CVE-2016-1000229

swagger-ui has XSS in key names

• https://github.com/ossf-cve-benchmark/CVE-2016-1000229

CVE-2016-1000027

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

• https://github.com/artem-smotrakov/cve-2016-1000027-poc

• https://github.com/tina94happy/Spring-Web-5xx-Mitigated-version

• https://github.com/yihtserns/spring-web-without-remoting

CVE-2016-20012

** DISPUTED ** OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session. NOTE: the vendor does not recognize user enumeration as a vulnerability for this product.

• https://github.com/aztec-eagle/cve-2016-20012

CVE-2016-10993

The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter.

• https://github.com/0xc4t/CVE-2016-10993

CVE-2016-10956

The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.

• https://github.com/p0dalirius/CVE-2016-10956-mail-masta

• https://github.com/Hackhoven/wp-mail-masta-exploit

CVE-2016-10924

The ebook-download plugin before 1.2 for WordPress has directory traversal.

• https://github.com/rvizx/CVE-2016-10924

• https://github.com/LGenAgul/Wordpress-ebook-CVE-2016-10924

CVE-2016-10761

Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack.

• https://github.com/ISSAPolska/CVE-2016-10761

CVE-2016-10735

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

• https://github.com/ossf-cve-benchmark/CVE-2016-10735

CVE-2016-10725

In Bitcoin Core before v0.13.0, a non-final alert is able to block the special "final alert" (which is supposed to override all other alerts) because operations occur in the wrong order. This behavior occurs in the remote network alert system (deprecated since Q1 2016). This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

• https://github.com/JinBean/CVE-Extension

CVE-2016-10724

Bitcoin Core before v0.13.0 allows denial of service (memory exhaustion) triggered by the remote network alert system (deprecated since Q1 2016) if an attacker can sign a message with a certain private key that had been known by unintended actors, because of an infinitely sized map. This affects other uses of the codebase, such as Bitcoin Knots before v0.13.0.knots20160814 and many altcoins.

• https://github.com/JinBean/CVE-Extension

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_rrd_graph_img.php graph parameter, related to _rrd_graph_img.php.

• https://github.com/wetw0rk/Exploit-Development

CVE-2016-10555

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.

• https://github.com/CircuitSoul/poc-cve-2016-10555

• https://github.com/scent2d/PoC-CVE-2016-10555

CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known (or a non-root default account exists within an ISP's deployment of these devices).

• https://github.com/oxagast/oxasploits

CVE-2016-10277

An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33840490.

• https://github.com/alephsecurity/initroot

• https://github.com/leosol/initroot

CVE-2016-10191

Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check for RTMP packet size mismatches.

• https://github.com/KaviDk/Heap-Over-Flow-with-CVE-2016-10191

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response.

• https://github.com/muzalam/FFMPEG-exploit

CVE-2016-10140

Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, which allows a remote unauthenticated attacker to browse all directories in the web root, e.g., a remote unauthenticated attacker can view all CCTV images on the server via the /events URI.

• https://github.com/asaotomo/CVE-2016-10140-Zoneminder-Poc

CVE-2016-10045

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

• https://github.com/Zenexer/safeshell

• https://github.com/pedro823/cve-2016-10033-45

CVE-2016-10034

The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.

• https://github.com/heikipikker/exploit-CVE-2016-10034

CVE-2016-10033

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted Sender property.

• https://github.com/opsxcq/exploit-CVE-2016-10033

• https://github.com/GeneralTesler/CVE-2016-10033

• https://github.com/Zenexer/safeshell

• https://github.com/paralelo14/CVE_2016-10033

• https://github.com/0x00-0x00/CVE-2016-10033

• https://github.com/chipironcin/CVE-2016-10033

• https://github.com/pedro823/cve-2016-10033-45

• https://github.com/j4k0m/CVE-2016-10033

• https://github.com/awidardi/opsxcq-cve-2016-10033

• https://github.com/cved-sources/cve-2016-10033

• https://github.com/eb613819/CTF_CVE-2016-10033

• https://github.com/ElnurBDa/CVE-2016-10033

• https://github.com/qwertyuiop12138/CVE-2016-10033

• https://github.com/CAOlvchonger/CVE-2016-10033

• https://github.com/Bajunan/CVE-2016-10033

• https://github.com/Astrowmist/POC-CVE-2016-10033

• https://github.com/zeeshanbhattined/exploit-CVE-2016-10033

• https://github.com/liusec/WP-CVE-2016-10033

CVE-2016-10006

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.

• https://github.com/epicosy/VUL4J-60

CVE-2016-9920

steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line, which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.

• https://github.com/t0kx/exploit-CVE-2016-9920

CVE-2016-9838

An issue was discovered in components/com_users/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and password, as demonstrated by submitting a form that targets the registration.register task.

