Microsoft Windows True Type Font Parsing Elevation of Privilege (MS16-120: CVE-2016-7182)

A memory corruption vulnerability exists in the Win32k-GDI component. The vulnerability is due to the way Windows Graphics Component handles objects in memory. An attacker who successfully exploits this vulnerability could run arbitrary code in kernel mode...

Microsoft Browser Information Disclosure (MS16-118: CVE-2016-3298)

An information disclosure vulnerability exists in Internet Explorer. The vulnerability is due to the way Internet Explorer improperly handles objects in memory. A remote attacker could exploit this vulnerability by enticing the target user to open a specially crafted website...

Microsoft Browser Elevation of Privilege (MS16-118: CVE-2016-3388)

An Elevation of Privileges vulnerability exists in Internet Explorer and Edge. The vulnerability is due to a failure in properly securing a private namespace. A remote attacker could exploit this vulnerability by enticing a user to run a specially crafted executable...

Adobe Flash Player Memory Corruption (APSB16-32: CVE-2016-4273)

A memory corruption vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Microsoft Edge Scripting Engine Memory Corruption (MS16-119: CVE-2016-7190)

A memory corruption vulnerability exists in Microsoft Edge. The vulnerability is due to the way Chakra JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Microsoft Win32k Elevation of Privilege (MS16-123: CVE-2016-3266)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is caused when the Windows kernel-mode driver fails to properly handle objects in memory. A remote attacker could exploit this vulnerability by running a specially crafted application...

Microsoft Browser Memory Corruption (MS16-118: CVE-2016-3331)

A remote code execution vulnerability exists in Internet Explorer. The vulnerability is due to the way Internet Explorer accesses objects in memory. A remote attacker can exploit this vulnerability by enticing a user to open a specially crafted website...

Microsoft Windows Kernel Local Elevation of Privilege (MS16-124: CVE-2016-0079)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to the way Windows kernel API improperly allows a user to access sensitive registry information. A remote attacker can exploit this vulnerability by enticing a user to run a specially crafted executable...

Microsoft Windows Kernel Local Elevation of Privilege (MS16-124: CVE-2016-0073)

An elevation of privilege vulnerability exists in the Windows Kernel. The vulnerability is caused when Microsoft Windows improperly deals with one of its kernel components. A successful exploitation could allow an attacker to run arbitrary code with elevated privileges...

Microsoft Scripting Engine Memory Corruption (MS16-119: CVE-2016-7194)

A memory corruption vulnerability exists in Microsoft Edge. The vulnerability is due to the way Chakra JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

Microsoft Windows True Type Font Parsing Information Disclosure (MS16-120: CVE-2016-3209)

An information disclosure vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the True Type Font TTF driver handles objects in memory. A remote attacker could exploit this vulnerability by enticing a target user to open a specially crafted EMF fil...

Railo Remote File Include (CVE-2014-5468)

This module exploits a remote file include vulnerability in Railo. A vulnerability in thumbnail.cfm allows an attacker to download an arbitrary PNG file, and by taking advantage of a directory traversal, an attacker can append cold fusion markup to the PNG file, and have it interpreted by the...

Drupal Sensitive Core Files Information Disclosure (CVE-2016-7572)

An information disclosure vulnerability exists in Drupal Core. Successful exploitation of this vulnerability could allow a remote attacker to download local files, and may lead to disclosure of database credentials...

Nuuo NVR PHP System Function Unauthenticated Remote Code Execution (CVE-2016-5675)

A remote code execution was discovered in Nuuo Network Video Recording systems with Network Attached Storage. The vulnerability is due to fails in sanitising by the PHP system function. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...

Nuuo NVR Log Parameter Unauthenticated Remote Code Execution (CVE-2016-5674)

A remote code execution was discovered in Nuuo Network Video Recording systems with Network Attached Storage. The vulnerability is due to Improper Input Validation in log parameter. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...

Foxit Reader GoToR Action Stack Buffer Overflow

A stack buffer overflow vulnerability has been reported in Foxit Reader. The vulnerability is due improper handling of the GoToR action. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted pdf file. Successful exploitation could allow...

