CVE & Exploit Intelligence Database

CVE-2016-1760 6.2 MEDIUM EPSS 0.00

The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app.

CWE-284 Mar 29, 2016

CVE-2016-1314 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager (CDM) 8.1(1) allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCux80760.

CWE-79 Mar 28, 2016

CVE-2016-3119 5.3 MEDIUM EPSS 0.09

The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

Mar 26, 2016

CVE-2016-1344 5.9 MEDIUM EPSS 0.03

The IKEv2 implementation in Cisco IOS 15.0 through 15.6 and IOS XE 3.3 through 3.17 allows remote attackers to cause a denial of service (device reload) via fragmented packets, aka Bug ID CSCux38417.

CWE-399 Mar 26, 2016

CVE-2016-1160 6.1 MEDIUM EPSS 0.00

Cross-site scripting (XSS) vulnerability in the WP Favorite Posts plugin before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CWE-79 Mar 26, 2016

CVE-2016-2340 5.4 MEDIUM EPSS 0.00

The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Mar 25, 2016

CVE-2016-1366 6.5 MEDIUM EPSS 0.00

The SCP and SFTP modules in Cisco IOS XR 5.0.0 through 5.2.5 on Network Convergence System 6000 devices use weak permissions for system files, which allows remote authenticated users to cause a denial of service (overwrite) via unspecified vectors, aka Bug ID CSCuw75848.

CWE-264 Mar 24, 2016

CVE-2016-1788 5.9 MEDIUM EPSS 0.01

Messages in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 does not properly implement a cryptographic protection mechanism, which allows remote attackers to read message attachments via vectors related to duplicate messages.

CWE-310 Mar 24, 2016

CVE-2016-1787 5.3 MEDIUM EPSS 0.00

Wiki Server in Apple OS X Server before 5.1 allows remote attackers to obtain sensitive information from Wiki pages via unspecified vectors.

CWE-200 Mar 24, 2016

CVE-2016-1786 5.4 MEDIUM EPSS 0.00

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles HTTP responses with a 3xx (aka redirection) status code, which allows remote attackers to spoof the displayed URL, bypass the Same Origin Policy, and obtain sensitive cached information via a crafted web site.

CWE-200 Mar 24, 2016

CVE-2016-1785 6.5 MEDIUM EPSS 0.00

The Page Loading implementation in WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles character encoding during access to cached data, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.

CWE-200 Mar 24, 2016

CVE-2016-1784 6.5 MEDIUM EPSS 0.01

The History implementation in WebKit in Apple iOS before 9.3, Safari before 9.1, and tvOS before 9.2 allows remote attackers to cause a denial of service (resource consumption and application crash) via a crafted web site.

CWE-400 Mar 24, 2016

CVE-2016-1782 6.5 MEDIUM EPSS 0.01

WebKit in Apple iOS before 9.3 and Safari before 9.1 does not properly restrict redirects that specify a TCP port number, which allows remote attackers to bypass intended port restrictions via a crafted web site.

CWE-284 Mar 24, 2016

CVE-2016-1781 4.3 MEDIUM EPSS 0.00

WebKit in Apple iOS before 9.3 and Safari before 9.1 mishandles attachment URLs, which makes it easier for remote web servers to track users via unspecified vectors.

CWE-19 Mar 24, 2016

CVE-2016-1780 4.3 MEDIUM EPSS 0.00

WebKit in Apple iOS before 9.3 does not prevent hidden web views from reading orientation and motion data, which allows remote attackers to obtain sensitive information about a device's physical environment via a crafted web site.

CWE-200 Mar 24, 2016

CVE-2016-1779 6.5 MEDIUM EPSS 0.08

WebKit in Apple iOS before 9.3 and Safari before 9.1 allows remote attackers to bypass the Same Origin Policy and obtain physical-location data via a crafted geolocation request.

CWE-200 Mar 24, 2016

CVE-2016-1776 5.3 MEDIUM EPSS 0.00

Web Server in Apple OS X Server before 5.1 does not properly restrict access to .DS_Store and .htaccess files, which allows remote attackers to obtain sensitive configuration information via an HTTP request.

CWE-284 Mar 24, 2016

CVE-2016-1774 5.3 MEDIUM EPSS 0.00

The Time Machine server in Server App in Apple OS X Server before 5.1 does not notify the user about ignored permissions during a backup, which makes it easier for remote attackers to obtain sensitive information in opportunistic circumstances by reading backup data that lacks intended restrictions.

CWE-284 Mar 24, 2016

CVE-2016-1772 4.3 MEDIUM EPSS 0.00

The Top Sites feature in Apple Safari before 9.1 mishandles cookie storage, which makes it easier for remote web servers to track users via unspecified vectors.

CWE-200 Mar 24, 2016

CVE-2016-1771 6.5 MEDIUM EPSS 0.00

The Downloads feature in Apple Safari before 9.1 mishandles file expansion, which allows remote attackers to cause a denial of service via a crafted web site.

CWE-19 Mar 24, 2016