• https://github.com/cved-sources/cve-2016-9838

CVE-2016-9795

The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Performance for Infrastructure Managers 12.8 and 12.9; CA Universal Job Management Agent 11.2; CA Virtual Assurance for Infrastructure Managers 12.8 and 12.9; CA Workload Automation AE 11, 11.3, 11.3.5, and 11.3.6 on AIX, HP-UX, Linux, and Solaris allows local users to modify arbitrary files and consequently gain root privileges via vectors related to insufficient validation.

• https://github.com/blogresponder/CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CVE-2016-9299

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

• https://github.com/r00t4dm/Jenkins-CVE-2016-9299

CVE-2016-9244

A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes of uninitialized memory. A remote attacker may exploit this vulnerability to obtain Secure Sockets Layer (SSL) session IDs from other sessions. It is possible that other data from uninitialized memory may be returned as well.

• https://github.com/EgeBalci/Ticketbleed

• https://github.com/glestel/minion-ticket-bleed-plugin

CVE-2016-9192

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. More Information: CSCvb68043. Known Affected Releases: 4.3(2039) 4.3(748). Known Fixed Releases: 4.3(4019) 4.4(225).

• https://github.com/serializingme/cve-2016-9192

CVE-2016-9079

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

• https://github.com/dangokyo/CVE-2016-9079

• https://github.com/LakshmiDesai/CVE-2016-9079

• https://github.com/Tau-hub/Firefox-CVE-2016-9079

CVE-2016-9066

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

• https://github.com/saelo/foxpwn

CVE-2016-8870

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

• https://github.com/rustyJ4ck/JoomlaCVE20168869

• https://github.com/cved-sources/cve-2016-8870

• https://github.com/zugetor/Joomla-3.4.4-3.6.4_CVE-2016-8869_and_CVE-2016-8870

CVE-2016-8869

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

• https://github.com/rustyJ4ck/JoomlaCVE20168869

• https://github.com/cved-sources/cve-2016-8869

• https://github.com/zugetor/Joomla-3.4.4-3.6.4_CVE-2016-8869_and_CVE-2016-8870

CVE-2016-8863

Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.

• https://github.com/mephi42/CVE-2016-8863

CVE-2016-8858

** DISPUTED ** The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate KEXINIT requests. NOTE: a third party reports that "OpenSSH upstream does not consider this as a security issue."

• https://github.com/dag-erling/kexkill

CVE-2016-8823

All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where the size of an input buffer is not validated leading to a denial of service or possible escalation of privileges

• https://github.com/SpiralBL0CK/NDAY_CVE_2016_8823

CVE-2016-8776

Huawei P9 phones with software EVA-AL10C00,EVA-CL10C00,EVA-DL10C00,EVA-TL10C00 and P9 Lite phones with software VNS-L21C185 allow attackers to bypass the factory reset protection (FRP) to enter some functional modules without authorization and perform operations to update the Google account.

• https://github.com/akzedevops/CVE-2016-8776

CVE-2016-8740

The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.

• https://github.com/jptr218/apachedos

• https://github.com/lcfpadilha/mac0352-ep4

CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

• https://github.com/ianxtianxt/CVE-2016-8735

CVE-2016-8655

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.

• https://github.com/martinmullins/CVE-2016-8655_Android

• https://github.com/LakshmiDesai/CVE-2016-8655

• https://github.com/agkunkle/chocobo

• https://github.com/KosukeShimofuji/CVE-2016-8655

• https://github.com/scarvell/cve-2016-8655

CVE-2016-8636

Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.

• https://github.com/jigerjain/Integer-Overflow-test

CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

• https://github.com/cujanovic/CVE-2016-8610-PoC

CVE-2016-8467

An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. This issue is rated as High because it is a local permanent denial of service (device interoperability: completely permanent or requiring re-flashing the entire operating system). Product: Android. Versions: N/A. Android ID: A-30308784.

• https://github.com/roeeh/bootmodechecker

CVE-2016-8462

An information disclosure vulnerability in the bootloader could enable a local attacker to access data outside of its permission level. This issue is rated as High because it could be used to access sensitive data. Product: Android. Versions: N/A. Android ID: A-32510383.

• https://github.com/CunningLogic/PixelDump_CVE-2016-8462

CVE-2016-8374

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker may be able to disrupt a targeted web server, resulting in a denial of service because of UNCONTROLLED RESOURCE CONSUMPTION.

• https://github.com/0xICF/PanelShock

CVE-2016-8367

An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, all versions, Magelis STO5xx and STU Small panels, all versions, Magelis XBT GH Advanced Hand-held Panels, all versions, Magelis XBT GK Advanced Touchscreen Panels with Keyboard, all versions, Magelis XBT GT Advanced Touchscreen Panels, all versions, and Magelis XBT GTW Advanced Open Touchscreen Panels (Windows XPe). An attacker can open multiple connections to a targeted web server and keep connections open preventing new connections from being made, rendering the web server unavailable during an attack.

