deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2097
Published: 2016-04-07
Description: Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html; http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
CVE: CVE-2016-2098
Published: 2016-04-07
Description: Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
CVE: CVE-2016-2563
Published: 2016-04-07
Description: Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2016-05/msg00131.html; http://seclists.org/fulldisclosure/2016/Mar/22; http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-pscp-sink-sscanf.html
CVE: CVE-2016-2789
Published: 2016-04-07
Description: Cross-site scripting (XSS) vulnerability in the Web User Interface in Citrix XenMobile Server 10.0, 10.1 before Rolling Patch 4, and 10.3 before Rolling Patch 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://support.citrix.com/article/CTX207499; http://www.securitytracker.com/id/1035265; http://support.citrix.com/article/CTX207499
CVE: CVE-2016-2851
Published: 2016-04-07
Description: Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00030.html; http://seclists.org/fulldisclosure/2016/Mar/21
CVE: CVE-2016-3976
Published: 2016-04-07
Description: Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html; http://seclists.org/fulldisclosure/2016/Jun/40; https://erpscan.io/advisories/erpscan-16-012/
CVE: CVE-2015-8840
Published: 2016-04-08
Description: The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp, (2) webcontent/cas/cas_validate.jsp, or (3) webcontent/aas/aas_store.jsp, aka SAP Security Note 1945215.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015; https://erpscan.io/advisories/erpscan-15-017-sap-netweaver-j2ee-das-service-unauthorized-access/; http://scn.sap.com/community/security/blog/2015/07/15/sap-security-notes-july-2015
CVE: CVE-2015-6541
Published: 2016-04-08
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to service/soap/BatchRequest.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://seclists.org/fulldisclosure/2016/Feb/121; https://wiki.zimbra.com/wiki/Security/Collab/86#Notes_from_8.5_.28Jetty.29; https://www.exploit-db.com/exploits/39500/
CVE: CVE-2016-2315
Published: 2016-04-08
Description: revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html
CVE: CVE-2016-2324
Published: 2016-04-08
Description: Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html
CVE: CVE-2016-3153
Published: 2016-04-08
Description: SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.debian.org/security/2016/dsa-3518; https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr; https://core.spip.net/projects/spip/repository/revisions/22911
CVE: CVE-2016-3154
Published: 2016-04-08
Description: The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.debian.org/security/2016/dsa-3518; https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-1-SPIP-3-0-22-et-SPIP-2-1.html?lang=fr; https://core.spip.net/projects/spip/repository/revisions/22903
CVE: CVE-2016-3187
Published: 2016-04-08
Description: The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b256dd785e029ec17f92ddf80cc443; https://www.drupal.org/node/2679215; https://www.drupal.org/node/2679503
CVE: CVE-2016-3188
Published: 2016-04-08
Description: The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have unspecified impact, via unspecified vectors.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b256dd785e029ec17f92ddf80cc443; https://www.drupal.org/node/2679215; https://www.drupal.org/node/2679503
CVE: CVE-2016-3978
Published: 2016-04-08
Description: The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2016/Mar/68; http://www.fortiguard.com/advisory/fortios-open-redirect-vulnerability; http://www.securitytracker.com/id/1035332
CVE: CVE-2016-3979
Published: 2016-04-08
Description: Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/137589/SAP-NetWeaver-AS-JAVA-7.4-icman-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2016/Jun/55; https://erpscan.io/advisories/erpscan-16-017-sap-java-icman-dos/
CVE: CVE-2016-3980
Published: 2016-04-08
Description: The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/137591/SAP-NetWeaver-AS-JAVA-7.4-jstart-Denial-Of-Service.html; http://seclists.org/fulldisclosure/2016/Jun/56; https://erpscan.io/advisories/erpscan-16-018-sap-java-jstart-dos/
CVE: CVE-2015-5229
Published: 2016-04-08
Description: The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-17
References: http://rhn.redhat.com/errata/RHSA-2016-0176.html; http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2[PII_REDACTED].html; http://www.securityfocus.com/bid/84172
CVE: CVE-2015-5969
Published: 2016-04-08
Description: The mysql-systemd-helper script in the mysql-community-server package before 5.6.28-2.17.1 in openSUSE 13.2 and before 5.6.28-13.1 in openSUSE Leap 42.1 and the mariadb package before 10.0.22-2.21.2 in openSUSE 13.2 and before 10.0.22-3.1 in SUSE Linux Enterprise (SLE) 12.1 and openSUSE Leap 42.1 allows local users to discover database credentials by listing a process and its arguments.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00015.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00039.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00050.html
CVE: CVE-2016-1180
Published: 2016-04-08
Description: Cross-site scripting (XSS) vulnerability in the Cyber-Will Social-button Premium plugin before 1.1 for EC-CUBE 2.13.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN78482127/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000048; http://www.cyber-will.co.jp/SA_JVN_78482127
CVE: CVE-2016-1375
Published: 2016-04-08
Description: Cross-site scripting (XSS) vulnerability in Cisco IP Interoperability and Collaboration System 4.10(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuy12339.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160407-cic; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160407-cic
CVE: CVE-2016-2381
Published: 2016-04-08
Description: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-03/msg00112.html; http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076; http://www.debian.org/security/2016/dsa-3501
CVE: CVE-2016-2512
Published: 2016-04-08
Description: The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\@attacker.com.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-0502.html; http://rhn.redhat.com/errata/RHSA-2016-0504.html; http://rhn.redhat.com/errata/RHSA-2016-0505.html
CVE: CVE-2016-2513
Published: 2016-04-08
Description: The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2016-0502.html; http://rhn.redhat.com/errata/RHSA-2016-0504.html; http://rhn.redhat.com/errata/RHSA-2016-0505.html
CVE: CVE-2016-3963
Published: 2016-04-08
Description: Siemens SCALANCE S613 allows remote attackers to cause a denial of service (web-server outage) via traffic to TCP port 443.
CVSS Score: 5.3 (MEDIUM)
References: http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-751155.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-16-103-02; https://www.exploit-db.com/exploits/44721/
CVE: CVE-2016-3983
Published: 2016-04-08
Description: McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent process.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10149; https://kc.mcafee.com/corporate/index?page=content&id=SB10149
CVE: CVE-2016-3984
Published: 2016-04-08
Description: The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: http://lab.mediaservice.net/advisory/2016-01-mcafee.txt; http://seclists.org/fulldisclosure/2016/Mar/13; http://www.securitytracker.com/id/1035130
CVE: CVE-2016-1006
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data.
CVSS Score: 8.1 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1011
Published: 2016-04-09
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://packetstormsecurity.com/files/137050/Adobe-Flash-MovieClip.duplicateMovieClip-Use-After-Free.html
CVE: CVE-2016-1012
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1013
Published: 2016-04-09
Description: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1014
Published: 2016-04-09
Description: Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://packetstormsecurity.com/files/137532/Adobe-Flash-Player-DLL-Hijacking.html
CVE: CVE-2016-1015
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different vulnerability than CVE-2016-1019.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1016
Published: 2016-04-09
Description: Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1017, and CVE-2016-1031.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1017
Published: 2016-04-09
Description: Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1018
Published: 2016-04-09
Description: Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1020
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1021
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1022
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1023
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html
CVE: CVE-2016-1024
Published: 2016-04-09
Description: Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html; http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html; http://rhn.redhat.com/errata/RHSA-2016-0610.html