deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3812
Published: 2016-07-11
Description: The MediaTek video codec driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28174833 and MediaTek internal bug ALPS02688832.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3813
Published: 2016-07-11
Description: The Qualcomm USB driver in Android before 2016-07-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28172322 and Qualcomm internal bug CR1010222.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3814
Published: 2016-07-11
Description: The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28193342.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-07-01.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-3815
Published: 2016-07-11
Description: The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28522274.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-07-01.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-3816
Published: 2016-07-11
Description: The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28402240.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3818
Published: 2016-07-11
Description: libc in Android 4.x before 4.4.4 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28740702.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-1445
Published: 2016-07-12
Description: Cisco Adaptive Security Appliance (ASA) Software 8.2 through 9.4.3.3 allows remote attackers to bypass intended ICMP Echo Reply ACLs via vectors related to subtypes.
CVSS Score: 5.3 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160711-asa; http://www.securityfocus.com/bid/91693; http://www.securitytracker.com/id/1036271
CVE: CVE-2016-2205
Published: 2016-07-12
Description: Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 allows remote authenticated users to read unspecified application files via unknown vectors.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/89395; http://www.securitytracker.com/id/1036262; http://www.securitytracker.com/id/1036263
CVE: CVE-2016-2206
Published: 2016-07-12
Description: The management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 allows remote authenticated users to read arbitrary files by modifying the file-download configuration file.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/89394; http://www.securitytracker.com/id/1036262; http://www.securitytracker.com/id/1036263
CVE: CVE-2016-4503
Published: 2016-07-12
Description: Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to reading a cookie parameter containing a UserId value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/91670; https://ics-cert.us-cert.gov/advisories/ICSA-16-189-02; http://www.securityfocus.com/bid/91670
CVE: CVE-2016-4533
Published: 2016-07-12
Description: Heap-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91522; https://ics-cert.us-cert.gov/advisories/ICSA-16-189-01; http://www.securityfocus.com/bid/91522
CVE: CVE-2016-4831
Published: 2016-07-12
Description: Untrusted search path vulnerability in LINE and LINE Installer 4.7.0 and earlier on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
References: http://jvn.jp/en/jp/JVN51565015/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000123; http://linecorp.com/ja/security/article/61
CVE: CVE-2016-5308
Published: 2016-07-12
Description: The Client Intrusion Detection System (CIDS) driver before 15.0.6 in Symantec Endpoint Protection (SEP) and before 15.1.2 in Norton Security allows remote attackers to cause a denial of service (memory corruption and system crash) via a malformed Portable Executable (PE) file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91608; http://www.securitytracker.com/id/1036264; http://www.securitytracker.com/id/1036265
CVE: CVE-2016-5781
Published: 2016-07-12
Description: Stack-based buffer overflow in WECON LeviStudio allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91522; https://ics-cert.us-cert.gov/advisories/ICSA-16-189-01; http://www.securityfocus.com/bid/91522
CVE: CVE-2015-3192
Published: 2016-07-12
Description: Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162015.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162017.html; http://pivotal.io/security/cve-2015-3192
CVE: CVE-2016-2219
Published: 2016-07-12
Description: Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securitytracker.com/id/1036192; https://security.paloaltonetworks.com/CVE-2016-2219; http://www.securitytracker.com/id/1036192
CVE: CVE-2016-4428
Published: 2016-07-12
Description: Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.debian.org/security/2016/dsa-3617; http://www.openwall.com/lists/oss-security/2016/06/17/4; https://access.redhat.com/errata/RHSA-2016:1268
CVE: CVE-2016-4985
Published: 2016-07-12
Description: The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the v1/drivers/$DRIVER_NAME/vendor_passthru resource.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/06/21/6; https://access.redhat.com/errata/RHSA-2016:1377; https://access.redhat.com/errata/RHSA-2016:1378
CVE: CVE-2016-4994
Published: 2016-07-12
Description: Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-updates/2016-07/msg00005.html; http://rhn.redhat.com/errata/RHSA-2016-2589.html; http://www.debian.org/security/2016/dsa-3612
CVE: CVE-2016-5009
Published: 2016-07-12
Description: The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-12/msg00126.html; http://tracker.ceph.com/issues/16297; https://access.redhat.com/errata/RHSA-2016:1384
CVE: CVE-2016-5774
Published: 2016-07-12
Description: The HTTPS server in Blue Coat PacketShaper S-Series 11.5.x before 11.5.3.2 might allow remote attackers to obtain sensitive credentials and other information via unspecified vectors, related to use of insecure cryptographic parameters.
