Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2016

65 records · 6 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2016-3088
    99Now

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTT

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    apache · activemqJun 1, 2016

  • CVE-2015-7611
    60This week

    Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unsp

    HighCVSS 8.1WeaponizedEPSS 68%

    apache · james serverJun 7, 2016

  • CVE-2016-4437
    97Now

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbit

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    apache · auroraJun 7, 2016

  • CVE-2016-4450
    35Monitor

    os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer deref

    HighCVSS 7.5No exploitEPSS 16%

    canonical · ubuntu linuxJun 7, 2016

  • CVE-2016-3087
    64This week

    Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker

    CriticalCVSS 9.8WeaponizedEPSS 81%

    apache · strutsJun 7, 2016

  • CVE-2016-4359
    44Plan

    Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3,

    CriticalCVSS 9.8No exploitEPSS 15%

    hp · loadrunnerJun 8, 2016

  • CVE-2016-5108
    46Plan

    Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    videolan · vlc media playerJun 8, 2016

  • CVE-2016-4510
    42Plan

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and r

    CriticalCVSS 9.1No exploitEPSS 20%

    trihedral · vtscadaJun 9, 2016

  • CVE-2016-4523
    69This week

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (

    HighCVSS 7.5KEVWeaponizedEPSS 31%

    trihedral · vtscadaJun 9, 2016

  • CVE-2016-4532
    44Plan

    Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote att

    CriticalCVSS 9.1No exploitEPSS 27%

    trihedral · vtscadaJun 9, 2016

  • CVE-2016-4447
    34Monitor

    The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-b

    HighCVSS 7.5No exploitEPSS 13%

    hp · icewall federation agentJun 9, 2016

  • CVE-2016-5118
    54Plan

    The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (p

    CriticalCVSS 9.8No exploitEPSS 49%

    graphicsmagick · graphicsmagickJun 10, 2016

  • CVE-2016-2819
    42Plan

    Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code

    HighCVSS 8.8Proof of conceptEPSS 23%

    mozilla · firefoxJun 13, 2016

  • CVE-2016-1542
    60This week

    The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote at

    HighCVSS 7.5WeaponizedEPSS 74%

    bmc · bladelogic server automation consoleJun 13, 2016

  • CVE-2016-1543
    60This week

    The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remot

    HighCVSS 7.5WeaponizedEPSS 71%

    bmc · bladelogic server automation consoleJun 13, 2016

  • CVE-2016-0028
    29Monitor

    Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative

    MediumCVSS 5.5No exploitEPSS 22%

    microsoft · exchange serverJun 15, 2016

  • CVE-2016-0199
    50Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    HighCVSS 8.8Proof of conceptEPSS 50%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-0200
    41Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    HighCVSS 8.8No exploitEPSS 20%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-3198
    36Monitor

    Microsoft Edge allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted document, aka "Microso

    MediumCVSS 6.5No exploitEPSS 32%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3199
    43Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 8.8No exploitEPSS 26%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3201
    33Monitor

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensit

    MediumCVSS 6.5No exploitEPSS 23%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3202
    35Monitor

    The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft E

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3203
    41Plan

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbit

    HighCVSS 7.8No exploitEPSS 33%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3205
    34Monitor

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · jscriptJun 15, 2016

  • CVE-2016-3206
    34Monitor

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · jscriptJun 15, 2016

  • CVE-2016-3207
    35Monitor

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · jscriptJun 15, 2016

  • CVE-2016-3210
    42Plan

    The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cau

    HighCVSS 8.8No exploitEPSS 21%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-3211
    45Plan

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    HighCVSS 8.8No exploitEPSS 31%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-3212
    27Monitor

    The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers

    MediumCVSS 6.1No exploitEPSS 10%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-3213
    60This week

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP

    HighCVSS 8.8WeaponizedEPSS 66%

    microsoft · internet explorerJun 15, 2016

  • CVE-2016-3214
    40Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 8.8No exploitEPSS 16%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3215
    32Monitor

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive infor

    MediumCVSS 5.5No exploitEPSS 33%

    microsoft · windows 10Jun 15, 2016

  • CVE-2016-3216
    24Monitor

    GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows

    MediumCVSS 4.3Proof of conceptEPSS 24%

    microsoft · windows 10Jun 15, 2016

  • CVE-2016-3222
    52Plan

    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak

    HighCVSS 8.8Proof of conceptEPSS 56%

    microsoft · edgeJun 15, 2016

  • CVE-2016-3223
    38Monitor

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1

    HighCVSS 8.1Proof of conceptEPSS 21%

    microsoft · windows 10Jun 15, 2016

  • CVE-2016-3225
    44Plan

    The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    HighCVSS 7.8WeaponizedEPSS 43%

    microsoft · windows 10Jun 15, 2016

  • CVE-2016-3226
    29Monitor

    Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of

    MediumCVSS 6.5No exploitEPSS 10%

    microsoft · windows server 2008Jun 15, 2016

  • CVE-2016-3227
    47Plan

    Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arb

    CriticalCVSS 9.8No exploitEPSS 25%

    microsoft · windows server 2012Jun 15, 2016

  • CVE-2016-3228
    39Monitor

    Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows Server 2012 Gold and R2 allow remote authenticated users to execute arbitrary code

