VYPR

CVEs

8,988 total · page 165 of 180

AllCriticalHighKEV
  • CVE-2016-5666CriAug 3, 2016
    Crestron
    DM-TXRX-100-STR
    risk 0.64cvss 9.8epss 0.02

    Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1.

  • CVE-2016-5640CriAug 3, 2016
    Crestron
    AirMedia AM-100
    risk 0.68cvss 9.8epss 0.52

    Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.

  • CVE-2016-6178CriAug 2, 2016
    Huawei
    Cx600
    risk 0.64cvss 9.8epss 0.01

    Huawei NE40E and CX600 devices with software before V800R007SPH017; PTN 6900-2-M8 devices with software before V800R007SPH019; NE5000E devices with software before V800R006SPH018; and CloudEngine devices 12800 with software before V100R003SPH010 and V100R005 before…

  • CVE-2016-5229CriAug 2, 2016
    Atlassian
    Bamboo
    risk 0.64cvss 9.8epss 0.06

    Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.

  • CVE-2016-3737CriAug 2, 2016
    Red Hat
    Jboss Operations Network
    risk 0.64cvss 9.8epss 0.01

    The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.

  • CVE-2016-4837CriAug 1, 2016
    Ec Cube Co.,ltd.
    Seed Coupon
    risk 0.64cvss 9.8epss 0.03

    SQL injection vulnerability in the Seed Coupon plugin before 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2016-4373CriAug 1, 2016
    Cloudfoundry
    Operations Manager
    risk 0.64cvss 9.8epss 0.02

    The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

  • CVE-2016-4522CriJul 28, 2016
    Rockwellautomation
    Factorytalk Energrymetrix
    risk 0.64cvss 9.8epss 0.01

    SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2016-6296CriJul 25, 2016
    PHP
    PHP
    risk 0.65cvss 9.8epss 0.13

    Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have…

  • CVE-2016-6295CriJul 25, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.05

    ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have…

  • CVE-2016-6294CriJul 25, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.06

    The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service…

  • CVE-2016-6293CriJul 25, 2016
    Unicode
    International Components For Unicode
    risk 0.64cvss 9.8epss 0.01

    The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service…

  • CVE-2016-6291CriJul 25, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.07

    The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process…

  • CVE-2016-6290CriJul 25, 2016
    risk 0.64cvss 9.8epss 0.08

    ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors…

  • CVE-2016-6288CriJul 25, 2016
    PHP
    PHP
    risk 0.64cvss 9.8epss 0.04

    The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.

  • CVE-2016-1706CriJul 23, 2016
    Google
    Chrome
    risk 0.63cvss 9.6epss 0.01

    The PPAPI implementation in Google Chrome before 52.0.2743.82 does not validate the origin of IPC messages to the plugin broker process that should have come from the browser process, which allows remote attackers to bypass a sandbox protection mechanism via an unexpected…

  • CVE-2016-5743CriJul 22, 2016
    Siemens Foundation
    Wincc
    risk 0.65cvss 9.8epss 0.18

    Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1, SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1, SIMATIC OpenPCS 7 before 8.2 Update 1…

  • CVE-2016-4629CriJul 22, 2016
    Apple Inc.
    OS X
    risk 0.65cvss 9.8epss 0.11

    ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in an EXR image.

  • CVE-2016-4616CriJul 22, 2016
    Apple Inc.
    iTunes
    risk 0.64cvss 9.8epss 0.03

    libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4615CriJul 22, 2016
    Xmlsoft
    Libxml2
    risk 0.64cvss 9.8epss 0.03

    libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4614CriJul 22, 2016
    Apple Inc.
    iTunes
    risk 0.64cvss 9.8epss 0.03

    libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4610CriJul 22, 2016
    Apple Inc.
    iTunes
    risk 0.64cvss 9.8epss 0.06

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4609CriJul 22, 2016
    Apple Inc.
    iTunes
    risk 0.64cvss 9.8epss 0.06

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4608CriJul 22, 2016
    GNOME Foundation
    Libxslt
    risk 0.64cvss 9.8epss 0.04

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4607CriJul 22, 2016
    GNOME Foundation
    Libxslt
    risk 0.64cvss 9.8epss 0.07

    libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact…

  • CVE-2016-4598CriJul 22, 2016
    Apple Inc.
    Quicktime
    risk 0.64cvss 9.8epss 0.03

    QuickTime in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted image.

  • CVE-2016-5453CriJul 21, 2016
    Oracle Corporation
    Sun Systems Products Suite
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to IPMI.

