By publication date

Exploited and new serious CVEs: July 2016

84 records · 0 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
53Plan	CVE-2016-1606Proof of concept	Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitrmicrofocus · rumba · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	45.5%	Jul 2, 2016
44Plan	CVE-2016-5228Proof of concept	Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11microfocus · rumba · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	15.1%	Jul 2, 2016
63This week	CVE-2016-5734Weaponized	phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pphpmyadmin · phpmyadmin · CWE-94 pre-auth RCE	Critical9.8	—	81.3%	Jul 2, 2016
47Plan	CVE-2016-3955Proof of concept	The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a deniallinux · linux kernel · CWE-119 Pre-auth Memory safety	Critical9.8	—	25.2%	Jul 3, 2016
40Plan	CVE-2016-4997Weaponized	The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3linux · linux kernel · CWE-264 Local privilege escalation	High7.8	—	5.6%	Jul 3, 2016
40Plan	CVE-2016-4998Weaponized	The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denlinux · linux kernel · CWE-119 Memory safety	High7.1	—	1.8%	Jul 3, 2016
36Monitor	CVE-2015-0899No exploit	The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions vapache · struts · CWE-20 Pre-auth	High7.5	—	21.2%	Jul 4, 2016
44Plan	CVE-2016-4438Proof of concept	The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.apache · struts · CWE-20 pre-auth RCE	Critical9.8	—	16.7%	Jul 4, 2016
24Monitor	CVE-2016-4465No exploit	The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servicapache · struts · CWE-20 Pre-auth Denial of service	Medium5.3	—	10.3%	Jul 4, 2016
35Monitor	CVE-2016-4953No exploit	ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoontp · ntp · CWE-287 Pre-auth Auth bypass Denial of service	High7.5	—	17.2%	Jul 4, 2016
34Monitor	CVE-2016-4954No exploit	The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-varintp · ntp · CWE-362 Pre-auth Race condition Denial of service	High7.5	—	13.3%	Jul 4, 2016
26Monitor	CVE-2016-4956No exploit	ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoontp · ntp Pre-auth Denial of service	Medium5.3	—	16.3%	Jul 4, 2016
43Plan	CVE-2016-4957No exploit	ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.ntp · ntp · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	44.9%	Jul 4, 2016
36Monitor	CVE-2016-1181No exploit	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attaapache · struts pre-auth RCE	High8.1	—	13.1%	Jul 4, 2016
40Plan	CVE-2016-1182No exploit	ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackeapache · struts · CWE-20 Pre-auth XSS	High8.2	—	25.7%	Jul 4, 2016
41Plan	CVE-2016-3092No exploit	The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x beapache · tomcat · CWE-20 Pre-auth Denial of service	High7.5	—	37.1%	Jul 4, 2016
28Monitor	CVE-2016-1546No exploit	The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single Hapache · http server · CWE-399 Pre-auth Denial of service	Medium5.9	—	15.9%	Jul 6, 2016
36Monitor	CVE-2016-4979No exploit	The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requiapache · http server · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	18.8%	Jul 6, 2016
38Monitor	CVE-2016-6170No exploit	ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (seisc · bind · CWE-20 Denial of service	Medium6.5	—	40.9%	Jul 6, 2016
34Monitor	CVE-2016-4463Proof of concept	Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply napache · xerces-c\+\+ · CWE-119 Pre-auth Memory safety Denial of service	High7.5	—	14.1%	Jul 8, 2016
35Monitor	CVE-2016-4533No exploit	Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.wecon · levistudiou · CWE-119 RCE Memory safety	High7.8	—	12.7%	Jul 11, 2016
36Monitor	CVE-2016-5781No exploit	Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.wecon · levistudio · CWE-119 RCE Memory safety	High7.8	—	16.0%	Jul 11, 2016
36Monitor	CVE-2016-6174Proof of concept	applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Bphp · php pre-auth RCE	High8.1	—	12.2%	Jul 12, 2016
41Plan	CVE-2016-3204No exploit	The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allomicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High8.8	—	18.7%	Jul 12, 2016
43Plan	CVE-2016-3238Proof of concept	The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201microsoft · windows 10 · CWE-254 pre-auth RCE	High8.1	—	35.4%	Jul 12, 2016
34Monitor	CVE-2016-3240No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.8%	Jul 12, 2016
