VYPR

CVEs

102,253 total · page 1693 of 2,046

AllCriticalHighKEV
  • CVE-2019-0576HigJan 8, 2019
    Microsoft
    Windows
    risk 0.52cvss 7.8epss 0.17

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows…

  • CVE-2019-0575HigJan 8, 2019
    Microsoft
    Windows Server 2008
    risk 0.52cvss 7.8epss 0.14

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows…

  • CVE-2019-0574HigJan 8, 2019
    Microsoft
    Windows
    risk 0.55cvss 7.8epss 0.19

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10…

  • CVE-2019-0573HigJan 8, 2019
    Microsoft
    Windows
    risk 0.55cvss 7.8epss 0.20

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10…

  • CVE-2019-0572HigJan 8, 2019
    Microsoft
    Windows Data Sharing Service
    risk 0.56cvss 7.8epss 0.25

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10…

  • CVE-2019-0571HigJan 8, 2019
    Microsoft
    Windows Data Sharing Service
    risk 0.55cvss 7.8epss 0.16

    An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka "Windows Data Sharing Service Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10…

  • CVE-2019-0570HigJan 8, 2019
    Microsoft
    Windows Runtime
    risk 0.54cvss 7.8epss 0.03

    An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka "Windows Runtime Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2019, Windows Server…

  • CVE-2019-0568HigJan 8, 2019
    Microsoft
    Edge
    risk 0.02cvss 7.5epss 0.69

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539,…

  • CVE-2019-0567HigJan 8, 2019
    Microsoft
    Edge
    risk 0.02cvss 7.5epss 0.80

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539,…

  • CVE-2019-0566HigJan 8, 2019
    Microsoft
    Edge
    risk 0.62cvss 8.8epss 0.19

    An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This affects Microsoft Edge.

  • CVE-2019-0565HigJan 8, 2019
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.10

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.

  • CVE-2019-0564HigJan 8, 2019
    Microsoft
    Asp.net
    risk 0.49cvss 7.5epss 0.08

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

  • CVE-2019-0555HigJan 8, 2019
    Microsoft
    Windows
    risk 0.54cvss 7.8epss 0.02

    An elevation of privilege vulnerability exists in the Microsoft XmlDocument class that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft XmlDocument Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows…

  • CVE-2019-0552HigJan 8, 2019
    Microsoft
    Windows
    risk 0.60cvss 8.8epss 0.03

    An elevation of privilege exists in Windows COM Desktop Broker, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

  • CVE-2019-0551HigJan 8, 2019
    Microsoft
    Windows
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10,…

  • CVE-2019-0550HigJan 8, 2019
    Microsoft
    Windows
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10,…

  • CVE-2019-0548HigJan 8, 2019
    Microsoft
    Asp.net
    risk 0.49cvss 7.5epss 0.08

    A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.

  • CVE-2019-0546HigJan 8, 2019
    Microsoft
    Visual Studio
    risk 0.52cvss 7.8epss 0.16

    A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio.

  • CVE-2019-0545HigJan 8, 2019
    Microsoft
    Chart Control For Microsoft .net Framework
    risk 0.50cvss 7.5epss 0.10

    An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET…

  • CVE-2019-0543HigKEVJan 8, 2019
    Microsoft
    Windows
    risk 0.72cvss 7.8epss 0.05

    An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows…

  • CVE-2019-0541HigKEVJan 8, 2019
    Microsoft
    Internet Explorer
    risk 0.76cvss 8.8epss 0.53

    A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft…

  • CVE-2019-0539HigJan 8, 2019
    Microsoft
    Edge
    risk 0.03cvss 7.5epss 0.83

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567,…

  • CVE-2019-0538HigJan 8, 2019
    Microsoft
    Windows
    risk 0.52cvss 7.8epss 0.21

    A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows…

  • CVE-2019-0249HigJan 8, 2019
    SAP
    Landscape Management
    risk 0.49cvss 7.5epss 0.02

    Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwise be restricted.

  • CVE-2019-0243HigJan 8, 2019
    SAP
    BW4HANA
    risk 0.57cvss 8.8epss 0.02

    Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

  • CVE-2019-0241HigJan 8, 2019
    SAP
    Work and Inventory Manager
    risk 0.49cvss 7.5epss 0.02

    SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.