• https://github.com/0xICF/PanelShock

CVE-2016-8025

SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8024

Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8023

Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8022

Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8021

Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8020

Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8019

Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8018

Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8017

Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8016

Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.

• https://github.com/opsxcq/exploit-CVE-2016-8016-25

CVE-2016-8007

Authentication bypass vulnerability in McAfee Host Intrusion Prevention Services (HIPS) 8.0 Patch 7 and earlier allows authenticated users to manipulate the product's registry keys via specific conditions.

• https://github.com/dmaasland/mcafee-hip-CVE-2016-8007

CVE-2016-7855

Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.

• https://github.com/swagatbora90/CheckFlashPlayerVersion

CVE-2016-7617

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (type confusion) via a crafted app.

• https://github.com/bazad/physmem

CVE-2016-7608

An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "IOFireWireFamily" component, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.

• https://github.com/bazad/IOFireWireFamily-overflow

CVE-2016-7434

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

• https://github.com/opsxcq/exploit-CVE-2016-7434

• https://github.com/cved-sources/cve-2016-7434

• https://github.com/shekkbuilder/CVE-2016-7434

CVE-2016-7255

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."

• https://github.com/FSecureLABS/CVE-2016-7255

• https://github.com/yuvatia/page-table-exploitation

• https://github.com/heh3/CVE-2016-7255

• https://github.com/bbolmin/cve-2016-7255_x86_x64

• https://github.com/homjxi0e/CVE-2016-7255

CVE-2016-7201

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

• https://github.com/theori-io/chakra-2016-11

CVE-2016-7200

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

• https://github.com/theori-io/chakra-2016-11

CVE-2016-7190

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-3389, and CVE-2016-7194.

• https://github.com/0xcl/cve-2016-7190

CVE-2016-7117

Use-after-free vulnerability in the __sys_recvmmsg function in net/socket.c in the Linux kernel before 4.5.2 allows remote attackers to execute arbitrary code via vectors involving a recvmmsg system call that is mishandled during error processing.

• https://github.com/KosukeShimofuji/CVE-2016-7117

CVE-2016-6801

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.

• https://github.com/TSNGL21/CVE-2016-6801

CVE-2016-6798

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.

• https://github.com/tafamace/CVE-2016-6798

CVE-2016-6754

A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a remote attacker to execute arbitrary code when the user is navigating to a website. This issue is rated as High due to the possibility of remote code execution in an unprivileged process. Android ID: A-31217937.

• https://github.com/secmob/BadKernel

CVE-2016-6663

Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x before 10.0.28, and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0, 5.6.x before 5.6.32-25.17, and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.

• https://github.com/firebroo/CVE-2016-6663

CVE-2016-6662

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52, 5.6.33, and 5.7.15.

• https://github.com/MAYASEVEN/CVE-2016-6662

• https://github.com/Ashrafdev/MySQL-Remote-Root-Code-Execution

• https://github.com/meersjo/ansible-mysql-cve-2016-6662

• https://github.com/boompig/cve-2016-6662

• https://github.com/KosukeShimofuji/CVE-2016-6662

• https://github.com/konstantin-kelemen/mysqld_safe-CVE-2016-6662-patch

CVE-2016-6584

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

• https://github.com/ViralSecurityGroup/KNOXout

CVE-2016-6516

Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability.

• https://github.com/wpengfei/CVE-2016-6516-exploit

CVE-2016-6515

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.

• https://github.com/opsxcq/exploit-CVE-2016-6515

• https://github.com/jptr218/openssh_dos

• https://github.com/cved-sources/cve-2016-6515

CVE-2016-6415

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

• https://github.com/3ndG4me/CVE-2016-6415-BenignCertain-Monitor

CVE-2016-6366

Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted IPv4 SNMP packets, aka Bug ID CSCva92151 or EXTRABACON.

• https://github.com/RiskSense-Ops/CVE-2016-6366

CVE-2016-6328

A vulnerability was found in libexif. An integer overflow when parsing the MNOTE entry data of the input file. This can cause Denial-of-Service (DoS) and Information Disclosure (disclosing some critical heap chunk metadata, even other applications' private data).

• https://github.com/Pazhanivelmani/libexif_Android10_r33_CVE-2016-6328

CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.

• https://github.com/kavgan/vuln_test_repo_public_ruby_gemfile_cve-2016-6317

CVE-2016-6271

The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.

• https://github.com/gteissier/CVE-2016-6271

CVE-2016-6210

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.

• https://github.com/hackingyseguridad/ssha

• https://github.com/justlce/CVE-2016-6210-Exploit

• https://github.com/calebshortt/opensshd_user_enumeration

• https://github.com/Tardcircus/CVE2016-6210

• https://github.com/samh4cks/CVE-2016-6210-OpenSSH-User-Enumeration

• https://github.com/bassitone/OpenSSH-User-Enumeration

• https://github.com/goomdan/CVE-2016-6210-exploit

CVE-2016-6187

The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook.