34Monitor	CVE-2016-3241No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.3%	Jul 12, 2016
34Monitor	CVE-2016-3242No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) microsoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.8%	Jul 12, 2016
34Monitor	CVE-2016-3243No exploit	Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) viamicrosoft · internet explorer · CWE-119 pre-auth RCE Memory safety	High7.5	—	13.3%	Jul 12, 2016
23Monitor	CVE-2016-3244No exploit	Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature microsoft · edge · CWE-284 Pre-auth Broken access control (IDOR)	Medium4.3	—	18.7%	Jul 12, 2016
30Monitor	CVE-2016-3245No exploit	Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a craftmicrosoft · internet explorer · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.5	—	14.5%	Jul 12, 2016
34Monitor	CVE-2016-3246No exploit	Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, akmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	14.1%	Jul 12, 2016
42Plan	CVE-2016-3248No exploit	The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoftmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	22.9%	Jul 12, 2016
28Monitor	CVE-2016-3251No exploit	The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,microsoft · windows 10 · CWE-200 Info leak	Low2.8	—	58.0%	Jul 12, 2016
37Monitor	CVE-2016-3255No exploit	Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing microsoft · .net framework · CWE-200 Pre-auth XXE Info leak	High7.5	—	24.6%	Jul 12, 2016
46Plan	CVE-2016-3259No exploit	The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoftmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	36.3%	Jul 12, 2016
42Plan	CVE-2016-3260No exploit	The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, andmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	23.0%	Jul 12, 2016
25Monitor	CVE-2016-3261No exploit	Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Informmicrosoft · internet explorer · CWE-200 Pre-auth Info leak	Medium5.3	—	13.4%	Jul 12, 2016
34Monitor	CVE-2016-3264No exploit	Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (mmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High7.5	—	14.0%	Jul 12, 2016
41Plan	CVE-2016-3265No exploit	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	20.7%	Jul 12, 2016
41Plan	CVE-2016-3269No exploit	The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupmicrosoft · edge · CWE-119 pre-auth RCE Memory safety	High8.8	—	21.4%	Jul 12, 2016
32Monitor	CVE-2016-3271No exploit	The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, akmicrosoft · edge · CWE-200 Pre-auth Info leak	Medium6.5	—	20.8%	Jul 12, 2016
24Monitor	CVE-2016-3272No exploit	The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault sysmicrosoft · windows 10 · CWE-200 Info leak	Low2.8	—	43.2%	Jul 12, 2016
25Monitor	CVE-2016-3273No exploit	The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remotmicrosoft · edge · CWE-200 Pre-auth XSS Info leak	Medium5.3	—	14.1%	Jul 12, 2016
31Monitor	CVE-2016-3277No exploit	Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka microsoft · edge · CWE-200 Pre-auth Info leak	Medium5.3	—	32.3%	Jul 12, 2016
37Monitor	CVE-2016-3278No exploit	Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document,microsoft · outlook · CWE-119 RCE Memory safety	High7.8	—	20.3%	Jul 12, 2016
27Monitor	CVE-2016-3279No exploit	Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 201microsoft · excel · CWE-254 RCE	Medium5.5	—	16.4%	Jul 12, 2016
37Monitor	CVE-2016-3280No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Word 2016 for Mac, Office Compamicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	19.6%	Jul 12, 2016
37Monitor	CVE-2016-3281No exploit	Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation microsoft · office · CWE-119 RCE Memory safety	High7.8	—	20.4%	Jul 12, 2016
39Monitor	CVE-2016-3282No exploit	Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Omicrosoft · office · CWE-119 RCE Memory safety	High7.8	—	26.2%	Jul 12, 2016
37Monitor	CVE-2016-3283No exploit	Microsoft Word Viewer allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruptimicrosoft · word viewer · CWE-119 RCE Memory safety	High7.8	—	19.6%	Jul 12, 2016
37Monitor	CVE-2016-3284No exploit	Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compmicrosoft · excel · CWE-119 RCE Memory safety	High7.8	—	19.6%	Jul 12, 2016
41Plan	CVE-2016-4175Proof of concept	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attadobe · flash player desktop runtime · CWE-787 pre-auth RCE Memory safety	High8.8	—	20.4%	Jul 12, 2016
