VYPR

CVEs

1,630 total · page 29 of 33

AllCriticalHighKEV
  • CVE-2016-3351MedKEVSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.62cvss 6.5epss 0.26

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

  • CVE-2016-4657HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.78cvss 8.8epss 0.67

    WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4656HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.68cvss 7.8epss 0.24

    The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4655MedKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.53cvss 5.5epss 0.33

    The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

  • CVE-2016-6367HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.68cvss 7.8epss 0.23

    Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

  • CVE-2016-6366HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.79cvss 8.8epss 0.88

    Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted…

  • CVE-2016-3309HigKEVAug 9, 2016
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.21

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3643HigKEVJun 17, 2016
    SolarWinds
    Virtualization Manager
    risk 0.66cvss 7.8epss 0.04

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."

  • CVE-2016-4171CriKEVJun 16, 2016
    Adobe Inc.
    Flashplayer
    risk 0.77cvss 9.8epss 0.20

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

  • CVE-2016-3235HigKEVJun 16, 2016
    Microsoft
    Visio
    risk 0.69cvss 7.8epss 0.43

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

  • CVE-2016-4523HigKEVJun 9, 2016
    Trihedral
    Vtscada
    risk 0.63cvss 7.5epss 0.31

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.

  • CVE-2016-4437CriKEVJun 7, 2016
    Apache
    Shiro
    risk 0.79cvss 9.8epss 0.93

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

  • CVE-2016-3088CriKEVJun 1, 2016
    Apache
    Activemq
    risk 0.80cvss 9.8epss 0.99

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

  • CVE-2010-5326CriKEVMay 13, 2016
    SAP
    Netweaver Application Server Java
    risk 0.78cvss 10.0epss 0.17

    The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour"…

  • CVE-2016-4117CriKEVMay 11, 2016
    Adobe Inc.
    Flashplayer
    risk 0.86cvss 9.8epss 0.94

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

  • CVE-2016-0189HigKEVMay 11, 2016
    Microsoft
    Internet Explorer
    risk 0.71cvss 7.5epss 0.93

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine…

  • CVE-2016-0185HigKEVMay 11, 2016
    Microsoft
    Windows
    risk 0.71cvss 7.8epss 0.70

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

  • CVE-2016-3718MedKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.57cvss 5.5epss 0.77

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

  • CVE-2016-3715MedKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.57cvss 5.5epss 0.75

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

  • CVE-2016-3714HigKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.77cvss 8.4epss 0.97

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

  • CVE-2016-3427CriKEVApr 21, 2016
    NetApp
    Oncommand Balance
    risk 0.76cvss 9.8epss 0.92

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

  • CVE-2016-0167HigKEVApr 12, 2016
    Microsoft
    Windows
    risk 0.69cvss 7.8epss 0.06

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0165HigKEVApr 12, 2016
    Microsoft
    Windows
    risk 0.67cvss 7.8epss 0.14

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0162MedKEVApr 12, 2016
    Microsoft
    Internet Explorer
    risk 0.42cvss 4.3epss 0.22

    Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2016-0151HigKEVApr 12, 2016
    Microsoft
    Windows Server 2012
    risk 0.77cvss 7.8epss 0.63

    The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security…

  • CVE-2016-3976HigKEVApr 7, 2016
    SAP
    Netweaver As Java
    risk 0.67cvss 7.5epss 0.47

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

  • CVE-2016-1019CriKEVApr 7, 2016
    Adobe Inc.
    Air SDK
    risk 0.83cvss 9.8epss 0.22

    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

  • CVE-2016-1646HigKEVMar 29, 2016
    Google
    Chrome
    risk 0.73cvss 8.8epss 0.48

    The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other…

  • CVE-2016-1010HigKEVMar 12, 2016
    Adobe Inc.
    Air
    risk 0.71cvss 8.8epss 0.20

    Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to…

  • CVE-2016-0099HigKEVMar 9, 2016
    Microsoft
    Windows
    risk 0.75cvss 7.8epss 0.37

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain…

  • CVE-2016-2388MedKEVFeb 16, 2016
    SAP
    Netweaver As Java
    risk 0.54cvss 5.3epss 0.52

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

  • CVE-2016-2386CriKEVFeb 16, 2016
    SAP
    Netweaver J2ee Engine
    risk 0.84cvss 9.8epss 0.71

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

  • CVE-2016-0752HigKEVFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.64cvss 7.5epss 0.96

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render…

  • CVE-2016-0984HigKEVFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.77cvss 8.8epss 0.55

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…

  • CVE-2016-0040HigKEVFeb 10, 2016
    Microsoft
    Windows
    risk 0.68cvss 7.8epss 0.25

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  • CVE-2016-0034HigKEVJan 13, 2016
    Microsoft
    Silverlight
    risk 0.81cvss 8.8epss 0.70

    Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution…

  • CVE-2015-7450CriKEVJan 2, 2016
    IBM
    Websphere Application Server
    risk 0.87cvss 9.8epss 0.98

    Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the…

  • CVE-2015-8651HigKEVDec 28, 2015
    Adobe Inc.
    Air
    risk 0.75cvss 8.8epss 0.68

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to…

  • CVE-2015-7755CriKEVDec 19, 2015
    Juniper Networks
    Screenos
    risk 0.84cvss 9.8epss 0.61

    Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before…

  • CVE-2015-6175HigKEVDec 9, 2015
    Microsoft
    Windows 10 1909
    risk 0.63cvss 7.8epss 0.05

    The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."

  • CVE-2015-5317HigKEVNov 25, 2015
    Jenkins Project
    Jenkins
    risk 0.56cvss 7.5epss 0.22

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

  • CVE-2015-4852CriKEVNov 18, 2015
    Oracle Corporation
    Weblogic Server
    risk 0.86cvss 9.8epss 0.96

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache…

  • CVE-2015-4902MedKEVOct 22, 2015
    Sun Corporation
    Java SE
    risk 0.48cvss 5.3epss 0.13

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

  • CVE-2015-7645HigKEVOct 15, 2015
    Adobe Inc.
    Flashplayer
    risk 0.77cvss 7.8epss 0.68

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

  • CVE-2015-2546HigKEVSep 9, 2015
    Microsoft
    Windows
    risk 0.72cvss 8.2epss 0.11

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2015-2545HigKEVSep 9, 2015
    Microsoft
    Office
    risk 0.70cvss 7.8epss 0.86

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."

  • CVE-2015-2502HigKEVAug 19, 2015
    Microsoft
    Internet Explorer
    risk 0.73cvss 8.8epss 0.51

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.

  • CVE-2015-1769MedKEVAug 15, 2015
    Microsoft
    Windows
    risk 0.55cvss 6.6epss 0.04

    Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary…

  • CVE-2015-1642HigKEVAug 15, 2015
    Microsoft
    Office
    risk 0.67cvss 7.8epss 0.53

    Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2015-4495HigKEVAug 8, 2015
    Mozilla Corporation
    Firefox
    risk 0.78cvss 8.8epss 0.70

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as…