VYPR

CVEs

1,665 total · page 30 of 34

AllCriticalHighKEV
  • CVE-2016-0185HigKEVMay 11, 2016
    Microsoft
    Windows
    risk 0.71cvss 7.8epss 0.70

    Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Center link (aka .mcl) file, aka "Windows Media Center Remote Code Execution Vulnerability."

  • CVE-2016-3718MedKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.57cvss 5.5epss 0.77

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

  • CVE-2016-3715MedKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.57cvss 5.5epss 0.75

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

  • CVE-2016-3714HigKEVMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.70cvss 8.4epss 0.97

    The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka "ImageTragick."

  • CVE-2016-3427CriKEVApr 21, 2016
    NetApp
    Oncommand Balance
    risk 0.76cvss 9.8epss 0.92

    Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

  • CVE-2016-0167HigKEVApr 12, 2016
    Microsoft
    Windows
    risk 0.69cvss 7.8epss 0.06

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0165HigKEVApr 12, 2016
    Microsoft
    Windows
    risk 0.67cvss 7.8epss 0.14

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0162MedKEVApr 12, 2016
    Microsoft
    Internet Explorer
    risk 0.42cvss 4.3epss 0.22

    Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explorer Information Disclosure Vulnerability."

  • CVE-2016-0151HigKEVApr 12, 2016
    Microsoft
    Windows Server 2012
    risk 0.77cvss 7.8epss 0.63

    The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security…

  • CVE-2016-3976HigKEVApr 7, 2016
    SAP
    Netweaver As Java
    risk 0.67cvss 7.5epss 0.47

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

  • CVE-2016-1019CriKEVApr 7, 2016
    Adobe Inc.
    Air SDK
    risk 0.83cvss 9.8epss 0.22

    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

  • CVE-2016-1646HigKEVMar 29, 2016
    Google
    Chrome
    risk 0.73cvss 8.8epss 0.48

    The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other…

  • CVE-2016-1010HigKEVMar 12, 2016
    Adobe Inc.
    Air
    risk 0.71cvss 8.8epss 0.20

    Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to…

  • CVE-2016-0099HigKEVMar 9, 2016
    Microsoft
    Windows
    risk 0.75cvss 7.8epss 0.37

    The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain…

  • CVE-2016-2388MedKEVFeb 16, 2016
    SAP
    Netweaver As Java
    risk 0.54cvss 5.3epss 0.52

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

  • CVE-2016-2386CriKEVFeb 16, 2016
    SAP
    Netweaver J2ee Engine
    risk 0.84cvss 9.8epss 0.71

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

  • CVE-2016-0752HigKEVFeb 16, 2016
    Rubyonrails
    Rails
    risk 0.64cvss 7.5epss 0.96

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render…

  • CVE-2016-0984HigKEVFeb 10, 2016
    Adobe Inc.
    Air SDK
    risk 0.77cvss 8.8epss 0.55

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows…

  • CVE-2016-0040HigKEVFeb 10, 2016
    Microsoft
    Windows
    risk 0.68cvss 7.8epss 0.25

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."

  • CVE-2016-0034HigKEVJan 13, 2016
    Microsoft
    Silverlight
    risk 0.80cvss 8.8epss 0.59

    Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site, aka "Silverlight Runtime Remote Code Execution…

  • CVE-2015-7450CriKEVJan 2, 2016
    IBM
    Websphere Application Server
    risk 0.87cvss 9.8epss 0.98

    Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the…

  • CVE-2015-8651HigKEVDec 28, 2015
    Adobe Inc.
    Air
    risk 0.75cvss 8.8epss 0.68

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to…

  • CVE-2015-7755CriKEVDec 19, 2015
    Juniper Networks
    Screenos
    risk 0.84cvss 9.8epss 0.61

    Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before…

  • CVE-2015-6175HigKEVDec 9, 2015
    Microsoft
    Windows 10 1909
    risk 0.63cvss 7.8epss 0.05

    The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability."

  • CVE-2015-5317HigKEVNov 25, 2015
    Jenkins Project
    Jenkins
    risk 0.56cvss 7.5epss 0.22

    The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.

