Microsoft Internet Explorer Memory Corruption (MS16-051: CVE-2016-0192)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote attacker can exploit this issue by enticing a victim to open a specially crafted web page that could cause...

Microsoft Internet Explorer Information Disclosure (MS16-051: CVE-2016-0194)

An information disclosure vulnerability exists in Microsoft Internet Explorer. The vulnerability is due to an error in Microsoft Internet Explorer while handling files. A remote attacker can exploit this issue by enticing a user to open a specially crafted web-page with an affected version of...

Microsoft Internet Explorer Memory Corruption (MS16-051: CVE-2016-0189)

A use after free vulnerability exists in Microsoft Internet Explorer. The root cause is a heap corruption when dealing with a corrupted VBScript array size. A successful exploitation of this issue could allow an attacker to execute arbitrary code on the remote system...

Microsoft Internet Explorer Scripting Engine Memory Corruption (MS16-051: CVE-2016-0187)

A use-after-free vulnerability was detected in Microsoft Internet Explorer in the handling of BooleanProtoObj objects. The underlying vulnerability lies in jscript!JSONStringifyArray where a previously released object is reused...

Microsoft Win32k Elevation of Privilege (MS16-062: CVE-2016-0172)

An elevation of privilege vulnerability exists in the Windows Kernel. The vulnerability is caused when Microsoft Windows improperly deals with DC Device context surface. A remote attacker can exploit this vulnerability by running a specially crafted application...

Microsoft Edge Memory Corruption (MS16-052: CVE-2016-0193)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to a type confusion when handling certain objects in JavaScript. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that could...

Microsoft HTTP.sys HTTP 2.0 Denial of Service (MS16-049; CVE-2016-0150)

A denial-of-service vulnerability exists in Microsoft Windows' HTTP 2.0 protocol stack, HTTP.sys. The vulnerability is due to insufficient validation of HTTP 2.0 requests. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP packet to the target...

Microsoft Office Graphics Information Disclosure (MS16-054: CVE-2016-0183)

An information disclosure vulnerability exists in Microsoft Office Graphics. The vulnerability is due to an out of bound memory read resulting in a memory safety issue. A successful exploitation of the issue could allow an attacker to achieve information disclosure...

Microsoft Edge Memory Corruption (MS16-052: CVE-2016-0191)

A remote code execution vulnerability has been reported in Microsoft Edge. The vulnerability is due to a use of uninitialized pointer. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that could cause memory corruption in a way that would...

Microsoft Windows Win32k Elevation of Privilege (MS16-062: CVE-2016-0174)

A use after free vulnerability exists in Microsoft Windows that could be abused by attackers to elevate privileges. The vulnerability is caused when a font object is referenced after being deleted. A remote attacker can exploit this vulnerability by running a specially crafted application...

Microsoft Win32k Elevation of Privilege (MS16-062: CVE-2016-0173)

An elevation of privilege vulnerability exists in the Windows Kernel. The vulnerability is caused when Microsoft Windows improperly deals with DC Device context surface. A remote attacker can exploit this vulnerability by running a specially crafted application...

Microsoft Windows Win32k Elevation of Privilege (MS16-062: CVE-2016-0171)

An elevation of privilege vulnerability exists in the Windows Kernel. The vulnerability is due to the way Windows handles DC surface. A remote attacker can exploit this vulnerability by enticing a user to run a specially crafted application...

Microsoft Graphics Component Remote Code Execution (MS16-055: CVE-2016-0170)

A remote code execution vulnerability exists in Windows Graphics Component. The vulnerability is due to the way Microsoft Windows does not properly handle malformed EMF files. A remote attacker can exploit this vulnerability to execute arbitrary code via a specially crafted request...

Microsoft Windows Graphics Component Information Disclosure (MS16-055: CVE-2016-0169)

Information disclosure vulnerability exists in Windows GDI component. The vulnerability is due to the way Microsoft Graphics Component improperly discloses contents of its memory. An attacker who successfully exploited the vulnerabilities could obtain information to further compromise the users...

Microsoft Windows Graphics Component Information Disclosure (MS16-055: CVE-2016-0168)

A Vulnerability was discovered within Internet explorer when handling a spcially crafted EMF file allowing an information disclosure about the user filesystem. The root cause of the vulnerability is related to the CreateColorSpaceW function that tries to build a file path checking of its existanc...

WordPress Suspicious File Upload (CVE-2020-12800)

A remote attacker can upload a malicious file to WordPress. Successful exploitation could result in the execution of arbitrary code in the security context of the web server...

OpenSSL Padding Oracle Information Disclosure (CVE-2016-2107)

An information disclosure vulnerability exists in the AES-NI implementation of OpenSSL. The vulnerability is due to memory allocation miscalculation during a certain padding check. A remote attacker can exploit this vulnerability to obtain sensitive cleartext information via a padding-oracle atta...

WordPress Header.php Unauthorized Code Injection

A Code Injection vulnerability has been reported in WordPress. Successful exploitation of this vulnerability would allow a remote attacker to redirect the clients who access an Infected WordPress website to an attacker-controlled page, and infect the client host...

ImageMagick Unauthorized File Deletion (CVE-2016-3715)

A file deletion vulnerability has been reported in ImageMagick. The vulnerability is due to insufficient filtering of shell characters. A remote attacker may exploit this issue by sending a crafted request containing such characters. Successful exploitation would allow attackers to delete files i...

