitor
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0125
16Monitor
Microsoft Edge mishandles the Referer policy, which allows remote attackers to obtain sensitive browser-history and request information via
LowCVSS 3.1No exploitEPSS 11%
- Pre-auth
- Info leak
microsoft · edgeMar 9, 2016
CVE-2016-0129
34Monitor
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0130
34Monitor
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · edgeMar 9, 2016
CVE-2016-0132
45Plan
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 mishandles signature validation for unspecified elements of XML
CriticalCVSS 9.8No exploitEPSS 21%
- Pre-auth
microsoft · .net frameworkMar 9, 2016
CVE-2016-0134
38Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O
HighCVSS 7.8No exploitEPSS 22%
- RCE
- Memory safety
microsoft · officeMar 9, 2016
CVE-2016-0954
44Plan
Adobe Digital Editions before 4.5.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecif
CriticalCVSS 9.8Proof of conceptEPSS 18%
- pre-auth RCE
- Memory safety
adobe · digital editionsMar 9, 2016
CVE-2016-2774
45Plan
ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows rem
MediumCVSS 5.9No exploitEPSS 73%
- Pre-auth
- Denial of service
isc · dhcpMar 9, 2016
CVE-2015-6184
36Monitor
The CAttrArray object implementation in Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause
HighCVSS 8.1No exploitEPSS 13%
- pre-auth RCE
microsoft · internet explorerMar 9, 2016
CVE-2016-1285
45Plan
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages,
MediumCVSS 6.8No exploitEPSS 59%
- Pre-auth
- Denial of service
isc · bindMar 9, 2016
CVE-2016-1286
53Plan
named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure an
HighCVSS 8.6No exploitEPSS 62%
- Pre-auth
- Denial of service
isc · bindMar 9, 2016
CVE-2016-2088
34Monitor
resolver.c in named in ISC BIND 9.10.x before 9.10.3-P4, when DNS cookies are enabled, allows remote attackers to cause a denial of service
MediumCVSS 6.8No exploitEPSS 22%
- Pre-auth
- Denial of service
isc · bindMar 9, 2016
CVE-2016-0997
44Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-0998
43Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-0999
44Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-1000
44Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 28%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-1001
43Plan
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11
HighCVSS 8.8Proof of conceptEPSS 25%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-1002
41Plan
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR
HighCVSS 8.8Proof of conceptEPSS 19%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-1010
71This week
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577
HighCVSS 8.8KEVWeaponizedEPSS 19%
- pre-auth RCE
- Memory safety
adobe · flash playerMar 12, 2016
CVE-2016-1960
44Plan
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7
HighCVSS 8.8Proof of conceptEPSS 30%
- pre-auth RCE
mozilla · firefoxMar 13, 2016
CVE-2015-7560
30Monitor
The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows
MediumCVSS 6.5No exploitEPSS 12%
- Broken access control (IDOR)
samba · sambaMar 13, 2016
CVE-2016-1988
42Plan
HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive i
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
hp · network automationMar 14, 2016
CVE-2016-1989
42Plan
HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive i
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
hp · network automationMar 14, 2016
CVE-2016-2342
36Monitor
The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 conf
HighCVSS 8.1No exploitEPSS 13%
- pre-auth RCE
- Memory safety
quagga · quaggaMar 17, 2016
CVE-2016-2345
54Plan
Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to exe
CriticalCVSS 9.8Proof of conceptEPSS 51%
- pre-auth RCE
- Memory safety
dameware · mini remote controlMar 17, 2016
CVE-2016-1995
42Plan
HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
hp · system management homepageMar 18, 2016
CVE-2016-3115
36Monitor
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended she
MediumCVSS 6.4Proof of conceptEPSS 35%
openbsd · opensshMar 22, 2016
CVE-2016-3116
31Monitor
CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions
MediumCVSS 6.4Proof of conceptEPSS 19%
dropbear ssh project · dropbear sshMar 22, 2016
CVE-2016-1741
42Plan
The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged
CriticalCVSS 9.8Proof of conceptEPSS 11%
- pre-auth RCE
- Memory safety
apple · mac os xMar 23, 2016
CVE-2016-1757
32Monitor
Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged cont
HighCVSS 7.0Proof of conceptEPSS 12%
- RCE
- Local privilege escalation
- Race condition
apple · iphone osMar 23, 2016
CVE-2016-1768
36Monitor
QuickTime in Apple OS X before 10.11.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vi
HighCVSS 7.8Proof of conceptEPSS 16%
- RCE
- Memory safety
apple · mac os xMar 23, 2016
CVE-2016-3119
33Monitor
The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5
MediumCVSS 5.3No exploitEPSS 39%
- Denial of service
mit · kerberos 5Mar 25, 2016
CVE-2016-1646
79This week
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly cons
HighCVSS 8.8KEVWeaponizedEPSS 48%
- Pre-auth
- Memory safety
google · chromeMar 29, 2016
CVE-2016-3141
50Plan
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a
CriticalCVSS 9.8Proof of conceptEPSS 36%
- Pre-auth
- Deserialization
- Memory safety
php · phpMar 31, 2016