deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5338
Published: 2016-06-14
Description: The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the QEMU host via vectors related to the information transfer buffer.
CVSS Score: 7.8 (HIGH)
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ff589551c8e8e9e95e211b9d8daafb4ed39f1aec; http://www.openwall.com/lists/oss-security/2016/06/07/3; http://www.openwall.com/lists/oss-security/2016/06/08/14
CVE: CVE-2016-5365
Published: 2016-06-14
Description: Stack-based buffer overflow in Huawei Honor WS851 routers with software 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges via unspecified vectors, aka HWPSIRT-2016-05051.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE: CVE-2016-5366
Published: 2016-06-14
Description: Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to modify configuration data via vectors related to a "file injection vulnerability," aka HWPSIRT-2016-05052.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE: CVE-2016-5367
Published: 2016-06-14
Description: Huawei Honor WS851 routers with software 1.1.21.1 and earlier allow remote attackers to obtain sensitive information via unspecified vectors, aka HWPSIRT-2016-05053.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160607-01-honorrouter-en
CVE: CVE-2016-0025
Published: 2016-06-16
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1036093; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070; http://www.securitytracker.com/id/1036093
CVE: CVE-2016-0028
Published: 2016-06-16
Description: Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative Update 1 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, aka "Microsoft Exchange Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036106; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-079; http://www.securitytracker.com/id/1036106
CVE: CVE-2016-0199
Published: 2016-06-16
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and CVE-2016-3211.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://packetstormsecurity.com/files/137533/Microsoft-Internet-Explorer-11-Garbage-Collector-Attribute-Type-Confusion.html; http://seclists.org/fulldisclosure/2016/Jun/44; http://www.securityfocus.com/archive/1/538706/100/0/threaded
CVE: CVE-2016-0200
Published: 2016-06-16
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-3211.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.zerodayinitiative.com/advisories/ZDI-16-365; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3198
Published: 2016-06-16
Description: Microsoft Edge allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted document, aka "Microsoft Edge Security Feature Bypass."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254
References: http://www.securitytracker.com/id/1036099; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068; http://www.securitytracker.com/id/1036099
CVE: CVE-2016-3199
Published: 2016-06-16
Description: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3214.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1036099; http://www.zerodayinitiative.com/advisories/ZDI-16-367; http://www.zerodayinitiative.com/advisories/ZDI-16-368
CVE: CVE-2016-3201
Published: 2016-06-16
Description: Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3215.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036099; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-080
CVE: CVE-2016-3202
Published: 2016-06-16
Description: The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.securitytracker.com/id/1036099; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3203
Published: 2016-06-16
Description: Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbitrary code via a crafted PDF document, aka "Windows PDF Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/91086; http://www.securitytracker.com/id/1036099; http://www.zerodayinitiative.com/advisories/ZDI-16-369
CVE: CVE-2016-3205
Published: 2016-06-16
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3206 and CVE-2016-3207.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.securitytracker.com/id/1036097; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3206
Published: 2016-06-16
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3205 and CVE-2016-3207.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.securitytracker.com/id/1036097; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3207
Published: 2016-06-16
Description: The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3205 and CVE-2016-3206.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.securitytracker.com/id/1036097; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3210
Published: 2016-06-16
Description: The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91106; http://www.securitytracker.com/id/1036096; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3211
Published: 2016-06-16
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0199 and CVE-2016-0200.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1036096; http://www.zerodayinitiative.com/advisories/ZDI-16-366; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3212
Published: 2016-06-16
Description: The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/91105; http://www.securitytracker.com/id/1036096; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3213
Published: 2016-06-16
Description: The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 9 through 11 has an improper fallback mechanism, which allows remote attackers to gain privileges via NetBIOS name responses, aka "WPAD Elevation of Privilege Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036096; http://www.securitytracker.com/id/1036104; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-063
CVE: CVE-2016-3214
Published: 2016-06-16
Description: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3199.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1036099; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068; http://www.securitytracker.com/id/1036099
CVE: CVE-2016-3215
Published: 2016-06-16
Description: Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted PDF document, aka "Windows PDF Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3201.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036099; http://www.zerodayinitiative.com/advisories/ZDI-16-370; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068
