CVE & Exploit Intelligence Database

CVE-2016-5190 6.3 MEDIUM EPSS 0.01

Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled object lifecycles during shutdown, which allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.

CWE-416 Dec 18, 2016

CVE-2016-5189 6.5 MEDIUM EPSS 0.00

Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted navigation to blob URLs with non-canonical origins, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.

CWE-284 Dec 18, 2016

CVE-2016-5188 4.3 MEDIUM EPSS 0.00

Multiple issues in Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux allow a remote attacker to spoof various parts of browser UI via crafted HTML pages.

CWE-20 Dec 18, 2016

CVE-2016-5187 6.5 MEDIUM EPSS 0.00

Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.

CWE-20 Dec 18, 2016

CVE-2016-5186 5.3 MEDIUM EPSS 0.00

Devtools in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android incorrectly handled objects after a tab crash, which allowed a remote attacker to perform an out of bounds memory read via crafted PDF files.

CWE-125 Dec 18, 2016

CVE-2016-5181 6.1 MEDIUM EPSS 0.00

Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android permitted execution of v8 microtasks while the DOM was in an inconsistent state, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages.

CWE-79 Dec 18, 2016

CVE-2016-9998 6.1 MEDIUM EPSS 0.00

SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/info_plugin.php involving the `$plugin` parameter, as demonstrated by a /ecrire/?exec=info_plugin URL.

CWE-79 Dec 17, 2016

CVE-2016-9997 6.1 MEDIUM EPSS 0.00

SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/puce_statut.php involving the `$id` parameter, as demonstrated by a /ecrire/?exec=puce_statut URL.

CWE-79 Dec 17, 2016

CVE-2016-9951 6.5 MEDIUM 1 PoC Analysis EPSS 0.08

An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK.

CWE-284 Dec 17, 2016

CVE-2016-9159 5.9 MEDIUM EPSS 0.00

A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices.

CWE-200 Dec 17, 2016

CVE-2016-8827 6.5 MEDIUM EPSS 0.06

NVIDIA GeForce Experience 3.x before GFE 3.1.0.52 contains a vulnerability in NVIDIA Web Helper.exe where a local web API endpoint, /VisualOPS/v.1.0./, lacks proper access control and parameter validation, allowing for information disclosure via a directory traversal attack.

CWE-22 Dec 16, 2016

CVE-2016-8826 5.5 MEDIUM EPSS 0.00

All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys for Windows or nvidia.ko for Linux) where a user can cause a GPU interrupt storm, leading to a denial of service.

CWE-399 Dec 16, 2016

CVE-2016-8820 6.1 MEDIUM EPSS 0.00

All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where a check on a function return value is missing, potentially allowing an uninitialized value to be used as the source of a strcpy() call, leading to denial of service or information disclosure.

CWE-20 Dec 16, 2016

CVE-2016-9964 6.5 MEDIUM 1 Writeup EPSS 0.01

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

CWE-93 Dec 16, 2016

CVE-2016-3129 6.6 MEDIUM EPSS 0.02

A remote shell execution vulnerability in the BlackBerry Good Enterprise Mobility Server (GEMS) implementation of the Apache Karaf command shell in GEMS versions 2.1.5.3 to 2.2.22.25 allows remote attackers to obtain local administrator rights on the GEMS server via commands executed on the Karaf command shell.

Dec 16, 2016

CVE-2015-3271 5.3 MEDIUM 2 PoCs Analysis EPSS 0.01

Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.

CWE-200 Dec 15, 2016

CVE-2016-7891 6.1 MEDIUM EPSS 0.01

Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.

CWE-79 Dec 15, 2016

CVE-2016-7888 5.3 MEDIUM EPSS 0.02

Adobe Digital Editions versions 4.5.2 and earlier has an important vulnerability that could lead to memory address leak.

CWE-200 Dec 15, 2016

CVE-2016-7884 6.1 MEDIUM EPSS 0.01

Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks.

CWE-79 Dec 15, 2016

CVE-2016-7883 6.1 MEDIUM EPSS 0.01

Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks.

CWE-79 Dec 15, 2016