40Plan	CVE-2016-4176Proof of concept	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attadobe · flash player desktop runtime · CWE-787 pre-auth RCE Memory safety	High8.8	—	17.5%	Jul 12, 2016
40Plan	CVE-2016-4177Proof of concept	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attadobe · flash player desktop runtime · CWE-787 pre-auth RCE Memory safety	High8.8	—	17.5%	Jul 12, 2016
41Plan	CVE-2016-4179Proof of concept	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attadobe · flash player desktop runtime · CWE-787 pre-auth RCE Memory safety	High8.8	—	20.4%	Jul 12, 2016
45Plan	CVE-2016-4201Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	20.7%	Jul 12, 2016
47Plan	CVE-2016-4203Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	26.9%	Jul 12, 2016
44Plan	CVE-2016-4204Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	17.8%	Jul 12, 2016
44Plan	CVE-2016-4205Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	17.8%	Jul 12, 2016
44Plan	CVE-2016-4206Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	17.8%	Jul 12, 2016
44Plan	CVE-2016-4207Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	17.8%	Jul 12, 2016
44Plan	CVE-2016-4208Proof of concept	Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continadobe · acrobat · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	17.8%	Jul 12, 2016
45Plan	CVE-2016-4226Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	33.1%	Jul 12, 2016
45Plan	CVE-2016-4227Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	32.8%	Jul 12, 2016
45Plan	CVE-2016-4228Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	33.1%	Jul 12, 2016
45Plan	CVE-2016-4229Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	32.4%	Jul 12, 2016
45Plan	CVE-2016-4230Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	32.2%	Jul 12, 2016
45Plan	CVE-2016-4231Proof of concept	Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before adobe · flash player desktop runtime · CWE-416 pre-auth RCE Memory safety	High8.8	—	32.8%	Jul 12, 2016
41Plan	CVE-2016-4232Proof of concept	Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attadobe · flash player desktop runtime · CWE-401 Pre-auth Denial of service	High7.5	—	36.4%	Jul 12, 2016
45Plan	CVE-2016-4372Proof of concept	HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2hp · intelligent management center application performance manager · CWE-20 pre-auth RCE	Critical9.8	—	19.4%	Jul 15, 2016
47Plan	CVE-2016-5385No exploit	PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from thp · storeever msl6480 tape library firmware · CWE-601 Pre-auth Open redirect	High8.1	—	50.4%	Jul 18, 2016
49Plan	CVE-2016-5387No exploit	The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untruapache · http server Pre-auth	High8.1	—	55.7%	Jul 18, 2016
47Plan	CVE-2016-5388No exploit	Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does apache · tomcat · CWE-284 Pre-auth Broken access control (IDOR)	High8.1	—	50.8%	Jul 19, 2016
42Plan	CVE-2016-2775No exploit	ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows isc · bind · CWE-20 Pre-auth Denial of service	Medium5.9	—	63.3%	Jul 19, 2016
42Plan	CVE-2016-5080No exploit	Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent objective systems · asn1c pre-auth RCE	Critical9.8	—	10.0%	Jul 19, 2016
66This week	CVE-2016-3510Weaponized	Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remoteoracle · weblogic server Pre-auth	Critical9.8	—	91.4%	Jul 21, 2016
29Monitor	CVE-2016-3521No exploit	Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x bmariadb · mariadb Denial of service	Medium6.5	—	10.4%	Jul 21, 2016
45Plan	CVE-2016-3586Proof of concept	Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remoteoracle · weblogic server Pre-auth	Critical9.8	—	20.0%	Jul 21, 2016
41Plan	CVE-2016-4622Proof of concept	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a deapple · safari · CWE-119 pre-auth RCE Memory safety	High8.8	—	20.3%	Jul 21, 2016
42Plan	CVE-2016-5743No exploit	Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 thsiemens · simatic batch · CWE-20 pre-auth RCE	Critical9.8	—	10.4%	Jul 22, 2016
38Monitor	CVE-2016-1608Proof of concept	vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbinovell · filr · CWE-284 RCE Broken access control (IDOR)	High8.8	—	11.3%	Jul 31, 2016
33Monitor	CVE-2016-1610Proof of concept	Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2novell · filr · CWE-22 Pre-auth Path traversal	High7.5	—	11.5%	Jul 31, 2016