  • CVE-2019-0240HigJan 8, 2019
    SAP
    Business Objects Mobile for Android
    risk 0.49cvss 7.5epss 0.02

    SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the form of a SAP BI link, preventing legitimate users from accessing the application by crashing it.

  • CVE-2018-2499HigJan 8, 2019
    SAP
    Financial Consolidation Cube Designer
    risk 0.49cvss 7.5epss 0.02

    A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an attacker to discover the password hash of an admin user.

  • CVE-2018-2484HigJan 8, 2019
    SAP
    S4CORE
    risk 0.57cvss 8.8epss 0.01

    SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/CFM 4.63_20) does not perform necessary authorization checks for an authenticated user, resulting…

  • CVE-2019-5488HigJan 7, 2019
    EARCLINK
    ESPCMS-P8
    risk 0.49cvss 7.5epss 0.01

    EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter. install_pack/espcms_public/espcms_db.php may allow retrieving sensitive information from the ESPCMS database.

  • CVE-2018-1320HigJan 7, 2019
    risk 0.42cvss 7.5epss 0.08

    Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production…

  • CVE-2018-5481HigJan 7, 2019
    NetApp
    OnCommand Unified Manager for 7-Mode
    risk 0.48cvss 7.4epss 0.01

    OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via man-in-the-middle (MITM) attacks.

  • CVE-2018-5410HigJan 7, 2019
    Dokan Dev
    Dokany
    risk 0.54cvss 7.8epss 0.02

    Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was…

  • CVE-2019-5009HigJan 4, 2019
    Vtiger
    CRM
    risk 0.51cvss 7.2epss 0.10

    Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a…

  • CVE-2019-5007HigJan 3, 2019
    Foxitsoftware
    Reader
    risk 0.46cvss 7.1epss 0.02

    An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Disclosure and crash due to a NULL pointer dereference when reading TIFF data during TIFF parsing.

  • CVE-2018-19249HigJan 3, 2019
    Stripe
    Stripe CLI
    risk 0.49cvss 7.5epss 0.01

    The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card{}, and reading the cvc_check information if the creation is successful without charging the…

  • CVE-2019-3575HigJan 3, 2019
    Schettino72
    Sqla YAML Fixtures
    risk 0.51cvss 7.8epss 0.00

    Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.

  • CVE-2018-19998HigJan 3, 2019
    Dolibarr
    Dolibarr
    risk 0.50cvss 8.8epss 0.02

    SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter.

  • CVE-2018-19994HigJan 3, 2019
    Dolibarr
    Dolibarr
    risk 0.50cvss 8.8epss 0.02

    An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter.

  • CVE-2018-16882HigJan 3, 2019
    Linux
    Kernel
    risk 0.57cvss 8.8epss 0.00

    A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without…

  • CVE-2017-18330HigJan 3, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425,…

  • CVE-2017-18329HigJan 3, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415,…

  • CVE-2017-18328HigJan 3, 2019
    Qualcomm
    Snapdragon Mobile
    risk 0.51cvss 7.8epss 0.00

    Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 820, SD 835, SDA660,…

  • CVE-2017-18320HigJan 3, 2019
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and snapdragon mobile in versions MSM8996AU, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD…

  • CVE-2017-18141HigJan 3, 2019
    Qualcomm
    Snapdragon Mobile
    risk 0.51cvss 7.8epss 0.00

    When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions…

  • CVE-2019-3580HigJan 3, 2019
    Openrefine
    Openrefine
    risk 0.49cvss 7.5epss 0.02

    OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.

  • CVE-2018-20131HigJan 3, 2019
    Code42
    Code42 for Enterprise
    risk 0.51cvss 7.8epss 0.00

    The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on the /usr/local/crashplan/log directory. This allows a user to manipulate symbolic links to escalate privileges, or show the contents of sensitive files that a…

  • CVE-2018-18264HigJan 3, 2019
    Cri O
    Dashboard
    risk 0.06cvss 7.5epss 0.70

    Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.

  • CVE-2018-20211HigJan 2, 2019
    Exiftool
    Exiftool
    risk 0.51cvss 7.8epss 0.01

    ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010…

  • CVE-2018-20166HigJan 2, 2019
    Rukovoditel
    Rukovoditel
    risk 0.61cvss 8.8epss 0.07

    A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in…