  • CVE-2016-3613CriJul 21, 2016
    Oracle Corporation
    Secure Global Desktop
    risk 0.64cvss 9.8epss 0.05

    Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 4.63, 4.71, and 5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to OpenSSL.

  • CVE-2016-3610CriJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.63cvss 9.6epss 0.04

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.

  • CVE-2016-3609CriJul 21, 2016
    Oracle Corporation
    Database Server
    risk 0.59cvss 9.0epss 0.01

    Unspecified vulnerability in the OJVM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.

  • CVE-2016-3607CriJul 21, 2016
    Oracle Corporation
    Glassfish Server
    risk 0.64cvss 9.8epss 0.05

    Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.

  • CVE-2016-3606CriJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.63cvss 9.6epss 0.04

    Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

  • CVE-2016-3598CriJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.63cvss 9.6epss 0.07

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.

  • CVE-2016-3587CriJul 21, 2016
    Sun Corporation
    Java Se
    risk 0.63cvss 9.6epss 0.06

    Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.

  • CVE-2016-3586CriJul 21, 2016
    Oracle Corporation
    Weblogic Server
    risk 0.65cvss 9.8epss 0.12

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability…

  • CVE-2016-3556CriJul 21, 2016
    Oracle Corporation
    Agile Plm
    risk 0.64cvss 9.8epss 0.04

    Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 and 9.3.5 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to EM Integration.

  • CVE-2016-3546CriJul 21, 2016
    Oracle Corporation
    Advanced Collections
    risk 0.59cvss 9.1epss 0.01

    Unspecified vulnerability in the Oracle Advanced Collections component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Report JSPs.

  • CVE-2016-3543CriJul 21, 2016
    Oracle Corporation
    Common Applications Calendar
    risk 0.59cvss 9.1epss 0.01

    Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to Tasks.

  • CVE-2016-3541CriJul 21, 2016
    Oracle Corporation
    Common Applications Calendar
    risk 0.59cvss 9.1epss 0.01

    Unspecified vulnerability in the Oracle Common Applications Calendar component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to Notes.

  • CVE-2016-3527CriJul 21, 2016
    Oracle Corporation
    Demand Planning
    risk 0.59cvss 9.1epss 0.01

    Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 12.1 and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to ODPDA Servlet.

  • CVE-2016-3510CriJul 21, 2016
    Oracle Corporation
    Weblogic Server
    risk 0.74cvss 9.8epss 0.94

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability…

  • CVE-2016-3504CriJul 21, 2016
    Oracle Corporation
    Jdeveloper
    risk 0.64cvss 9.8epss 0.02

    Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, and 12.2.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to ADF Faces.

  • CVE-2016-3499CriJul 21, 2016
    Oracle Corporation
    Weblogic Server
    risk 0.64cvss 9.8epss 0.07

    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.3.0 and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Web Container.

  • CVE-2016-3493CriJul 21, 2016
    Oracle Corporation
    Hyperion Financial Reporting
    risk 0.64cvss 9.8epss 0.03

    Unspecified vulnerability in the Hyperion Financial Reporting component in Oracle Hyperion 11.1.2.4 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Security Models.

  • CVE-2016-3468CriJul 21, 2016
    Oracle Corporation
    Agile Engineering Data Management
    risk 0.64cvss 9.8epss 0.06

    Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 and 6.2.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Install.

  • CVE-2016-3444CriJul 21, 2016
    Oracle Corporation
    Retail Integration Bus
    risk 0.64cvss 9.8epss 0.06

    Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Retail Applications 13.0, 13.1, 13.2, 14.0, 14.1, and 15.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Install.

  • CVE-2016-5080CriJul 19, 2016
    Objective Systems
    ASN1C for C/C++
    risk 0.64cvss 9.8epss 0.10

    Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled…

  • CVE-2016-5804CriJul 15, 2016
    Moxa
    MGate MB3180
    risk 0.64cvss 9.8epss 0.00

    Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value.

  • CVE-2016-4520CriJul 15, 2016
    Schneider Electric
    Pelco Digital Sentry Video Management System Firmware
    risk 0.64cvss 9.8epss 0.03

    Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials, which allows remote attackers to obtain access, and consequently execute arbitrary code, via unspecified vectors.

  • CVE-2016-4372CriJul 15, 2016
    HPE
    iMC PLAT
    risk 0.68cvss 9.8epss 0.10

    HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 E0402P02, and iMC UAM_TAM before 7.2 E0405P05 allow remote attackers to execute arbitrary commands via a crafted serialized Java object,…