39Monitor	CVE-2016-2180No exploit	The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSopenssl · openssl · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	29.9%	Jul 31, 2016

CVE-2016-1606
53Plan
Multiple stack-based buffer overflows in COM objects in Micro Focus Rumba 9.4.x before 9.4 HF 13960 allow remote attackers to execute arbitr
CriticalCVSS 9.8Proof of conceptEPSS 45%
- pre-auth RCE
- Memory safety
microfocus · rumbaJul 2, 2016
CVE-2016-5228
44Plan
Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11
CriticalCVSS 9.8Proof of conceptEPSS 15%
- pre-auth RCE
- Memory safety
microfocus · rumbaJul 2, 2016
CVE-2016-5734
63This week
phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the p
CriticalCVSS 9.8WeaponizedEPSS 81%
- pre-auth RCE
phpmyadmin · phpmyadminJul 2, 2016
CVE-2016-3955
47Plan
The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial
CriticalCVSS 9.8Proof of conceptEPSS 25%
- Pre-auth
- Memory safety
linux · linux kernelJul 3, 2016
CVE-2016-4997
40Plan
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3
HighCVSS 7.8WeaponizedEPSS 5%
- Local privilege escalation
linux · linux kernelJul 3, 2016
CVE-2016-4998
40Plan
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a den
HighCVSS 7.1WeaponizedEPSS 1%
- Memory safety
linux · linux kernelJul 3, 2016
CVE-2015-0899
36Monitor
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions v
HighCVSS 7.5No exploitEPSS 21%
- Pre-auth
apache · strutsJul 4, 2016
CVE-2016-4438
44Plan
The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
CriticalCVSS 9.8Proof of conceptEPSS 16%
- pre-auth RCE
apache · strutsJul 4, 2016
CVE-2016-4465
24Monitor
The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servic
MediumCVSS 5.3No exploitEPSS 10%
- Pre-auth
- Denial of service
apache · strutsJul 4, 2016
CVE-2016-4953
35Monitor
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoo
HighCVSS 7.5No exploitEPSS 17%
- Pre-auth
- Auth bypass
- Denial of service
ntp · ntpJul 4, 2016
CVE-2016-4954
34Monitor
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-vari
HighCVSS 7.5No exploitEPSS 13%
- Pre-auth
- Race condition
- Denial of service
ntp · ntpJul 4, 2016
CVE-2016-4956
26Monitor
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoo
MediumCVSS 5.3No exploitEPSS 16%
- Pre-auth
- Denial of service
ntp · ntpJul 4, 2016
CVE-2016-4957
43Plan
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.
HighCVSS 7.5No exploitEPSS 44%
- Pre-auth
- Memory safety
- Denial of service
ntp · ntpJul 4, 2016
CVE-2016-1181
36Monitor
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote atta
HighCVSS 8.1No exploitEPSS 13%
- pre-auth RCE
apache · strutsJul 4, 2016
CVE-2016-1182
40Plan
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attacke
HighCVSS 8.2No exploitEPSS 25%
- Pre-auth
- XSS
apache · strutsJul 4, 2016
CVE-2016-3092
41Plan
The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x be
HighCVSS 7.5No exploitEPSS 37%
- Pre-auth
- Denial of service
apache · tomcatJul 4, 2016
CVE-2016-1546
28Monitor
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single H
MediumCVSS 5.9No exploitEPSS 15%
- Pre-auth
- Denial of service
apache · http serverJul 6, 2016
CVE-2016-4979
36Monitor
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requi
HighCVSS 7.5No exploitEPSS 18%
- Pre-auth
- Broken access control (IDOR)
apache · http serverJul 6, 2016
CVE-2016-6170
38Monitor
ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (se
MediumCVSS 6.5No exploitEPSS 40%
- Denial of service
isc · bindJul 6, 2016
CVE-2016-4463
34Monitor
Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply n
HighCVSS 7.5Proof of conceptEPSS 14%
- Pre-auth
- Memory safety
- Denial of service
apache · xerces-c\+\+Jul 8, 2016
CVE-2016-4533
35Monitor
Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
HighCVSS 7.8No exploitEPSS 12%
- RCE
- Memory safety
wecon · levistudiouJul 11, 2016
CVE-2016-5781
36Monitor
Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
HighCVSS 7.8No exploitEPSS 16%
- RCE
- Memory safety
wecon · levistudioJul 11, 2016
CVE-2016-6174
36Monitor
applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power B
HighCVSS 8.1Proof of conceptEPSS 12%
- pre-auth RCE
php · phpJul 12, 2016
CVE-2016-3204
41Plan
The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allo
HighCVSS 8.8No exploitEPSS 18%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 12, 2016
CVE-2016-3238
43Plan
The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201
HighCVSS 8.1Proof of conceptEPSS 35%