  • CVE-2015-4852CriKEVNov 18, 2015
    Oracle Corporation
    Weblogic Server
    risk 0.86cvss 9.8epss 0.96

    The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache…

  • CVE-2015-4902MedKEVOct 22, 2015
    Sun Corporation
    Java SE
    risk 0.48cvss 5.3epss 0.13

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

  • CVE-2015-7645HigKEVOct 15, 2015
    Adobe Inc.
    Flashplayer
    risk 0.77cvss 7.8epss 0.68

    Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

  • CVE-2015-2546HigKEVSep 9, 2015
    Microsoft
    Windows
    risk 0.72cvss 8.2epss 0.11

    The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2015-2545HigKEVSep 9, 2015
    Microsoft
    Office
    risk 0.70cvss 7.8epss 0.80

    Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."

  • CVE-2015-2502HigKEVAug 19, 2015
    Microsoft
    Internet Explorer
    risk 0.73cvss 8.8epss 0.39

    Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015.

  • CVE-2015-1769MedKEVAug 15, 2015
    Microsoft
    Windows
    risk 0.55cvss 6.6epss 0.04

    Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary…

  • CVE-2015-1642HigKEVAug 15, 2015
    Microsoft
    Office
    risk 0.67cvss 7.8epss 0.53

    Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2015-4495HigKEVAug 8, 2015
    Mozilla Corporation
    Firefox
    risk 0.78cvss 8.8epss 0.69

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as…

  • CVE-2015-2426HigKEVJul 20, 2015
    Microsoft
    Windows
    risk 0.79cvss 8.8epss 0.87

    Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute…

  • CVE-2015-2590CriKEVJul 16, 2015
    Sun Corporation
    Java SE
    risk 0.78cvss 9.8epss 0.25

    Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

  • CVE-2015-2387HigKEVJul 14, 2015
    Microsoft
    Windows
    risk 0.66cvss 7.8epss 0.35

    ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges…

  • CVE-2015-2425HigKEVJul 14, 2015
    Microsoft
    Internet Explorer
    risk 0.73cvss 8.8epss 0.45

    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.

  • CVE-2015-2424HigKEVJul 14, 2015
    Microsoft
    Word
    risk 0.72cvss 8.8epss 0.39

    Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka…

  • CVE-2015-2419HigKEVJul 14, 2015
    Microsoft
    Internet Explorer
    risk 0.76cvss 8.8epss 0.45

    JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."

  • CVE-2015-5123CriKEVJul 14, 2015
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.77cvss 9.8epss 0.18

    Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on…

  • CVE-2015-5122CriKEVJul 14, 2015
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.86cvss 9.8epss 0.94

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on…

  • CVE-2015-5119CriKEVJul 8, 2015
    Adobe Inc.
    Flashplayer
    risk 0.87cvss 9.8epss 0.99

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code…

  • CVE-2015-3113CriKEVJun 23, 2015
    Microfocus
    System Management Homepage
    risk 0.87cvss 9.8epss 1.00

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

  • CVE-2015-2360HigKEVJun 10, 2015
    Microsoft
    Windows
    risk 0.70cvss 8.8epss 0.15

    win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges…

  • CVE-2015-1770HigKEVJun 10, 2015
    Microsoft
    Office
    risk 0.72cvss 8.8epss 0.35

    Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."

  • CVE-2015-4068CriKEVMay 29, 2015
    Arcserve
    UDP
    risk 0.76cvss 9.1epss 0.64

    Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.

  • CVE-2015-1671HigKEVMay 13, 2015
    Microsoft
    .net Framework
    risk 0.67cvss 7.8epss 0.55

    The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and…

  • CVE-2014-8361CriKEVMay 1, 2015
    Realtek
    SDK
    risk 0.87cvss 9.8epss 1.00

    The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild through 2023.

  • CVE-2015-3035HigKEVApr 22, 2015
    TP-Link
    Archer C5
    risk 0.70cvss 7.5epss 0.84

    Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302,…