Vulnerabilities > Critical

DATE CVE VULNERABILITY TITLE RISK
2016-04-12 CVE-2016-1034 Unspecified vulnerability in Adobe Creative Cloud
The Sync Process in the JavaScript API for Creative Cloud Libraries in Adobe Creative Cloud Desktop Application before 3.6.0.244 allows remote attackers to read or write to arbitrary files via unspecified vectors.
network
low complexity
adobe
critical
 9.1
9.1
2016-04-12 CVE-2016-0088 Improper Access Control vulnerability in Microsoft Windows 10, Windows 8.1 and Windows Server 2012
Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."
local
low complexity
microsoft CWE-284
critical
 9.3
9.3
2016-04-12 CVE-2016-3657 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Paloaltonetworks Pan-Os
Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.
network
low complexity
paloaltonetworks CWE-119
critical
 9.8
9.8
2016-04-12 CVE-2016-3655 OS Command Injection vulnerability in Paloaltonetworks Pan-Os
The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
network
low complexity
paloaltonetworks CWE-78
critical
 9.8
9.8
2016-04-12 CVE-2016-2170 Improper Input Validation vulnerability in Apache Ofbiz
Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
network
low complexity
apache CWE-20
critical
 9.8
9.8
2016-04-12 CVE-2016-0733 Improper Authentication vulnerability in Apache Ranger 0.4.0/0.4.1/0.5.0
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
network
low complexity
apache CWE-287
critical
 9.8
9.8
2016-04-12 CVE-2016-3987 Improper Access Control vulnerability in Trendmicro Password Manager
The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.
network
low complexity
trendmicro CWE-284
critical
 9.8
9.8
2016-04-12 CVE-2015-8841 Out-of-bounds Write vulnerability in Eset Nod32
Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.
network
low complexity
eset CWE-787
critical
 9.8
9.8
2016-04-12 CVE-2015-8833 Unspecified vulnerability in Cypherpunks Pidgin-Otr
Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.
network
low complexity
cypherpunks
critical
 9.8
9.8
2016-04-11 CVE-2015-8710 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.
network
low complexity
xmlsoft debian CWE-119
critical
 9.8
9.8