Oracle ATS DownloadServlet scriptName Directory Traversal (CVE-2016-0478)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/olt/download" URI with parameter scriptName. A remote unauthenticated attacker can exploit this vulnerability by...

Oracle Application Testing Suite DownloadServlet scriptPath Directory Traversal (CVE-2016-0484)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter scriptPath. A remote, unauthenticated attacker can exploit this vulnerability by...

Oracle Application Testing Suite DownloadServlet file Directory Traversal (CVE-2016-0482)

A directory traversal vulnerability exists in Oracle Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with the "file" parameter. A remote unauthenticated attacker can exploit this vulnerability by sendin...

WordPress Instagram Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Instagram Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress Clikstats Plugin Open Redirection

A website redirection vulnerability exists in WordPress Clickstats Plugin. Successful exploitation of this vulnerability would allow a remote attacker to redirect the clients who access a WordPress website to an attacker-controlled page, and infect the client host...

WordPress Captcha Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Captcha Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress SP Projects and Document Manager Plugin Arbitrary Code Execution

A code execution vulnerability exists in WordPress SP Projects and Document Manager Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress jQuery Html5 File Upload Plugin Arbitrary File Upload

An Arbitrary File Upload vulnerability exists in WordPress jQuery Html5 File Upload Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress iThemes Security Plugin Local File Access

A local file access vulnerability exists in WordPress iThemes Security Plugin. Successful exploitation of this vulnerability could allow an attacker to read and obtain backup and log files from the victim's computer...

WordPress Commentator Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Commentator Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress LeenkMe Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress LeenkMe Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress Comment Rating Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress Comment Rating Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress SP Projects and Document Manager Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress SP Projects and Document Manager Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress DZS Videogallery Plugin Cross-Site Scripting

A cross-site scripting vulnerability exists in WordPress DZS Videogallery Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

PHP ZIP Archive Heap Overflow (CVE-2016-3078)

A heap overflow vulnerability exists in PHP, due to an integer overflow when reading ZIP files. A remote attacker can exploit this vulnerability by sending a crafted ZIP archive to a web application running a vulnerable version of PHP. A successful attack can result in remote code execution under...

WordPress Ocim MP3 Plugin SQL Injection

An SQL injection vulnerability exists in WordPress Ocim MP3 Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

Oracle ATS DownloadServlet exportFileName Directory Traversal (CVE-2016-0486)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter exportFileName. A remote unauthenticated attacker can exploit this vulnerability by...

Apache Struts Dynamic Method Remote Code Execution (CVE-2016-3081)

A remote code execution vulnerability exists in Apache's Struts 2 web application framework. The vulnerability is due to Dynamic Method invocation content. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable server. A successful attac...

Oracle ATS DownloadServlet OTM reportName Directory Traversal (CVE-2016-0485)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter reportName.A remote unauthenticated attacker can exploit this vulnerability by sendi...

Microsoft Office RTF Embedded Object Remote Code Execution

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office handles objects in memory while parsing specially crafted Office files. A remote attacker can exploit this issue by enticing a user to open a specially crafted file a...

Oracle ATS DownloadServlet TMAPReportImage Directory Traversal (CVE-2016-0480)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter TMAPReportImage. A remote unauthenticated attacker can exploit this vulnerability by...

Oracle ATS DownloadServlet scheduleReportName Directory Traversal (CVE-2016-0481)

A directory traversal vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/otm/download" URI with parameter scheduleReportName. A remote unauthenticated attacker can exploit this vulnerability...

Oracle Application Testing Suite DownloadServlet scenario Directory Traversal (CVE-2016-0477)

A directory traversal vulnerability exists in the in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests to the "/olt/download" URI. A remote unauthenticated attacker can exploit this vulnerability by sending a malicious...

Suspicious Sender Mail Phishing Attempt

Phishing and ransomware emails are often sent from known suspicious domains. E-mails sent from such domains might be indicative of phishing attempt, ransomware, or other attempts to compromise the network...

PayPal Mail Phishing Containing Attachment

Genuine email from PayPal will never include attachments. A remote attacker could send spam PayPal e-mails including those malicious attachments and convince users to manually enable them. This would allow the malicious code to run and infect the target system...

Advantech WebAccess multiple services Buffer Overflow (CVE-2016-0856)

A buffer overflow vulnerability has been reported in the webvrpcs and datacore service of Advantech WebAccess. The vulnerability is due to an insecure call to some functions. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted request to the target...

Microsoft .NET Framework mscoreei.dll Insecure Library Loading (MS16-041; CVE-2016-0148)

An insecure library loading vulnerability exists in Microsoft Windows. The vulnerability is due to the way that the affected component handles the loading of dynamic link library .DLL files. A remote attacker could exploit this vulnerability by enticing a target user to open an Office file from a...

Apache Jetspeed Privilege Escalation

A privilege escalation vulnerability exists in Apache Jetspeed. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

Apache Jetspeed Remote Code Execution (CVE-2016-0709)

A code execution vulnerability exists Apache Jetspeed. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apache Jetspeed SQL Injection (CVE-2016-0710)

An SQL injection vulnerability exists in Apache Jetspeed. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

ZTE F460/F660 Backdoor Unauthorized Access (CVE-2014-2321)

An Unauthorized Access Vulnerability exists in ZTE F460 and F660 cable modems. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands with administrator level access on the affected device...