- pre-auth RCE
microsoft · windows 10Jul 12, 2016
CVE-2016-3240
34Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 12, 2016
CVE-2016-3241
34Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 12, 2016
CVE-2016-3242
34Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 12, 2016
CVE-2016-3243
34Monitor
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via
HighCVSS 7.5No exploitEPSS 13%
- pre-auth RCE
- Memory safety
microsoft · internet explorerJul 12, 2016
CVE-2016-3244
23Monitor
Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature
MediumCVSS 4.3No exploitEPSS 18%
- Pre-auth
- Broken access control (IDOR)
microsoft · edgeJul 12, 2016
CVE-2016-3245
30Monitor
Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a craft
MediumCVSS 6.5No exploitEPSS 14%
- Pre-auth
- Broken access control (IDOR)
microsoft · internet explorerJul 12, 2016
CVE-2016-3246
34Monitor
Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak
HighCVSS 7.5No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3248
42Plan
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft
HighCVSS 8.8No exploitEPSS 22%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3251
28Monitor
The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1,
LowCVSS 2.8No exploitEPSS 58%
- Info leak
microsoft · windows 10Jul 12, 2016
CVE-2016-3255
37Monitor
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing
HighCVSS 7.5No exploitEPSS 24%
- Pre-auth
- XXE
- Info leak
microsoft · .net frameworkJul 12, 2016
CVE-2016-3259
46Plan
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft
HighCVSS 8.8No exploitEPSS 36%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3260
42Plan
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and
HighCVSS 8.8No exploitEPSS 23%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3261
25Monitor
Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Inform
MediumCVSS 5.3No exploitEPSS 13%
- Pre-auth
- Info leak
microsoft · internet explorerJul 12, 2016
CVE-2016-3264
34Monitor
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m
HighCVSS 7.5No exploitEPSS 14%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3265
41Plan
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup
HighCVSS 8.8No exploitEPSS 20%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3269
41Plan
The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup
HighCVSS 8.8No exploitEPSS 21%
- pre-auth RCE
- Memory safety
microsoft · edgeJul 12, 2016
CVE-2016-3271
32Monitor
The VBScript engine in Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, ak
MediumCVSS 6.5No exploitEPSS 20%
- Pre-auth
- Info leak
microsoft · edgeJul 12, 2016
CVE-2016-3272
24Monitor
The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault sys
LowCVSS 2.8No exploitEPSS 43%
- Info leak
microsoft · windows 10Jul 12, 2016
CVE-2016-3273
25Monitor
The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remot
MediumCVSS 5.3No exploitEPSS 14%
- Pre-auth
- XSS
- Info leak
microsoft · edgeJul 12, 2016
CVE-2016-3277
31Monitor
Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka
MediumCVSS 5.3No exploitEPSS 32%
- Pre-auth
- Info leak
microsoft · edgeJul 12, 2016
CVE-2016-3278
37Monitor
Microsoft Outlook 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document,
HighCVSS 7.8No exploitEPSS 20%
- RCE
- Memory safety
microsoft · outlookJul 12, 2016
CVE-2016-3279
27Monitor
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Excel 201
MediumCVSS 5.5No exploitEPSS 16%
- RCE
microsoft · excelJul 12, 2016
CVE-2016-3280
37Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Word 2016 for Mac, Office Compa
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · officeJul 12, 2016
CVE-2016-3281
37Monitor
Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Word Automation
HighCVSS 7.8No exploitEPSS 20%
- RCE
- Memory safety
microsoft · officeJul 12, 2016
CVE-2016-3282
39Monitor
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, O
HighCVSS 7.8No exploitEPSS 26%
- RCE
- Memory safety
microsoft · officeJul 12, 2016
CVE-2016-3283
37Monitor
Microsoft Word Viewer allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corrupti
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · word viewerJul 12, 2016
CVE-2016-3284
37Monitor
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Comp
HighCVSS 7.8No exploitEPSS 19%
- RCE
- Memory safety
microsoft · excelJul 12, 2016
CVE-2016-4175
41Plan
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows att