    HighCVSS 8.8No exploitEPSS 13%

    microsoft · windows server 2008Jun 15, 2016

  • CVE-2016-3235
    74This week

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading

    HighCVSS 7.8KEVWeaponizedEPSS 43%

    microsoft · visioJun 15, 2016

  • CVE-2016-3236
    62This week

    The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP

    CriticalCVSS 9.8WeaponizedEPSS 76%

    microsoft · windows 10Jun 15, 2016

  • CVE-2016-0025
    34Monitor

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 20

    HighCVSS 7.3No exploitEPSS 15%

    microsoft · officeJun 16, 2016

  • CVE-2016-3233
    33Monitor

    Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted O

    HighCVSS 7.3No exploitEPSS 14%

    microsoft · excelJun 16, 2016

  • CVE-2016-3234
    29Monitor

    Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint

    MediumCVSS 5.5No exploitEPSS 24%

    microsoft · officeJun 16, 2016

  • CVE-2016-4121
    42Plan

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before

    CriticalCVSS 9.8No exploitEPSS 10%

    adobe · flash playerJun 16, 2016

  • CVE-2016-4135
    40Plan

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    HighCVSS 8.8Proof of conceptEPSS 16%

    adobe · flash playerJun 16, 2016

  • CVE-2016-4136
    40Plan

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    HighCVSS 8.8Proof of conceptEPSS 16%

    adobe · flash playerJun 16, 2016

  • CVE-2016-4137
    40Plan

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    HighCVSS 8.8Proof of conceptEPSS 16%

    adobe · flash playerJun 16, 2016

  • CVE-2016-4138
    47Plan

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    adobe · flash playerJun 16, 2016

  • CVE-2016-4171
    75This week

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors

    CriticalCVSS 9.8KEVWeaponizedEPSS 20%

    adobe · flash playerJun 16, 2016

  • CVE-2016-3642
    43Plan

    The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute arbitrary commands via a crafted s

    CriticalCVSS 9.8No exploitEPSS 13%

    solarwinds · virtualization managerJun 17, 2016

  • CVE-2016-3643
    62This week

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demons

    HighCVSS 7.8KEVWeaponizedEPSS 3%

    solarwinds · virtualization managerJun 17, 2016

  • CVE-2016-2177
    52Plan

    OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a de

    CriticalCVSS 9.8No exploitEPSS 44%

    openssl · opensslJun 19, 2016

  • CVE-2016-4309
    33Monitor

    Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessi

    HighCVSS 7.5Proof of conceptEPSS 10%

    getsymphony · symphonyJun 30, 2016

  • CVE-2016-4971
    49Plan

    GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

    HighCVSS 8.8Proof of conceptEPSS 46%

    gnu · wgetJun 30, 2016

  • CVE-2016-5360
    43Plan

    HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memor

    HighCVSS 7.5No exploitEPSS 42%

    haproxy · haproxyJun 30, 2016

  • CVE-2016-3189
    31Monitor

    Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2

    MediumCVSS 6.5No exploitEPSS 15%

    bzip · bzip2Jun 30, 2016

  • CVE-2016-4472
    36Monitor

    The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial

    HighCVSS 8.1No exploitEPSS 11%

    libexpat project · libexpatJun 30, 2016

  • CVE-2016-2207
    38Monitor

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    HighCVSS 8.4Proof of conceptEPSS 18%

    symantec · mail security for microsoft exchangeJun 30, 2016

  • CVE-2016-2209
    35Monitor

    Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security

    HighCVSS 7.3Proof of conceptEPSS 20%

    symantec · mail security for microsoft exchangeJun 30, 2016

  • CVE-2016-2210
    32Monitor

    Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Securit

    HighCVSS 7.3Proof of conceptEPSS 11%

    symantec · mail security for microsoft exchangeJun 30, 2016

  • CVE-2016-2211
    47Plan

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    HighCVSS 7.8No exploitEPSS 53%

    symantec · mail security for microsoft exchangeJun 30, 2016

  • CVE-2016-3644
    38Monitor

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    HighCVSS 8.4Proof of conceptEPSS 17%

    symantec · norton securityJun 30, 2016

  • CVE-2016-3645
    46Plan

    Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    symantec · norton securityJun 30, 2016

  • CVE-2016-3646
    38Monitor

    The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6

    HighCVSS 8.4Proof of conceptEPSS 17%

    symantec · norton securityJun 30, 2016