CVE & Exploit Intelligence Database

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

338,223 CVEs tracked 53,271 with exploits 4,730 exploited in wild 1,542 CISA KEV 3,929 Nuclei templates 37,826 vendors 42,547 researchers

110,849 results Clear all

CVE-2015-2012 4.0 MEDIUM EPSS 0.00

IBM Websphere MQ - Information Disclosure

The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.

CWE-200 Feb 08, 2016

CVE-2016-0723 6.8 MEDIUM EPSS 0.00

Linux kernel <4.4.1 - Info Disclosure/DoS

Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.

CWE-362 Feb 08, 2016

CVE-2015-8785 6.2 MEDIUM EPSS 0.00

Linux Kernel < 4.4 - Infinite Loop

The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.

CWE-835 Feb 08, 2016

CVE-2015-8767 6.2 MEDIUM EPSS 0.00

Linux Kernel < 4.3 - Race Condition

net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does not properly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call.

CWE-362 Feb 08, 2016

CVE-2015-8575 4.0 MEDIUM EPSS 0.00

Linux kernel <4.3.4 - Info Disclosure

The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.

CWE-200 Feb 08, 2016

CVE-2015-7566 4.6 MEDIUM 1 PoC Analysis EPSS 0.00

Linux kernel <4.4.1 - DoS

The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.

CVE-2015-7550 5.5 MEDIUM EPSS 0.00

Linux kernel <4.3.4 - DoS

The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls.

CWE-362 Feb 08, 2016

CVE-2015-7513 6.5 MEDIUM EPSS 0.00

Linux kernel <4.4 - DoS

arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.

CWE-369 Feb 08, 2016

CVE-2013-4312 6.2 MEDIUM 1 Writeup EPSS 0.00

Oracle Linux < 4.4 - Memory Corruption

The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.

CWE-119 Feb 08, 2016

CVE-2016-1309 6.1 MEDIUM EPSS 0.00

Cisco WebEx Meetings Server 2.5.1.5 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meetings Server 2.5.1.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuy01843.

CWE-79 Feb 07, 2016

CVE-2016-1308 6.5 MEDIUM EPSS 0.00

Cisco Unified Communications Manager <10.5(2.13900.9) - SQL Injection

SQL injection vulnerability in Cisco Unified Communications Manager 10.5(2.13900.9) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCux99227.

CWE-89 Feb 07, 2016

CVE-2016-1307 5.4 MEDIUM EPSS 0.00

Cisco Finesse Desktop <11.0.1 - Auth Bypass

The Openfire server in Cisco Finesse Desktop 10.5(1) and 11.0(1) and Unified Contact Center Express 10.6(1) has a hardcoded account, which makes it easier for remote attackers to obtain access via an XMPP session, aka Bug ID CSCuw79085.

CWE-287 Feb 07, 2016

CVE-2016-1305 6.1 MEDIUM EPSS 0.00

Cisco APIC-EM 1.1 - XSS

Cross-site scripting (XSS) vulnerability in Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) 1.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving HTML entities, aka Bug ID CSCux15511.

CWE-79 Feb 07, 2016

CVE-2016-0813 6.1 MEDIUM EPSS 0.00

Android <5.1.1 LMY49G & <6 - Privilege Escalation

packages/SystemUI/src/com/android/systemui/recents/AlternateRecentsComponent.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.x before 2016-02-01 does not properly check for device provisioning, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25476219.

CWE-264 Feb 07, 2016

CVE-2016-0812 6.1 MEDIUM EPSS 0.00

Android <5.1.1 LMY49G & <6.0 - Privilege Escalation

The interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java in Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and 6.0 before 2016-02-01 does not properly check for setup completion, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 25229538.

CWE-264 Feb 07, 2016

CVE-2016-0808 6.2 MEDIUM EPSS 0.00

Android <5.1.1 LMY49G & <6.x - DoS

Integer overflow in the getCoverageFormat12 function in CmapCoverage.cpp in the Minikin library in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 allows attackers to cause a denial of service (continuous rebooting) via an application that triggers loading of a crafted TTF font, aka internal bug 25645298.

CWE-19 Feb 07, 2016

CVE-2016-1311 6.1 MEDIUM EPSS 0.00

Cisco Jabber Guest Server 10.6(8) - XSS

Cross-site scripting (XSS) vulnerability in the management interface in Cisco Jabber Guest Server 10.6(8) allows remote attackers to inject arbitrary web script or HTML via the host tag parameter, aka Bug ID CSCuy08224.

CWE-79 Feb 06, 2016

CVE-2016-1310 6.1 MEDIUM EPSS 0.00

Cisco Unity Connection 11.5(0.199) - XSS

Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 11.5(0.199) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy09033.

CWE-79 Feb 06, 2016

CVE-2016-1306 6.1 MEDIUM EPSS 0.00

Cisco Fog Director 1.0 - XSS

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Fog Director 1.0(0) allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, aka Bug ID CSCux80466.

CWE-79 Feb 06, 2016

CVE-2015-7916 6.5 MEDIUM EPSS 0.00

Sauter EY-WS505F0x0 moduWeb Vision <1.6.0 - XSS

Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.

CWE-79 Feb 06, 2016