Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-04-13 CVE-2016-4007 Unspecified vulnerability in Opensuse Leap and Opensuse
Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with "illegal options."
network
low complexity
opensuse
critical
 9.8
9.8
2016-04-13 CVE-2014-9766 Numeric Errors vulnerability in multiple products
Integer overflow in the create_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via large height and stride values.
network
low complexity
pixman canonical CWE-189
critical
 9.8
9.8
2016-04-12 CVE-2016-1034 Unspecified vulnerability in Adobe Creative Cloud
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
network
low complexity
adobe
critical
 9.1
9.1
2016-04-12 CVE-2016-0088 Improper Access Control vulnerability in Microsoft Windows 10, Windows 8.1 and Windows Server 2012
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."
local
low complexity
microsoft CWE-284
critical
 9.3
9.3
2016-04-12 CVE-2016-3657 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Paloaltonetworks Pan-Os
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
network
low complexity
paloaltonetworks CWE-119
critical
 9.8
9.8
2016-04-12 CVE-2016-3655 OS Command Injection vulnerability in Paloaltonetworks Pan-Os
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
network
low complexity
paloaltonetworks CWE-78
critical
 9.8
9.8
2016-04-12 CVE-2016-2170 Improper Input Validation vulnerability in Apache Ofbiz
Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
network
low complexity
apache CWE-20
critical
 9.8
9.8
2016-04-12 CVE-2016-0733 Improper Authentication vulnerability in Apache Ranger 0.4.0/0.4.1/0.5.0
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
network
low complexity
apache CWE-287
critical
 9.8
9.8
2016-04-12 CVE-2016-3987 Improper Access Control vulnerability in Trendmicro Password Manager
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
network
low complexity
trendmicro CWE-284
critical
 9.8
9.8
2016-04-12 CVE-2015-8841 Out-of-bounds Write vulnerability in Eset Nod32
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
network
low complexity
eset CWE-787
critical
 9.8
9.8