CVE: CVE-2016-3216
Published: 2016-06-16
Description: GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to bypass the ASLR protection mechanism via unspecified vectors, aka "Windows Graphics Component Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036101; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-074; https://www.exploit-db.com/exploits/39990/
CVE: CVE-2016-3218
Published: 2016-06-16
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3221.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036109; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-073; http://www.securitytracker.com/id/1036109
CVE: CVE-2016-3219
Published: 2016-06-16
Description: The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036101; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-074; https://www.exploit-db.com/exploits/39993/
CVE: CVE-2016-3220
Published: 2016-06-16
Description: atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "ATMFD.dll Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036101; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-074; https://www.exploit-db.com/exploits/39991/
CVE: CVE-2016-3221
Published: 2016-06-16
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3218.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036109; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-073; http://www.securitytracker.com/id/1036109
CVE: CVE-2016-3222
Published: 2016-06-16
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://packetstormsecurity.com/files/140043/Microsoft-Edge-CBase-Scriptable-Private-Query-Interface-Memory-Corruption.html; http://seclists.org/fulldisclosure/2016/Dec/16
CVE: CVE-2016-3223
Published: 2016-06-16
Description: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle LDAP authentication, which allows man-in-the-middle attackers to gain privileges by modifying group-policy update data within a domain-controller data stream, aka "Group Policy Elevation of Privilege Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/138248/Microsoft-Windows-7-Group-Policy-Privilege-Escalation.html; http://www.securitytracker.com/id/1036100; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-072
CVE: CVE-2016-3225
Published: 2016-06-16
Description: The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application that forwards an authentication request to an unintended service, aka "Windows SMB Server Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securitytracker.com/id/1036110; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-075; https://www.exploit-db.com/exploits/45562/
CVE: CVE-2016-3226
Published: 2016-06-16
Description: Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service hang) by creating many machine accounts, aka "Active Directory Denial of Service Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securitytracker.com/id/1036108; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-081; http://www.securitytracker.com/id/1036108
CVE: CVE-2016-3227
Published: 2016-06-16
Description: Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests, aka "Windows DNS Server Use After Free Vulnerability."
CVSS Score: 9.8 (CRITICAL)
References: http://www.securitytracker.com/id/1036095; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-071; http://www.securitytracker.com/id/1036095
CVE: CVE-2016-3228
Published: 2016-06-16
Description: Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows Server 2012 Gold and R2 allow remote authenticated users to execute arbitrary code via a crafted NetLogon request, aka "Windows Netlogon Memory Corruption Remote Code Execution Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1036103; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-076; http://www.securitytracker.com/id/1036103
CVE: CVE-2016-3230
Published: 2016-06-16
Description: The Search component in Microsoft Windows 7, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to cause a denial of service (performance degradation) via a crafted application, aka "Windows Search Component Denial of Service Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1036102; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-082; http://www.securitytracker.com/id/1036102
CVE: CVE-2016-3231
Published: 2016-06-16
Description: The Standard Collector service in Windows Diagnostics Hub mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows Diagnostics Hub Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/91116; http://www.securitytracker.com/id/1036105; http://www.zerodayinitiative.com/advisories/ZDI-16-372
CVE: CVE-2016-3232
Published: 2016-06-16
Description: The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive information from uninitialized memory locations via a crafted application, aka "Windows Virtual PCI Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036109; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-073; http://www.securitytracker.com/id/1036109
CVE: CVE-2016-3233
Published: 2016-06-16
Description: Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1036093; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070; http://www.securitytracker.com/id/1036093
CVE: CVE-2016-3234
Published: 2016-06-16
Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036093; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070; http://www.securitytracker.com/id/1036093
CVE: CVE-2016-3235
Published: 2016-06-16
Description: Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/137490/Microsoft-Visio-DLL-Hijacking.html; http://seclists.org/fulldisclosure/2016/Jun/32; http://www.securityfocus.com/archive/1/538685/100/0/threaded
CVE: CVE-2016-3236
Published: 2016-06-16
Description: The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles proxy discovery, which allows remote attackers to redirect network traffic via unspecified vectors, aka "Windows WPAD Proxy Discovery Elevation of Privilege Vulnerability."
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.securitytracker.com/id/1036104; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-077; http://www.securitytracker.com/id/1036104
CVE: CVE-2016-4120
Published: 2016-06-16
Description: Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, and CVE-2016-4163.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://rhn.redhat.com/errata/RHSA-2016-1079.html; http://www.securityfocus.com/bid/90618; https://helpx.adobe.com/security/products/flash-player/apsb16-15.html