• https://github.com/Milo-D/CVE-2016-6187_LPE

• https://github.com/vnik5287/cve-2016-6187-poc

CVE-2016-5983

IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object.

• https://github.com/BitWrecker/CVE-2016-5983

CVE-2016-5734

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replace e (aka eval) modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table search-and-replace implementation.

• https://github.com/miko550/CVE-2016-5734-docker

• https://github.com/msharm33/CVE2016-5734

• https://github.com/KosukeShimofuji/CVE-2016-5734

• https://github.com/HKirito/phpmyadmin4.4_cve-2016-5734

CVE-2016-5725

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

• https://github.com/tintinweb/pub

CVE-2016-5699

CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL.

• https://github.com/bunseokbot/CVE-2016-5699-poc

• https://github.com/shajinzheng/cve-2016-5699-jinzheng-sha

CVE-2016-5696

net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack.

• https://github.com/violentshell/rover

• https://github.com/jduck/challack

• https://github.com/Gnoxter/mountain_goat

• https://github.com/bplinux/chackd

• https://github.com/unkaktus/grill

CVE-2016-5649

A vulnerability is in the 'BSW_cxttongr.htm' page of the Netgear DGN2200, version DGN2200-V1.0.0.50_7.0.50, and DGND3700, version DGND3700-V1.0.0.17_1.0.17, which can allow a remote attacker to access this page without any authentication. When processed, it exposes the admin password in clear text before it gets redirected to absw_vfysucc.cgia. An attacker can use this password to gain administrator access to the targeted router's web interface.

• https://github.com/lilloX/routerPWN

CVE-2016-5640

Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.

• https://github.com/vpnguy-zz/CrestCrack

• https://github.com/xfox64x/CVE-2016-5640

CVE-2016-5639

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter.

• https://github.com/xfox64x/CVE-2016-5639

CVE-2016-5636

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

• https://github.com/insuyun/CVE-2016-5636

CVE-2016-5394

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.

• https://github.com/epicosy/VUL4J-23

CVE-2016-5345

Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to gain privileges via a crafted application, aka Android internal bug 32639452 and Qualcomm internal bug CR1079713.

