Vulnerabilities > High

DATE CVE VULNERABILITY TITLE RISK
2016-08-05 CVE-2016-6148 Improper Input Validation vulnerability in SAP Hana 1.00.73.00.389160
SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vectors related to an IMPORT statement, aka SAP Security Note 2233136.
network
low complexity
sap CWE-20
7.5
2016-08-05 CVE-2016-6144 Improper Access Control vulnerability in SAP Hana 1.0/1.00
The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password_lock_for_system_user is not supported or is configured as "False," which makes it easier for remote attackers to bypass authentication via a brute force attack, aka SAP Security Note 2216869.
network
high complexity
sap CWE-284
8.1
2016-08-05 CVE-2016-1513 Out-of-bounds Write vulnerability in Apache Openoffice
The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary code via crafted MetaActions in an (1) ODP or (2) OTP file.
local
low complexity
apache CWE-787
7.8
2016-08-05 CVE-2016-5266 Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox
Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site.
network
low complexity
mozilla CWE-264
8.1
2016-08-05 CVE-2016-5264 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.
network
low complexity
mozilla oracle CWE-416
8.8
2016-08-05 CVE-2016-5263 Incorrect Type Conversion or Cast vulnerability in multiple products
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."
network
low complexity
mozilla oracle CWE-704
8.8
2016-08-05 CVE-2016-5261 Integer Overflow or Wraparound vulnerability in Mozilla Firefox
Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR < 45.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering.
network
low complexity
mozilla CWE-190
8.8
2016-08-05 CVE-2016-5259 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.
network
low complexity
mozilla oracle CWE-416
8.8
2016-08-05 CVE-2016-5258 Use After Free vulnerability in multiple products
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.
network
low complexity
oracle mozilla CWE-416
8.8
2016-08-05 CVE-2016-5255 Use After Free vulnerability in Mozilla Firefox
Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code via crafted JavaScript that is mishandled during incremental garbage collection.
network
low complexity
mozilla CWE-416
8.8