CVE & Exploit Intelligence Database

CVE-2016-1000127 6.1 MEDIUM NUCLEI EPSS 0.02

Reflected XSS in wordpress plugin ajax-random-post v2.00

CWE-79 Oct 10, 2016

CVE-2016-1000126 6.1 MEDIUM NUCLEI EPSS 0.02

Reflected XSS in wordpress plugin admin-font-editor v1.8

CWE-79 Oct 10, 2016

CVE-2016-8100 5.5 MEDIUM EPSS 0.00

Intel Integrated Performance Primitives (aka IPP) Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via a side-channel attack.

CWE-200 Oct 10, 2016

CVE-2016-7423 4.4 MEDIUM EPSS 0.00

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

Oct 10, 2016

CVE-2016-7099 5.9 MEDIUM EPSS 0.01

The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

CWE-19 Oct 10, 2016

CVE-2016-5325 6.1 MEDIUM EPSS 0.01

CRLF injection vulnerability in the ServerResponse#writeHead function in Node.js 0.10.x before 0.10.47, 0.12.x before 0.12.16, 4.x before 4.6.0, and 6.x before 6.7.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the reason argument.

CWE-113 Oct 10, 2016

CVE-2016-6690 5.5 MEDIUM 1 PoC Analysis EPSS 0.00

The sound driver in the kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Nexus Player devices allows attackers to cause a denial of service (reboot) via a crafted application, aka internal bug 28838221.

CWE-284 Oct 10, 2016

CVE-2016-6689 5.5 MEDIUM 1 PoC Analysis EPSS 0.01

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347.

CWE-200 Oct 10, 2016

CVE-2016-6688 5.5 MEDIUM EPSS 0.00

The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30593080.

CWE-200 Oct 10, 2016

CVE-2016-6687 5.5 MEDIUM EPSS 0.00

The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30162222.

CWE-200 Oct 10, 2016

CVE-2016-6686 5.5 MEDIUM EPSS 0.00

The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30163101.

CWE-200 Oct 10, 2016

CVE-2016-6685 5.5 MEDIUM EPSS 0.00

The kernel in Android before 2016-10-05 on Nexus 6P devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30402628.

CWE-200 Oct 10, 2016

CVE-2016-6684 5.5 MEDIUM EPSS 0.00

The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30148243.

CWE-200 Oct 10, 2016

CVE-2016-6683 5.5 MEDIUM EPSS 0.00

The kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30143283.

CWE-200 Oct 10, 2016

CVE-2016-6682 5.5 MEDIUM EPSS 0.00

drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 30152501 and Qualcomm internal bug CR 1049615.

CWE-200 Oct 10, 2016

CVE-2016-6681 5.5 MEDIUM EPSS 0.00

drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 30152182 and Qualcomm internal bug CR 1049521.

CWE-200 Oct 10, 2016

CVE-2016-6679 5.5 MEDIUM EPSS 0.00

CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes a setwpaie ioctl call, aka Android internal bug 29915601 and Qualcomm internal bug CR 1000913.

CWE-200 Oct 10, 2016

CVE-2016-6678 5.5 MEDIUM EPSS 0.00

The Motorola USBNet driver in Android before 2016-10-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 29914434.

CWE-200 Oct 10, 2016

CVE-2016-6677 5.5 MEDIUM EPSS 0.00

The NVIDIA GPU driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30259955.

CWE-200 Oct 10, 2016

CVE-2016-5348 5.9 MEDIUM 1 PoC Analysis EPSS 0.10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service (memory consumption, and device hang or reboot) via a large xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 29555864.

CWE-399 Oct 10, 2016