• https://github.com/NickStephens/cve-2016-5345

CVE-2016-5195

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

• https://github.com/timwr/CVE-2016-5195

• https://github.com/firefart/dirtycow

• https://github.com/scumjr/dirtycow-vdso

• https://github.com/gbonacini/CVE-2016-5195

• https://github.com/r1is/CVE-2022-0847

• https://github.com/hyln9/VIKIROOT

• https://github.com/Brucetg/DirtyCow-EXP

• https://github.com/idhyt/androotzf

• https://github.com/DavidBuchanan314/cowroot

• https://github.com/aishee/scan-dirtycow

• https://github.com/xlucas/dirtycow.cr

• https://github.com/pgporada/ansible-role-cve

• https://github.com/whu-enjoy/CVE-2016-5195

• https://github.com/imust6226/dirtcow

• https://github.com/martinmullins/amazon_remove_ads_apk

• https://github.com/sideeffect42/DirtyCOWTester

• https://github.com/jas502n/CVE-2016-5195

• https://github.com/oleg-fiksel/ansible_CVE-2016-5195_check

• https://github.com/droidvoider/dirtycow-replacer

• https://github.com/esc0rtd3w/org.cowpoop.moooooo

• https://github.com/LinuxKernelContent/DirtyCow

• https://github.com/arttnba3/CVE-2016-5195

• https://github.com/FloridSleeves/os-experiment-4

• https://github.com/talsim/root-dirtyc0w

• https://github.com/TotallyNotAHaxxer/CVE-2016-5195

• https://github.com/ASRTeam/CVE-2016-5195

• https://github.com/DanielEbert/CVE-2016-5195

• https://github.com/titanhp/Dirty-COW-CVE-2016-5195-Testing

• https://github.com/th3-5had0w/DirtyCOW-PoC

• https://github.com/arbll/dirtycow

• https://github.com/malinthag62/The-exploitation-of-Dirty-Cow-CVE-2016-5195

• https://github.com/ASUKA39/CVE-2016-5195

• https://github.com/fei9747/CVE-2016-5195

• https://github.com/KosukeShimofuji/CVE-2016-5195

• https://github.com/ldenevi/CVE-2016-5195

• https://github.com/sribaba/android-CVE-2016-5195

• https://github.com/sandeeparth07/CVE-2016_5195-vulnarability

• https://github.com/acidburnmi/CVE-2016-5195-master

• https://github.com/ndobson/inspec_CVE-2016-5195

• https://github.com/EDLLT/CVE-2016-5195-master

• https://github.com/h1n4mx0/Research-CVE-2016-5195

• https://github.com/xpcmdshell/derpyc0w

• https://github.com/gurpreetsinghsaluja/dirtycow

• https://github.com/zakariamaaraki/Dirty-COW-CVE-2016-5195-

• https://github.com/ZhiQiAnSecFork/DirtyCOW_CVE-2016-5195

• https://github.com/dulanjaya23/Dirty-Cow-CVE-2016-5195-

• https://github.com/sakilahamed/Linux-Kernel-Exploit-LAB

• https://github.com/passionchenjianyegmail8/scumjrs

• https://github.com/vinspiert/scumjrs

• https://github.com/1equeneRise/scumjr9

• https://github.com/shanuka-ashen/Dirty-Cow-Explanation-CVE-2016-5195-

• https://github.com/KaviDk/dirtyCow

• https://github.com/nndhanasekaran/redhat_cve2016

• https://github.com/istenrot/centos-dirty-cow-ansible

• https://github.com/nazgul6092/2nd-Year-Project-01-Linux-Exploitation-using-CVE-20166-5195

• https://github.com/KasunPriyashan/Y2S1-Project-Linux-Exploitaion-using-CVE-2016-5195-Vulnerability

CVE-2016-5063

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors.

• https://github.com/bao7uo/bmc_bladelogic

• https://github.com/DreadFog/RSCD_CVEs

CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

• https://github.com/shanika04/dashbuilder

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

• https://github.com/tpt11fb/SpringVulScan

• https://github.com/N0b1e6/CVE-2016-4977-POC

CVE-2016-4971

GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.

• https://github.com/gitcollect/CVE-2016-4971

• https://github.com/mbadanoiu/CVE-2016-4971

• https://github.com/dinidhu96/IT19013756_-CVE-2016-4971-

CVE-2016-4861

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.

• https://github.com/KosukeShimofuji/CVE-2016-4861

CVE-2016-4845

Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of arbitrary users for requests that delete content.

• https://github.com/kaito834/cve-2016-4845_csrf

CVE-2016-4825

The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.

• https://github.com/kaito834/cve-2016-4845_csrf

CVE-2016-4669

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "Kernel" component. It allows local users to execute arbitrary code in a privileged context or cause a denial of service (MIG code mishandling and system crash) via unspecified vectors.

• https://github.com/i-o-s/CVE-2016-4669

CVE-2016-4657

WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

• https://github.com/iDaN5x/Switcheroo

• https://github.com/viai957/webkit-vulnerability

• https://github.com/Mimoja/CVE-2016-4657-NintendoSwitch

CVE-2016-4656

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

• https://github.com/jndok/PegasusX

• https://github.com/tomitokics/br0ke

• https://github.com/Cryptiiiic/skybreak

• https://github.com/liangle1986126z/jndok

CVE-2016-4655

The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

• https://github.com/jndok/PegasusX

• https://github.com/tomitokics/br0ke

• https://github.com/Cryptiiiic/skybreak

• https://github.com/liangle1986126z/jndok

CVE-2016-4631

ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF file.

• https://github.com/hansnielsen/tiffdisabler

CVE-2016-4622

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.

• https://github.com/saelo/jscpwn

• https://github.com/hdbreaker/WebKit-CVE-2016-4622

CVE-2016-4468

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

• https://github.com/shanika04/cloudfoundry_uaa

CVE-2016-4463

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.

• https://github.com/arntsonl/CVE-2016-4463

CVE-2016-4438

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

• https://github.com/jason3e7/CVE-2016-4438

• https://github.com/tafamace/CVE-2016-4438

CVE-2016-4437

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

• https://github.com/zhzyker/vulmap

• https://github.com/bkfish/Awesome_shiro

• https://github.com/XuCcc/VulEnv

• https://github.com/4nth0ny1130/shisoserial

• https://github.com/pizza-power/CVE-2016-4437

• https://github.com/xk-mt/CVE-2016-4437

• https://github.com/m3terpreter/CVE-2016-4437

CVE-2016-4117

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

• https://github.com/hybridious/CVE-2016-4117

• https://github.com/amit-raut/CVE-2016-4117-Report

CVE-2016-4014

XML external entity (XXE) vulnerability in the UDDI component in SAP NetWeaver JAVA AS 7.4 allows remote attackers to cause a denial of service (system hang) via a crafted DTD in an XML request to uddi/api/replication, aka SAP Security Note 2254389.

• https://github.com/murataydemir/CVE-2016-4014

CVE-2016-4010

Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.

• https://github.com/brianwrf/Magento-CVE-2016-4010

• https://github.com/shadofren/CVE-2016-4010

CVE-2016-4004

Directory traversal vulnerability in Dell OpenManage Server Administrator (OMSA) 8.2 allows remote authenticated administrators to read arbitrary files via a ..\ (dot dot backslash) in the file parameter to ViewFile.

