CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2016-5262 – Mozilla: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
https://notcve.org/view.php?id=CVE-2016-5262
03 Aug 2016 — Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versiones anteriores a 45.3 procesa atributos de controladores de eventos JavaScript de un elemento MARQUEE dentro... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 1CVE-2016-5264 – Mozilla: Use-after-free when applying SVG effects (MFSA 2016-79)
https://notcve.org/view.php?id=CVE-2016-5264
03 Aug 2016 — Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. Vulnerabilidad de uso después de liberación de memoria en la función nsNodeUtils::NativeAnonymousChildListChange en Mozilla Firefox en versiones anteriores a 48.0 y Firefox ESR 45.x en versi... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 38EXPL: 0CVE-2016-5403 – Qemu: virtio: unbounded memory allocation on host via guest leading to DoS
https://notcve.org/view.php?id=CVE-2016-5403
02 Aug 2016 — The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. La función virtqueue_pop en hw/virtio/virtio.c en QEMU permite a administradores locales del SO invitado provocar una denegación de servicio (consumo de memoria y caida del proceso QUEMU) mediante la presentación de solicitudes sin esperar la finalización. Quick Emulator (QEMU) built with ... • http://rhn.redhat.com/errata/RHSA-2016-1585.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 30%CPEs: 32EXPL: 0CVE-2016-2180 – OpenSSL: OOB read in TS_OBJ_print_bio()
https://notcve.org/view.php?id=CVE-2016-2180
01 Aug 2016 — The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command. La función TS_OBJ_print_bio en crypto/ts/ts_lib.c en la implementación X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) en OpenSSL hasta la versión 1.0.2h permite a atacan... • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 • CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2016-3458 – OpenJDK: insufficient restrictions on the use of custom ValueHandler (CORBA, 8079718)
https://notcve.org/view.php?id=CVE-2016-3458
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA. Vulnerabilidad no especificada en Oracle Java SE 6u115, 7u101 y 8u92 y Java SE Embedded 8u91 permite a atacantes remotos afectar la integridad a través de vectores relacionados con CORBA. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00011.html •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2016-3500 – OpenJDK: maximum XML name limit not applied to namespace URIs (JAXP, 8148872)
https://notcve.org/view.php?id=CVE-2016-3500
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508. Vulnerabilidad no especificada en Oracle Java SE 6u115, 7u101 y 8u92; Java SE Embedded 8u91 y JRockit R28.3.10 permite a atacantes remotos afectar la disponibilidad a través de vectores relacionados con JAXP, una vulnerabilidad diferente a CVE-2016-3508. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00011.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2016-3508 – OpenJDK: missing entity replacement limits (JAXP, 8149962)
https://notcve.org/view.php?id=CVE-2016-3508
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500. Vulnerabilidad no especificada en Oracle Java SE 6u115, 7u101 y 8u92; Java SE Embedded 8u91 y JRockit R28.3.10 permite a atacantes remotos afectar la disponibilidad a través de vectores relacionados con JAXP, una vulnerabilidad diferente a CVE-2016-3500. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00011.html • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2016-3550 – OpenJDK: integer overflows in bytecode streams (Hotspot, 8152479)
https://notcve.org/view.php?id=CVE-2016-3550
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot. Vulnerabilidad en Oracle Java SE 6u115, 7u101 y 8u92 y Java SE Embedded 8u91 permite a atacantes remotos afectar la confidencialidad a través de vectores relacionados con Hotspot. • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00011.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.6EPSS: 1%CPEs: 6EXPL: 0CVE-2016-3587 – Oracle Java MethodHandle Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-3587
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. Vulnerabilidad no especificada en Oracle Java SE 8u92 y Java SE Embedded 8u91 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con Hotspot. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Jav... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00024.html •
CVSS: 9.6EPSS: 1%CPEs: 7EXPL: 0CVE-2016-3610 – Oracle Java MethodHandles filterReturnValue Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-3610
21 Jul 2016 — Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598. Vulnerabilidad no especificada en Oracle Java SE 8u92 y Java SE Embedded 8u91 permite a atacantes remotos afectar la confidencialidad, la integridad y la disponibilidad a través de vectores relacionados con Libraries, una vulnerabilidad diferente a CVE-2016-3598. This vulnerabi... • http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00011.html •