VYPR

CVEs

1,665 total · page 29 of 34

AllCriticalHighKEV
  • CVE-2017-0148HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.82cvss 8.1epss 0.99

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0147HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.78cvss 7.5epss 1.00

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information…

  • CVE-2017-0146HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.85cvss 8.8epss 0.90

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0145HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.85cvss 8.8epss 0.90

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0144HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.86cvss 8.8epss 0.99

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0143HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.86cvss 8.8epss 0.93

    The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via…

  • CVE-2017-0101HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.76cvss 7.8epss 0.57

    The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain…

  • CVE-2017-0059MedKEVMar 17, 2017
    Microsoft
    Internet Explorer
    risk 0.48cvss 4.3epss 0.62

    Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and…

  • CVE-2017-0022MedKEVMar 17, 2017
    Microsoft
    XML Core Services
    risk 0.56cvss 6.5epss 0.18

    Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing…

  • CVE-2017-0005HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.64cvss 7.8epss 0.11

    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted…

  • CVE-2017-0001HigKEVMar 17, 2017
    Microsoft
    Windows
    risk 0.63cvss 7.8epss 0.03

    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted…

  • CVE-2017-5638CriKEVMar 11, 2017
    Apache
    Struts
    risk 0.86cvss 9.8epss 1.00

    The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type,…

  • CVE-2017-6334HigKEVMar 6, 2017
    Netgear
    Dgn2200 Firmware
    risk 0.78cvss 8.8epss 0.72

    dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

  • CVE-2017-0037HigKEVFeb 26, 2017
    Microsoft
    Internet Explorer
    risk 0.74cvss 8.1epss 0.80

    Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted…

  • CVE-2017-6077CriKEVFeb 22, 2017
    Netgear
    DGN2200
    risk 0.84cvss 9.8epss 0.68

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

  • CVE-2016-10174CriKEVJan 30, 2017
    Netgear
    WNR2000v5
    risk 0.85cvss 9.8epss 0.83

    The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.

  • CVE-2016-5198HigKEVJan 19, 2017
    Google
    Chrome
    risk 0.72cvss 8.8epss 0.35

    V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a…

  • CVE-2017-5521HigKEVJan 17, 2017
    Netgear
    R7000
    risk 0.75cvss 8.1epss 0.89

    An issue was discovered on NETGEAR R8500, R8300, R7000, R6400, R7300, R7100LG, R6300v2, WNDR3400v3, WNR3500Lv2, R6250, R6700, R6900, and R8000 devices. They are prone to password disclosure via simple crafted requests to the web management server. The bug is exploitable remotely…

  • CVE-2016-10033CriKEVDec 30, 2016
    Phpmailer Project
    Phpmailer
    risk 0.80cvss 9.8epss 1.00

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

  • CVE-2016-7262HigKEVDec 20, 2016
    Microsoft
    Excel
    risk 0.67cvss 7.8epss 0.58

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary commands via a crafted cell that is mishandled upon a click, aka "Microsoft Office…

  • CVE-2016-7892HigKEVDec 15, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.71cvss 8.8epss 0.19

    Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

  • CVE-2016-6277HigKEVDec 14, 2016
    Netgear
    R7000
    risk 0.80cvss 8.8epss 1.00

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly…

  • CVE-2016-9563MedKEVNov 23, 2016
    SAP
    Netweaver As Java
    risk 0.56cvss 6.5epss 0.24

    BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.

  • CVE-2016-8562HigKEVNov 18, 2016
    Siemens Foundation
    SIMATIC CP 1543-1
    risk 0.61cvss 7.5epss 0.04

    A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with…

  • CVE-2016-5195HigKEVNov 10, 2016
    Linux
    Kernel
    risk 0.60cvss 7.0epss 0.84

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

  • CVE-2016-7256HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.74cvss 8.8epss 0.65

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute…

  • CVE-2016-7255HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.72cvss 7.8epss 0.81

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted…

  • CVE-2016-7201HigKEVNov 10, 2016
    Microsoft
    Edge
    risk 0.72cvss 8.8epss 0.80

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-7200HigKEVNov 10, 2016
    Microsoft
    Edge
    risk 0.72cvss 8.8epss 0.82

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-7855HigKEVNov 1, 2016
    Adobe Inc.
    Flashplayer
    risk 0.71cvss 8.8epss 0.25

    Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.

  • CVE-2016-7193HigKEVOct 14, 2016
    Microsoft
    Word
    risk 0.67cvss 7.8epss 0.58

    Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1,…

  • CVE-2016-3393HigKEVOct 14, 2016
    Microsoft
    Windows
    risk 0.68cvss 7.8epss 0.69

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via…

  • CVE-2016-3298MedKEVOct 14, 2016
    Microsoft
    Internet Explorer
    risk 0.57cvss 6.5epss 0.23

    Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information…

  • CVE-2016-6415HigKEVSep 19, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.71cvss 7.5epss 0.87

    The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA)…

  • CVE-2016-3351MedKEVSep 14, 2016
    Microsoft
    Internet Explorer
    risk 0.62cvss 6.5epss 0.26

    Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

  • CVE-2016-4657HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.78cvss 8.8epss 0.64

    WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4656HigKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.68cvss 7.8epss 0.21

    The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4655MedKEVAug 25, 2016
    Apple Inc.
    iOS
    risk 0.53cvss 5.5epss 0.30

    The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

  • CVE-2016-6367HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.68cvss 7.8epss 0.23

    Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

  • CVE-2016-6366HigKEVAug 18, 2016
    Cisco Systems, Inc.
    Cisco Adaptive Security Appliance
    risk 0.79cvss 8.8epss 0.88

    Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Firepower 9300 ASA Security Module, PIX, and FWSM devices allows remote authenticated users to execute arbitrary code via crafted…

  • CVE-2016-3309HigKEVAug 9, 2016
    Microsoft
    Windows
    risk 0.73cvss 7.8epss 0.21

    The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka…

  • CVE-2016-3643HigKEVJun 17, 2016
    SolarWinds
    Virtualization Manager
    risk 0.66cvss 7.8epss 0.04

    SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."

  • CVE-2016-4171CriKEVJun 16, 2016
    Adobe Inc.
    Flashplayer
    risk 0.77cvss 9.8epss 0.20

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

  • CVE-2016-3235HigKEVJun 16, 2016
    Microsoft
    Visio
    risk 0.69cvss 7.8epss 0.43

    Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

  • CVE-2016-4523HigKEVJun 9, 2016
    Trihedral
    Vtscada
    risk 0.63cvss 7.5epss 0.31

    The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via unspecified vectors.

  • CVE-2016-4437CriKEVJun 7, 2016
    Apache
    Shiro
    risk 0.79cvss 9.8epss 0.93

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

  • CVE-2016-3088CriKEVJun 1, 2016
    Apache
    Activemq
    risk 0.80cvss 9.8epss 0.99

    The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.

  • CVE-2010-5326CriKEVMay 13, 2016
    SAP
    Netweaver Application Server Java
    risk 0.78cvss 10.0epss 0.17

    The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour"…

  • CVE-2016-4117CriKEVMay 11, 2016
    Adobe Inc.
    Flashplayer
    risk 0.86cvss 9.8epss 0.94

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

  • CVE-2016-0189HigKEVMay 11, 2016
    Microsoft
    Internet Explorer
    risk 0.71cvss 7.5epss 0.94

    The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine…