Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2016

41 records · 3 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2016-1240
    40Plan

    The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tom

    HighCVSS 7.8WeaponizedEPSS 9%

    debian · debian linuxOct 3, 2016

  • CVE-2015-1832
    40Plan

    XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in plac

    CriticalCVSS 9.1No exploitEPSS 12%

    apache · derbyOct 3, 2016

  • CVE-2016-6433
    59Plan

    The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrar

    HighCVSS 8.8WeaponizedEPSS 80%

    cisco · secure firewall management centerOct 6, 2016

  • CVE-2016-6435
    40Plan

    The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters,

    MediumCVSS 6.5WeaponizedEPSS 36%

    cisco · secure firewall management centerOct 6, 2016

  • CVE-2015-2080
    53Plan

    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process mem

    HighCVSS 7.5Proof of conceptEPSS 75%

    eclipse · jettyOct 7, 2016

  • CVE-2016-7167
    43Plan

    Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl

    CriticalCVSS 9.8No exploitEPSS 11%

    fedoraproject · fedoraOct 7, 2016

  • CVE-2016-7117
    46Plan

    Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to exec

    CriticalCVSS 9.8No exploitEPSS 23%

    linux · linux kernelOct 10, 2016

  • CVE-2016-5425
    40Plan

    The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak perm

    HighCVSS 7.8WeaponizedEPSS 3%

    oracle · instantis enterprisetrackOct 13, 2016

  • CVE-2016-7065
    39Monitor

    The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of servic

    HighCVSS 8.8Proof of conceptEPSS 12%

    redhat · jboss enterprise application platformOct 13, 2016

  • CVE-2016-4273
    41Plan

    Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows att

    HighCVSS 8.8Proof of conceptEPSS 19%

    adobe · flash playerOct 13, 2016

  • CVE-2016-0070
    25Monitor

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,

    MediumCVSS 5.5Proof of conceptEPSS 11%

    microsoft · windows 10Oct 13, 2016

  • CVE-2016-0142
    37Monitor

    Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote

    HighCVSS 7.8No exploitEPSS 20%

    microsoft · windows 10Oct 13, 2016

  • CVE-2016-3209
    38Monitor

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    MediumCVSS 5.5Proof of conceptEPSS 53%

    microsoft · .net frameworkOct 13, 2016

  • CVE-2016-3262
    32Monitor

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    MediumCVSS 5.5No exploitEPSS 31%

    microsoft · live meetingOct 13, 2016

  • CVE-2016-3263
    32Monitor

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    MediumCVSS 5.5No exploitEPSS 31%

    microsoft · live meetingOct 13, 2016

  • CVE-2016-3267
    26Monitor

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to determine the existence of unspecified files via a cra

    MediumCVSS 5.3No exploitEPSS 15%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3298
    66This week

    Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window

    MediumCVSS 6.5KEVWeaponizedEPSS 33%

    microsoft · internet explorerOct 13, 2016

  • CVE-2016-3331
    34Monitor

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr

    HighCVSS 7.5No exploitEPSS 14%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3376
    35Monitor

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012

    HighCVSS 7.8Proof of conceptEPSS 12%

    microsoft · windows 10Oct 13, 2016

  • CVE-2016-3382
    35Monitor

    The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cau

    HighCVSS 7.5No exploitEPSS 17%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3383
    34Monitor

    Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via

    HighCVSS 7.5No exploitEPSS 13%

    microsoft · internet explorerOct 13, 2016

  • CVE-2016-3384
    34Monitor

    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)

    HighCVSS 7.5No exploitEPSS 12%

    microsoft · internet explorerOct 13, 2016

  • CVE-2016-3385
    37Monitor

    The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of serv

    HighCVSS 7.5No exploitEPSS 23%

    microsoft · internet explorerOct 13, 2016

  • CVE-2016-3386
    42Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 7.5Proof of conceptEPSS 41%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3387
    36Monitor

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker

    HighCVSS 7.5Proof of conceptEPSS 19%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3388
    29Monitor

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attacker

    MediumCVSS 5.3Proof of conceptEPSS 27%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3389
    35Monitor

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 7.5No exploitEPSS 15%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3390
    35Monitor

    The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denia

    HighCVSS 7.5No exploitEPSS 16%

    microsoft · edgeOct 13, 2016

  • CVE-2016-3393
    82Now

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    HighCVSS 7.8KEVWeaponizedEPSS 68%

    microsoft · windows 10 1507Oct 13, 2016

  • CVE-2016-3396
    38Monitor

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;

    HighCVSS 7.8No exploitEPSS 24%

    microsoft · live meetingOct 13, 2016

  • CVE-2016-7182
    48Plan

    The Graphics component in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 G

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    microsoft · live meetingOct 13, 2016

  • CVE-2016-7189
    44Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engi

    HighCVSS 7.5Proof of conceptEPSS 48%

    microsoft · edgeOct 13, 2016

  • CVE-2016-7190
    50Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 7.5Proof of conceptEPSS 66%

    microsoft · edgeOct 13, 2016

  • CVE-2016-7193
    78This week

    Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibi

    HighCVSS 7.8KEVWeaponizedEPSS 57%

    microsoft · officeOct 13, 2016

  • CVE-2016-7194
    47Plan

    The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup

    HighCVSS 7.5Proof of conceptEPSS 57%

    microsoft · edgeOct 13, 2016

  • CVE-2016-2848
    38Monitor

    ISC BIND 9.1.0 through 9.8.4-P2 and 9.9.0 through 9.9.2-P2 allows remote attackers to cause a denial of service (assertion failure and daemo

    HighCVSS 7.5No exploitEPSS 25%

    isc · bindOct 21, 2016

  • CVE-2016-3473
    34Monitor

    Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.

    HighCVSS 7.7Proof of conceptEPSS 13%

    oracle · business intelligence publisherOct 25, 2016

  • CVE-2016-1000031
    49Plan

    Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution

    CriticalCVSS 9.8No exploitEPSS 33%

    apache · commons fileuploadOct 25, 2016

  • CVE-2016-8339
    43Plan

    A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent.

    CriticalCVSS 9.8No exploitEPSS 14%

    redislabs · redisOct 28, 2016

  • CVE-2016-8581
    60This week

    A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an

    MediumCVSS 6.1WeaponizedEPSS 17%

    alienvault · open source security information and event managementOct 28, 2016

  • CVE-2016-8582
    60This week

    A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and r

    CriticalCVSS 9.8WeaponizedEPSS 57%

    alienvault · open source security information and event managementOct 28, 2016