DNS Server Bind 9 Response Message Rendering Denial of Service (CVE-2016-2776)

A denial-of-service vulnerability exists in DNS Servers due to a defect in the rendering of messages into packets. A remote attacker may send a specifically modified request in order to trigger the vulnerability...

Tuleap PHP Unserialize Code Execution (CVE-2014-8791)

This module exploits a PHP object injection vulnerability. Tuelap could be abused to allow authenticated users to execute arbitrary code with the permissions of the web server. This could lead to execute PHP code on the server...

Microsoft Excel Files Containing Malicious Macro

Microsoft Excel files might contain a malicious macros. A remote attacker could send spam e-mails including those macros, and use social engineering in order to convince users to manually enable them. This would allow the malicious code to run and infect the target system...

OpenSSH kbdint_next_device Policy Bypass (CVE-2015-5600)

A policy bypass vulnerability exists in OpenSSH. The vulnerability is due to a flaw in the kbdintnextdevice function. An unauthorized, remote attacker can exploit this vulnerability causing the vulnerable server to try the authentication method an arbitrary number of times, effectively allowing t...

Flash File Suspicious Downloader

A Trojan exists to agent.get in Flash. A remote attacker can exploit this vulnerability by using a suspicious file downloader on the targeted system...

PHP WDDX Deserialization Use After Free (CVE-2016-7413)

A Use-After-Free vulnerability exists in PHP during deserialization of WDDX elements. A remote attacker can exploit this vulnerability by supplying a crafted wddxPacket XML document. A successful attack can result in a denial of service...

SixApart MovableType Storable Perl Code Execution (CVE-2015-1592)

A vulnerability was discovered in SixApart MovableType. This is due to a vulnerability of storable perl module. A remote attacker can exploit this weakness by execute arbitrary code via a crafted request...

Weak SSL 3DES Cipher Suites (CVE-2016-2183)

3DES is a widely supported stream cipher often preferred by TLS servers and other servers using encrypted sessions. Recent cryptanalysis results one of which is the SWEET32 exploit biases in the 3DES keystroke to recover repeatedly encrypted plain-texts. As a result 3DES can no longer be seen as...

Accellion FTA getStatus verify_oauth_token Command Execution (CVE-2015-2857)

A command execution vulnerability exists in Accellion File Transfer appliance. The vulnerability is due to insufficient sanitization of the oauthtoken parameter. A remote attacker can exploit this vulnerability by sending crafted request to the affected appliance...

Kaseya Virtual System Administrator Multiple Vulnerabilities (CVE-2015-6922)

Multiple vulnerabilities exists in Kaseya Virtual System Administrator. These vulnerabilities includes privilege escalation to "Master Admin" and multiple remote code execution vulnerabilities. Successful exploitation of these vulnerabilities could lead to remote execution of arbitrary code under...

OpenSSL OCSP Extension Unbounded Memory Denial of Service (CVE-2016-6304)

A denial-of-service vulnerability exists in OpenSSL. A remote, unauthenticated attacker can send an excessively large OCSP Status Request extension and create a denial of service condition...

Trend Micro Control Manager TreeUserControl_process_tree_event Information Disclosure

An XML external entity XXE processing vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of user-supplied input prior to executing an XML query in TreeUserControlprocesstreeevent.aspx. A remote, authenticated attacker could exploit this...

SugarCRM REST Unserialize PHP Code Execution

A PHP code execution vulnerability exists in SugarCRM. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Trend Micro Control Manager task_controller Information Disclosure

An information disclosure vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation of the 'url' parameter in the request for taskcontrol.php. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted HT...

MySQL Remote Code Execution (CVE-2016-6662; CVE-2016-6663; CVE-2016-6664)

A code execution vulnerability exists in MySQL database server. Successful exploitation could allow a remote attacker to shut down the database, modify its content, or execute arbitrary code on the affected servers...

Realtek SDK Miniigd AddPortMapping SOAP Action Command Injection (CVE-2014-8361)

A command injection vulnerability exists in Realtek SDK. The vulnerability is due to lack of input sanitization on user-supplied data when processing the NewInternalClient requests to the miniigd SOAP service. By sending a crafted SOAP request to the affected service, a remote unauthenticated...