CVSS Score: 8.1 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/91455; https://bto.bluecoat.com/security-advisory/sa127; http://www.securityfocus.com/bid/91455
CVE: CVE-2016-5850
Published: 2016-07-12
Description: Cross-site scripting (XSS) vulnerability in the volume backup service module in Huawei Public Cloud Solution before 1.0.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160629-01-publiccloud-en; http://www.securityfocus.com/bid/91513; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160629-01-publiccloud-en
CVE: CVE-2016-6174
Published: 2016-07-12
Description: applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter.
CVSS Score: 8.1 (HIGH)
References: http://karmainsecurity.com/KIS-2016-11; http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html; http://packetstormsecurity.com/files/137804/IPS-Community-Suite-4.1.12.3-PHP-Code-Injection.html
CVE: CVE-2016-3204
Published: 2016-07-13
Description: The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91584; http://www.securitytracker.com/id/1036282; http://www.securitytracker.com/id/1036283
CVE: CVE-2016-3238
Published: 2016-07-13
Description: The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows man-in-the-middle attackers to execute arbitrary code by providing a crafted print driver during printer installation, aka "Windows Print Spooler Remote Code Execution Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/91609; http://www.securitytracker.com/id/1036277; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-087
CVE: CVE-2016-3239
Published: 2016-07-13
Description: The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via vectors involving filesystem write operations, aka "Windows Print Spooler Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91612; http://www.securitytracker.com/id/1036277; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-087
CVE: CVE-2016-3240
Published: 2016-07-13
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3241 and CVE-2016-3242.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91568; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3241
Published: 2016-07-13
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3240 and CVE-2016-3242.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91569; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3242
Published: 2016-07-13
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3240 and CVE-2016-3241.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91570; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3243
Published: 2016-07-13
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91571; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3244
Published: 2016-07-13
Description: Microsoft Edge allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Edge Security Feature Bypass."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/91599; http://www.securitytracker.com/id/1036286; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085
CVE: CVE-2016-3245
Published: 2016-07-13
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to trick users into making TCP connections to a restricted port via a crafted web site, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/91585; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3246
Published: 2016-07-13
Description: Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91602; http://www.securitytracker.com/id/1036286; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085
CVE: CVE-2016-3248
Published: 2016-07-13
Description: The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3259.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91578; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3249
Published: 2016-07-13
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3252, CVE-2016-3254, and CVE-2016-3286.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91597; http://www.securitytracker.com/id/1036288; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-090
CVE: CVE-2016-3250
Published: 2016-07-13
Description: The kernel-mode drivers in Microsoft Windows Server 2012 and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91613; http://www.securitytracker.com/id/1036288; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-090
CVE: CVE-2016-3251
Published: 2016-07-13
Description: The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address information via a crafted application, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 2.8 (LOW)
CWE: CWE-200
References: http://www.securitytracker.com/id/1036288; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-090; http://www.securitytracker.com/id/1036288
CVE: CVE-2016-3252
Published: 2016-07-13
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3249, CVE-2016-3254, and CVE-2016-3286.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91614; http://www.securitytracker.com/id/1036288; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-090
CVE: CVE-2016-3254
Published: 2016-07-13
Description: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3249, CVE-2016-3252, and CVE-2016-3286.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91615; http://www.securitytracker.com/id/1036288; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-090
CVE: CVE-2016-3255
Published: 2016-07-13
Description: Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka ".NET Information Disclosure Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91601; http://www.securitytracker.com/id/1036291; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-091
CVE: CVE-2016-3256
Published: 2016-07-13
Description: Microsoft Windows 10 Gold and 1511 allows local users to bypass the Secure Kernel Mode protection mechanism and obtain sensitive information via a crafted application, aka "Windows Secure Kernel Mode Information Disclosure Vulnerability."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91590; http://www.securitytracker.com/id/1036287; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-089
CVE: CVE-2016-3258
Published: 2016-07-13
Description: Race condition in the kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the Low Integrity protection mechanism and write to files by leveraging unspecified object-manager features, aka "Windows File System Security Feature Bypass."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-264, CWE-362
References: http://www.securityfocus.com/bid/91606; http://www.securitytracker.com/id/1036289; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-092
CVE: CVE-2016-3259
Published: 2016-07-13
Description: The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3248.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91581; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3260
Published: 2016-07-13
Description: The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91580; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3261
Published: 2016-07-13
Description: Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91575; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3264
Published: 2016-07-13
Description: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91598; http://www.securitytracker.com/id/1036283; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084
CVE: CVE-2016-3265
Published: 2016-07-13
Description: The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3269.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91573; http://www.securitytracker.com/id/1036286; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085