CVE-2016-4655

CVE-2016-4655 is an iOS kernel information-disclosure vulnerability that allowed memory disclosure via a crafted app on affected iOS versions (pre-9.3.5). The connected docs include PoC exploit references (Trident for iOS

CVE-2016-4657

CVE-2016-4657 refers to a memory corruption vulnerability in Apple WebKit used by iOS, prior to 9.3.5. The issue could allow a remote attacker to execute arbitrary code or cause a denial of service when a user visits a crafted website. Affected product is WebKit in iOS (and related WebKit-based c...

CVE-2016-4656

CVE-2016-4656 is an Apple iOS kernel memory‑corruption vulnerability that can allow an attacker to execute arbitrary code with kernel privileges or cause a DoS via a crafted app. Affected are iOS versions prior to 9.3.5; Apple’s security content notes the kernel memory corruption issue was addres...

CVE-2016-6367

The CVE-2016-6367 issue affects Cisco ASA Software on ASA 5500/5500-X, PIX, and FWSM where an authenticated, local attacker can trigger the CLI parser with invalid commands to gain privileges and potentially execute code or cause DoS. The root cause is improper handling of invalid CLI input in th...

CVE-2016-6366

CVE-2016-6366 is a buffer overflow in Cisco ASA software (SNMP code) that allows an authenticated, remote attacker to cause a reload or remotely execute code via crafted IPv4 SNMP packets. The vulnerability affects multiple Cisco devices and ASA platforms, including ASA 5500, 5500-X, ASA Services...

CVE-2016-3311

CVE-2016-3311 is a Windows kernel-mode driver elevation of privilege vulnerability affecting multiple Windows versions (Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, 8.1, Server 2012, Windows RT 8.1, and Windows 10 variants). The issue arises in Win32k kernel components where a crafted applicatio...

CVE-2016-3309

CVE-2016-3309 is a Windows kernel Win32k elevation-of-privilege vulnerability. A local attacker could gain SYSTEM privileges by exploiting a pool/handle-management issue in win32k, enabling code execution in kernel mode. Connected sources document an exploit (win32kfull!bFill pool overflow) and i...

CVE-2016-3310

CVE-2016-3310 is a Win32k Elevation of Privilege vulnerability affecting multiple Windows versions. The issue arises in kernel‑mode drivers where improper handling of memory objects enables a local user to execute code with SYSTEM privileges via a crafted application. This is a local, non‑authent...

CVE-2016-3308

Technical details for CVE-2016-3308 are not publicly available in the provided documents; monitor for updates.

CVE-2016-3643

SolarWinds Virtualization Manager

CVE-2016-4171

CVE-2016-4171 is an unspecified memory-corruption vulnerability in Adobe Flash Player 21.0.0.242 and earlier that allows remote code execution. The vulnerability was leveraged in the wild in June 2016. Affected product: Flash Player. Root cause and exact vectors are not detailed in the provided d...

CVE-2016-3235

CVE-2016-3235 corresponds to a Microsoft Office OLE DLL side-loading vulnerability. Affected products include Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016 and Visio Viewer (2007/2010 variants). The root cause is improper library loading validation, allowing a crafted file or applica...

CVE-2016-4523

CVE-2016-4523 affects Trihedral VTScada (VTS) WAP interface on Windows, with VTScada versions 8.x through 11.x prior to 11.2.02. The vulnerability allows remote attackers to cause a denial of service via an out-of-bounds read that crashes the application. Public disclosures and mitigations descri...

CVE-2016-4437

The CVE-2016-4437 issue affects Apache Shiro before 1.2.5 when no cipher key is configured for the rememberMe feature, enabling remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. Public advisories describe an RCE condition with ...

CVE-2016-3088

CVE-2016-3088 affects Apache ActiveMQ 5.x prior to 5.14.0. The Fileserver web application vulnerable to remote code execution via an HTTP PUT followed by an HTTP MOVE request allows an attacker to upload and execute arbitrary files on the server. Connected PoC repositories describe Python-based a...

CVE-2010-5326

The CVE-2010-5326 issue affects SAP NetWeaver Application Server Java, specifically the Invoker Servlet, and is exploitable without authentication. Affected are SAP NetWeaver AS Java platforms possibly older than version 7.3, where an unauthenticated HTTP/HTTPS request can trigger remote code exe...

CVE-2016-0185

CVE-2016-0185 affects Windows Media Center on Vista SP2, Windows 7 SP1, and Windows 8.1. The vulnerability allows remote code execution when a user opens a specially crafted Media Center link (.mcl) file. Root cause: Windows Media Center mishandles paths in the Run parameter of the Application ta...

CVE-2016-0187

Technical details for CVE-2016-0187 are not provided in the connected documents. The sources discuss related CVEs (e.g., CVE-2016-0189) and EK activity, but no product/version/impact specifics or remediation for 2016-0187 are given.

CVE-2016-0189

CVE-2016-0189 is a memory-corruption flaw in Microsoft JScript/VBScript engines used by Internet Explorer 9–11 that attackers could trigger via crafted web content to achieve remote code execution or memory corruption. Connected sources show exploitation within exploit kits (notably Neutrino/Nept...

CVE-2016-4117

CVE-2016-4117 affects Adobe Flash Player (earlier than 21.0.0.196) via an out-of-bounds access in the DeleteRangeTimelineOperation module of the SWF runtime, caused by a type-confusion vulnerability. This allows memory corruption and arbitrary code execution, as demonstrated by FireEye researcher...