• https://github.com/und3sc0n0c1d0/AFR-in-OMSA

CVE-2016-3962

Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.

• https://github.com/securifera/CVE-2016-3962-Exploit

CVE-2016-3959

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

• https://github.com/alexmullins/dsa

CVE-2016-3957

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.

• https://github.com/sj/web2py-e94946d-CVE-2016-3957

CVE-2016-3955

The usbip_recv_xbuff function in drivers/usb/usbip/usbip_common.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted length value in a USB/IP packet.

• https://github.com/pqsec/uboatdemo

CVE-2016-3861

LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

• https://github.com/zxkevn/CVE-2016-3861

CVE-2016-3749

server/LockSettingsService.java in LockSettingsService in Android 6.x before 2016-07-01 allows attackers to modify the screen-lock password or pattern via a crafted application, aka internal bug 28163930.

• https://github.com/nirdev/CVE-2016-3749-PoC

CVE-2016-3714

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

• https://github.com/ImageTragick/PoCs

• https://github.com/Hood3dRob1n/CVE-2016-3714

• https://github.com/shelld3v/RCE-python-oneliner-payload

• https://github.com/jpeanut/ImageTragick-CVE-2016-3714-RShell

• https://github.com/mike-williams/imagetragick-poc

• https://github.com/chusiang/CVE-2016-3714.ansible.role

• https://github.com/JoshMorrison99/CVE-2016-3714

• https://github.com/PandH4cker/pandagik

• https://github.com/tommiionfire/CVE-2016-3714

• https://github.com/jackdpeterson/imagick_secure_puppet

• https://github.com/artfreyr/wp-imagetragick

CVE-2016-3510

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/zhzhdoai/Weblogic_Vuln

• https://github.com/minhangxiaohui/Weblogic_direct_T3_Rces

• https://github.com/BabyTeam1024/CVE-2016-3510

CVE-2016-3427

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

• https://github.com/qtc-de/beanshooter

CVE-2016-3309

The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3308, CVE-2016-3310, and CVE-2016-3311.

• https://github.com/siberas/CVE-2016-3309_Reloaded

CVE-2016-3308

The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3309, CVE-2016-3310, and CVE-2016-3311.

• https://github.com/55-AA/CVE-2016-3308

CVE-2016-3238

The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows man-in-the-middle attackers to execute arbitrary code by providing a crafted print driver during printer installation, aka "Windows Print Spooler Remote Code Execution Vulnerability."

• https://github.com/pyiesone/CVE-2016-3238-PoC

CVE-2016-3141

Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.

• https://github.com/peternguyen93/CVE-2016-3141

CVE-2016-3116

CRLF injection vulnerability in Dropbear SSH before 2016.72 allows remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data.

• https://github.com/tintinweb/pub

• https://github.com/mxypoo/CVE-2016-3116-DropbearSSH

CVE-2016-3115

Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.

• https://github.com/tintinweb/pub

CVE-2016-3113

Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.

• https://github.com/0xEmanuel/CVE-2016-3113

CVE-2016-3088

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

• https://github.com/YutuSec/ActiveMQ_Crack

• https://github.com/Ma1Dong/ActiveMQ_putshell-CVE-2016-3088

• https://github.com/cyberaguiar/CVE-2016-3088

• https://github.com/cl4ym0re/CVE-2016-3088

• https://github.com/vonderchild/CVE-2016-3088

• https://github.com/pudiding/CVE-2016-3088

CVE-2016-2783

Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properly handle VLAN and I-SIS indexes, which allows remote attackers to obtain unauthorized access via crafted Ethernet frames.

• https://github.com/iknowjason/spb

CVE-2016-2776

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

• https://github.com/infobyte/CVE-2016-2776

• https://github.com/KosukeShimofuji/CVE-2016-2776

CVE-2016-2569

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

• https://github.com/amit-raut/CVE-2016-2569

CVE-2016-2563

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

• https://github.com/tintinweb/pub

CVE-2016-2555

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

• https://github.com/shadofren/CVE-2016-2555

• https://github.com/maximilianmarx/atutor-blind-sqli

CVE-2016-2468

The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted application, aka internal bug 27475454.

• https://github.com/gitcollect/CVE-2016-2468

CVE-2016-2434

The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27251090.

• https://github.com/jianqiangzhao/CVE-2016-2434

CVE-2016-2431

The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 5, Nexus 6, Nexus 7 (2013), and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 24968809.

• https://github.com/laginimaineb/ExtractKeyMaster

• https://github.com/laginimaineb/cve-2016-2431

CVE-2016-2402

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.

