CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 9 and 10)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
3801 CVE-2016-5066 255 2017-04-09 2017-04-14
10.0
None Remote Low Not required Complete Complete Complete
Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 have weak passwords for admin, rauser, sconsole, and user.
3802 CVE-2016-5062 669 Exec Code 2016-09-29 2017-04-09
9.3
None Remote Medium Not required Complete Complete Complete
The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.
3803 CVE-2016-5020 264 +Priv 2016-06-30 2019-06-06
9.0
None Remote Low Single system Complete Complete Complete
F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.
3804 CVE-2016-5002 611 2017-10-27 2018-12-05
9.3
None Remote Medium Not required Complete Complete Complete
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
3805 CVE-2016-4965 78 Exec Code 2016-09-21 2016-09-21
9.0
None Remote Low Single system Complete Complete Complete
Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote authenticated users with access to the nslookup functionality to execute arbitrary commands with root privileges via the graph parameter to diagnosis_control.php.
3806 CVE-2016-4929 77 Exec Code 2017-03-20 2017-03-22
9.0
None Remote Low Single system Complete Complete Complete
Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.
3807 CVE-2016-4902 426 +Priv 2017-06-09 2017-06-22
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in The Public Certification Service for Individuals "The JPKI user's software (for Windows 7 and later)" Ver3.0.1 and earlier, The Public Certification Service for Individuals "The JPKI user's software (for Windows Vista)" Ver3.0.1 and earlier and The Public Certification Service for Individuals "The JPKI user's software" Ver2.6 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
3808 CVE-2016-4899 20 Exec Code 2017-04-13 2017-04-19
10.0
None Remote Low Not required Complete Complete Complete
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
3809 CVE-2016-4898 20 Exec Code 2017-04-13 2017-04-19
10.0
None Remote Low Not required Complete Complete Complete
The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command execution via unspecified attack vectors.
3810 CVE-2016-4846 426 2017-04-21 2017-04-26
9.3
None Remote Medium Not required Complete Complete Complete
Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2.
3811 CVE-2016-4813 284 +Priv 2016-06-18 2016-06-21
9.0
None Remote Low Single system Complete Complete Complete
NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN account.
3812 CVE-2016-4782 20 2016-05-23 2016-05-25
9.3
None Remote Medium Not required Complete Complete Complete
Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."
3813 CVE-2016-4780 476 DoS Exec Code 2017-02-20 2017-02-21
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "Thunderbolt" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
3814 CVE-2016-4778 264 DoS Exec Code Mem. Corr. 2016-09-25 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3815 CVE-2016-4777 264 DoS Exec Code 2016-09-25 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.
3816 CVE-2016-4753 20 Exec Code 2016-09-25 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
3817 CVE-2016-4750 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3818 CVE-2016-4738 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2019-06-18
9.3
None Remote Medium Not required Complete Complete Complete
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
3819 CVE-2016-4737 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
3820 CVE-2016-4736 119 DoS Overflow Mem. Corr. 2016-09-25 2017-11-13
9.3
None Remote Medium Not required Complete Complete Complete
libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file.
3821 CVE-2016-4735 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4734.
3822 CVE-2016-4734 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and CVE-2016-4735.
3823 CVE-2016-4733 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and CVE-2016-4735.
3824 CVE-2016-4731 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4729.
3825 CVE-2016-4730 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.
3826 CVE-2016-4729 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4731.
3827 CVE-2016-4727 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3828 CVE-2016-4726 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3829 CVE-2016-4724 476 DoS Exec Code 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
3830 CVE-2016-4723 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3831 CVE-2016-4712 787 DoS Exec Code 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.
3832 CVE-2016-4703 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3833 CVE-2016-4702 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2018-10-30
10.0
None Remote Low Not required Complete Complete Complete
Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
3834 CVE-2016-4700 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.
3835 CVE-2016-4699 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4700.
3836 CVE-2016-4698 20 Exec Code 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
3837 CVE-2016-4697 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3838 CVE-2016-4696 476 DoS Exec Code 2016-09-25 2017-07-29
9.3
None Remote Medium Not required Complete Complete Complete
AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
3839 CVE-2016-4675 264 Exec Code 2017-02-20 2018-10-30
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "libxpc" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
3840 CVE-2016-4671 787 DoS Exec Code 2017-02-20 2017-07-28
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "ImageIO" component. It allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) via a crafted PDF file.
3841 CVE-2016-4662 119 DoS Exec Code Overflow Mem. Corr. 2017-02-20 2017-07-28
9.3
None Remote Medium Not required Complete Complete Complete
An issue was discovered in certain Apple products. macOS before 10.12.1 is affected. The issue involves the "AppleGraphicsControl" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3842 CVE-2016-4658 119 DoS Exec Code Overflow Mem. Corr. 2016-09-25 2018-02-22
10.0
None Remote Low Not required Complete Complete Complete
xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.
3843 CVE-2016-4656 264 DoS Exec Code Mem. Corr. 2016-08-25 2018-06-07
9.3
None Remote Medium Not required Complete Complete Complete
The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3844 CVE-2016-4654 119 DoS Exec Code Overflow Mem. Corr. 2016-08-18 2016-11-28
9.3
None Remote Medium Not required Complete Complete Complete
IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3845 CVE-2016-4650 119 DoS Exec Code Overflow Mem. Corr. 2017-04-20 2017-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
3846 CVE-2016-4641 20 Exec Code +Info 2016-07-21 2017-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion."
3847 CVE-2016-4640 119 DoS Exec Code Overflow Mem. Corr. +Info 2016-07-21 2017-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app.
3848 CVE-2016-4638 264 +Priv 2016-07-21 2017-08-31
9.3
None Remote Medium Not required Complete Complete Complete
Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion."
3849 CVE-2016-4629 119 DoS Exec Code Overflow Mem. Corr. 2016-07-21 2017-08-31
10.0
None Remote Low Not required Complete Complete Complete
ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in an EXR image.
3850 CVE-2016-4621 119 DoS Exec Code Overflow Mem. Corr. 2016-07-21 2017-08-31
9.3
None Remote Medium Not required Complete Complete Complete
libc++abi in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.