D.R. Software Easy CD-DA Recorder PLS Buffer Overflow (CVE-2010-2343)

A buffer overflow vulnerability has been reported in Easy CD-DA Recorder. The vulnerability is due to an overlong string in a playlist entry. Successfully exploatetion of this issue may allow remote attackers to execute arbitrary code in the context of the application...

Cisco IKEv1 Information Disclosure (BENIGNCERTAIN; CVE-2016-6415)

A vulnerability exists in IKEv1 packet processing code in Cisco IOS, Cisco IOS XE and Cisco IOS XR Software. The vulnerability , known as Pix Pocket, is due to insufficient condition checks in the IKEv1 security negotiation requests. A successful could cause disclosure of confidential information...

Nagios Network Analyzer Report Generator Command Injection

A command injection vulnerability exists in Nagios Network Analyzer. The vulnerability is due to improper validation of user-supplied input. A remote, authenticated attacker could exploit this vulnerability by sending maliciously crafted HTTP requests to the target server. Successful exploitation...

Trend Micro Control Manager AdHocQuery_Processor.aspx SQL Injection

A SQL injection vulnerability has been reported in Trend Micro Control Manager. The vulnerability is due to lack of validation on two parameters in the AdHocQueryProcessor.aspx script. A remote, authenticated attacker could exploit this vulnerability by sending a malicious HTTP request to the...

Suspicious Crafted PDF File

A remote code execution vulnerability exists in Adobe Reader, and possibly in additional PDF file readers. The vulnerability is due to the way a PDF file can be embedded inside another PDF file. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted PDF...

Mantis Bug Tracker Filter API view_type Cross Site Scripting (CVE-2016-6837)

A cross-site scripting vulnerability exists in the Filter API component of Mantis Bug Tracker. The vulnerability is due to insufficient input validation on the viewtype parameter in viewallbugpage.php. A remote attacker could exploit this vulnerability by enticing authenticated users to click on ...

Micro Focus NetIQ Sentinel Server SentinelContext Authentication Bypass (CVE-2016-1605)

The vulnerability is due to a flaw in SentinelContext Java class that allows a user to retrieve a valid authentication cookie from the vulnerable server by providing "admin" user name in an HTTP request. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted HTTP...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4275)

A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Suspicious Metadata Mail Phishing Containing Attachment

Mail attachment containing a malicious downloader was observed as part of ransomware campaigns. A remote attacker could send spam e-mails including those downloaders and convince users to manually enable them. This would allow the malicious code to run and infect the target system...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4283)

A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4285)

A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4276)

A memory corruption vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Adobe Flash Player Security Bypass (APSB16-29: CVE-2016-4277)

A security bypass vulnerability exists in Adobe Flash Player. The vulnerability is due to insufficient security restrictions while handling specially crafted URL of a HTTP request to SWF file. Successful exploitation could lead to information disclosure...

Micro Focus NetIQ Sentinel Server ReportViewServlet Directory Traversal (CVE-2016-1605)

The vulnerability is due to insufficient validation of fileName parameter within the ReportViewServlet servlet. A remote, authenticated attacker could exploit this vulnerability by sending crafted HTTP requests to the target server. Successful exploitation allows the attacker to read the content ...

ISC BIND lwresd Query Name Denial of Service (CVE-2016-2775)

A denial-of-service vulnerability exists in ISC BIND. The vulnerability is due to failure to check the query length when using lightweight resolver protocol. A remote, unauthenticated attacker could exploit this vulnerability by sending crafted queries potentially leading to denial-of-service...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4281)

A memory corruption vulnerability exists in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

Adobe Flash Player Type Confusion (APSB16-29: CVE-2016-4280)

A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a type confusion condition while handling a malformed SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file. Successful exploitation...

Suspicious Microsoft Publisher Mail Attachment

Microsoft Office Publisher files might contain a malicious downloader. A remote attacker could send spam e-mails including those downloaders, and use social engineering in order to convince users to manually enable them. This would allow the malicious code to run and infect the target system...