• https://github.com/ikoz/cert-pinning-flaw-poc

• https://github.com/ikoz/certPinningVulnerableOkHttp

CVE-2016-2388

The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

• https://github.com/vah13/SAP_exploit

CVE-2016-2386

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

• https://github.com/vah13/SAP_exploit

• https://github.com/murataydemir/CVE-2016-2386

CVE-2016-2338

An exploitable heap overflow vulnerability exists in the Psych::Emitter start_document function of Ruby. In Psych::Emitter start_document function heap buffer "head" allocation is made based on tags array length. Specially constructed object passed as element of tags array can increase this array size after mentioned allocation and cause heap overflow.

• https://github.com/SpiralBL0CK/CVE-2016-2338-nday

CVE-2016-2334

Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to execute arbitrary code via a crafted HFS+ image.

• https://github.com/icewall/CVE-2016-2334

CVE-2016-2233

Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.

• https://github.com/fath0218/CVE-2016-2233

CVE-2016-2173

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

• https://github.com/HaToan/CVE-2016-2173

CVE-2016-2118

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "BADLOCK."

• https://github.com/nickanderson/cfengine-CVE-2016-2118

CVE-2016-2107

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.

• https://github.com/FiloSottile/CVE-2016-2107

• https://github.com/tmiklas/docker-cve-2016-2107

CVE-2016-2098

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

• https://github.com/0x00-0x00/CVE-2016-2098

• https://github.com/hderms/dh-CVE_2016_2098

• https://github.com/Shakun8/CVE-2016-2098

• https://github.com/j4k0m/CVE-2016-2098

• https://github.com/its-arun/CVE-2016-2098

• https://github.com/Alejandro-MartinG/rails-PoC-CVE-2016-2098

• https://github.com/DanielHemmati/CVE-2016-2098-my-first-exploit

• https://github.com/CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42

• https://github.com/Debalinax64/CVE-2016-2098

• https://github.com/3rg1s/CVE-2016-2098

• https://github.com/JoseLRC97/Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution

CVE-2016-2067

drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers to gain privileges by leveraging accidental read-write mappings, aka Qualcomm internal bug CR988993.

• https://github.com/hhj4ck/CVE-2016-2067

CVE-2016-2004

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2623.

• https://github.com/marcocarolasec/CVE-2016-2004-Exploit

CVE-2016-1910

The User Management Engine (UME) in SAP NetWeaver 7.4 allows attackers to decrypt unspecified data via unknown vectors, aka SAP Security Note 2191290.

• https://github.com/vah13/SAP_exploit

CVE-2016-1828

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1829, and CVE-2016-1830.

• https://github.com/bazad/rootsh

• https://github.com/zqlblingzs/bazad5

• https://github.com/berritus163t/bazad5

• https://github.com/SideGreenHand100/bazad5

CVE-2016-1827

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1828, CVE-2016-1829, and CVE-2016-1830.

• https://github.com/bazad/flow_divert-heap-overflow

• https://github.com/superMan7912002/bazad3

CVE-2016-1825

IOHIDFamily in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

• https://github.com/bazad/physmem

CVE-2016-1764

The Content Security Policy (CSP) implementation in Messages in Apple OS X before 10.11.4 allows remote attackers to obtain sensitive information via a javascript: URL.

• https://github.com/moloch--/cve-2016-1764

CVE-2016-1757

Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.

• https://github.com/gdbinit/mach_race

CVE-2016-1734

AppleUSBNetworking in Apple iOS before 9.3 and OS X before 10.11.4 allows physically proximate attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted USB device.

• https://github.com/Manouchehri/CVE-2016-1734

CVE-2016-1555

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear WN604 before 3.3.3 and WN802Tv2, WNAP210v2, WNAP320, WNDAP350, WNDAP360, and WNDAP660 before 3.5.5.0 allow remote attackers to execute arbitrary commands.

• https://github.com/ide0x90/cve-2016-1555

CVE-2016-1543

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.

• https://github.com/bao7uo/bmc_bladelogic

• https://github.com/patriknordlen/bladelogic_bmc-cve-2016-1542

CVE-2016-1542

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.

• https://github.com/bao7uo/bmc_bladelogic

• https://github.com/patriknordlen/bladelogic_bmc-cve-2016-1542

CVE-2016-1531

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

• https://github.com/n3rdh4x0r/CVE-2016-1531

CVE-2016-1494

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.

• https://github.com/matthiasbe/secuimag3a

CVE-2016-1287

Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X devices, ASA Services Module for Cisco Catalyst 6500 and Cisco 7600 devices, ASA 1000V devices, Adaptive Security Virtual Appliance (aka ASAv), Firepower 9300 ASA Security Module, and ISA 3000 devices allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via crafted UDP packets, aka Bug IDs CSCux29978 and CSCux42019.

• https://github.com/NetSPI/asa_tools

• https://github.com/jgajek/killasa

CVE-2016-1240

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

• https://github.com/Naramsim/Offensive

• https://github.com/mhe18/CVE_Project

CVE-2016-1209

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.