HighCVSS 8.8Proof of conceptEPSS 20%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4176
40Plan
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows att
HighCVSS 8.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4177
40Plan
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows att
HighCVSS 8.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4179
41Plan
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows att
HighCVSS 8.8Proof of conceptEPSS 20%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4201
45Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 20%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4203
47Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 26%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4204
44Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4205
44Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4206
44Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4207
44Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4208
44Plan
Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Contin
CriticalCVSS 9.8Proof of conceptEPSS 17%
- pre-auth RCE
- Memory safety
adobe · acrobatJul 12, 2016
CVE-2016-4226
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 33%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4227
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 32%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4228
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 33%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4229
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 32%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4230
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 32%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4231
45Plan
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before
HighCVSS 8.8Proof of conceptEPSS 32%
- pre-auth RCE
- Memory safety
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4232
41Plan
Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows att
HighCVSS 7.5Proof of conceptEPSS 36%
- Pre-auth
- Denial of service
adobe · flash player desktop runtimeJul 12, 2016
CVE-2016-4372
45Plan
HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2
CriticalCVSS 9.8Proof of conceptEPSS 19%
- pre-auth RCE
hp · intelligent management center application performance managerJul 15, 2016
CVE-2016-5385
47Plan
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from t
HighCVSS 8.1No exploitEPSS 50%
- Pre-auth
- Open redirect
hp · storeever msl6480 tape library firmwareJul 18, 2016
CVE-2016-5387
49Plan
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untru
HighCVSS 8.1No exploitEPSS 55%
- Pre-auth
apache · http serverJul 18, 2016
CVE-2016-5388
47Plan
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does
HighCVSS 8.1No exploitEPSS 50%
- Pre-auth
- Broken access control (IDOR)
apache · tomcatJul 19, 2016
CVE-2016-2775
42Plan
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows
MediumCVSS 5.9No exploitEPSS 63%
- Pre-auth
- Denial of service
isc · bindJul 19, 2016
CVE-2016-5080
42Plan
Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
objective systems · asn1cJul 19, 2016
CVE-2016-3510
66This week
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote
CriticalCVSS 9.8WeaponizedEPSS 91%
- Pre-auth
oracle · weblogic serverJul 21, 2016
CVE-2016-3521
29Monitor
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x b
MediumCVSS 6.5No exploitEPSS 10%
- Denial of service
mariadb · mariadbJul 21, 2016
CVE-2016-3586
45Plan
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote
CriticalCVSS 9.8Proof of conceptEPSS 20%
- Pre-auth
oracle · weblogic serverJul 21, 2016
CVE-2016-4622
41Plan
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a de
HighCVSS 8.8Proof of conceptEPSS 20%
- pre-auth RCE
- Memory safety
apple · safariJul 21, 2016
CVE-2016-5743
42Plan
Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 th
CriticalCVSS 9.8No exploitEPSS 10%
- pre-auth RCE
siemens · simatic batchJul 22, 2016
CVE-2016-1608
38Monitor
vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbi
HighCVSS 8.8Proof of conceptEPSS 11%
- RCE
- Broken access control (IDOR)
novell · filrJul 31, 2016
CVE-2016-1610
33Monitor
Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2
HighCVSS 7.5Proof of conceptEPSS 11%
- Pre-auth
- Path traversal
novell · filrJul 31, 2016
CVE-2016-2180
39Monitor
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenS
HighCVSS 7.5No exploitEPSS 29%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslJul 31, 2016