• https://github.com/LeBlogDuHacker/vulnlab

• https://github.com/SWICYBERLWA7DA/vulnlab-main

CVE-2016-0974

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0975, CVE-2016-0982, CVE-2016-0983, and CVE-2016-0984.

• https://github.com/Fullmetal5/FlashHax

CVE-2016-0856

Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.

• https://github.com/thezdi/PoC

• https://github.com/readloud/PoC

CVE-2016-0846

libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.

• https://github.com/secmob/CVE-2016-0846

• https://github.com/b0b0505/CVE-2016-0846-PoC

CVE-2016-0805

The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25773204.

• https://github.com/hulovebin/cve-2016-0805

CVE-2016-0801

The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029.

• https://github.com/abdsec/CVE-2016-0801

• https://github.com/zsaurus/CVE-2016-0801-test

CVE-2016-0800

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

• https://github.com/anthophilee/A2SV--SSL-VUL-Scan

CVE-2016-0793

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.

• https://github.com/tafamace/CVE-2016-0793

CVE-2016-0792

Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

• https://github.com/jpiechowka/jenkins-cve-2016-0792

• https://github.com/Aviksaikat/CVE-2016-0792

CVE-2016-0772

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

• https://github.com/tintinweb/pub

CVE-2016-0752

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.

• https://github.com/forced-request/rails-rce-cve-2016-0752

• https://github.com/julianmunoz/Rails-Dynamic-Render-vuln

• https://github.com/dachidahu/CVE-2016-0752

CVE-2016-0728

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

• https://github.com/nardholio/cve-2016-0728

• https://github.com/bittorrent3389/cve-2016-0728

• https://github.com/sunnyjiang/cve_2016_0728

• https://github.com/neuschaefer/cve-2016-0728-testbed

• https://github.com/fochess/cve_2016_0728

• https://github.com/kennetham/cve_2016_0728

• https://github.com/mfer/cve_2016_0728

• https://github.com/idl3r/cve-2016-0728

• https://github.com/sugarvillela/CVE

• https://github.com/bjzz/cve_2016_0728_exploit

• https://github.com/isnuryusuf/cve_2016_0728

• https://github.com/tndud042713/cve

• https://github.com/hal0taso/CVE-2016-0728

• https://github.com/sibilleg/exploit_cve-2016-0728

• https://github.com/sidrk01/cve-2016-0728

• https://github.com/googleweb/CVE-2016-0728

• https://github.com/th30d00r/Linux-Vulnerability-CVE-2016-0728-and-Exploit

CVE-2016-0705

Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.

• https://github.com/hshivhare67/OpenSSL_1.0.1g_CVE-2016-0705

CVE-2016-0702

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.

• https://github.com/Trinadh465/OpenSSL-1_0_1g_CVE-2016-0702

CVE-2016-0701

The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.

• https://github.com/luanjampa/cve-2016-0701

CVE-2016-0638

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

• https://github.com/0xn0ne/weblogicScanner

• https://github.com/zhzhdoai/Weblogic_Vuln

• https://github.com/minhangxiaohui/Weblogic_direct_T3_Rces

• https://github.com/BabyTeam1024/CVE-2016-0638

CVE-2016-0451

Unspecified vulnerability in the Oracle GoldenGate component in Oracle GoldenGate 11.2 and 12.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-0452.

• https://github.com/rwincey/Oracle-GoldenGate---CVE-2016-0451

CVE-2016-0199

Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and CVE-2016-3211.

• https://github.com/LeoonZHANG/CVE-2016-0199

CVE-2016-0189

The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.

• https://github.com/theori-io/cve-2016-0189

• https://github.com/deamwork/MS16-051-poc

CVE-2016-0100

Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."

• https://github.com/zi0Black/CVE-2016-010033-010045

CVE-2016-0099

The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."

• https://github.com/zcgonvh/MS16-032

CVE-2016-0095

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-0093, CVE-2016-0094, and CVE-2016-0096.

• https://github.com/fengjixuchui/cve-2016-0095-x64

CVE-2016-0051

The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."

• https://github.com/koczkatamas/CVE-2016-0051

• https://github.com/hexx0r/CVE-2016-0051

• https://github.com/ganrann/CVE-2016-0051

CVE-2016-0049

Kerberos in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 Gold and 1511 does not properly validate password changes, which allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action, aka "Windows Kerberos Security Feature Bypass."

• https://github.com/JackOfMostTrades/bluebox

CVE-2016-0040

The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

• https://github.com/Rootkitsmm-zz/cve-2016-0040

• https://github.com/de7ec7ed/CVE-2016-0040

CVE-2016-0034

Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution Vulnerability."

• https://github.com/hybridious/CVE-2016-0034-Decompile