VYPR

CVEs

8,985 total · page 172 of 180

AllCriticalHighKEV
  • CVE-2016-3657CriApr 12, 2016
    Paloaltonetworks
    Pan OS
    risk 0.64cvss 9.8epss 0.03

    Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to cause a denial of service (device crash) or possibly execute arbitrary code via an SSL VPN request.

  • CVE-2016-3655CriApr 12, 2016
    Paloaltonetworks
    Pan OS
    risk 0.64cvss 9.8epss 0.01

    The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.

  • CVE-2016-2170CriApr 12, 2016
    Apache
    Ofbiz
    risk 0.65cvss 9.8epss 0.14

    Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-0733CriApr 12, 2016
    Apache
    Ranger
    risk 0.64cvss 9.8epss 0.02

    The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.

  • CVE-2016-3987CriApr 12, 2016
    Trend Micro
    Password Manager
    risk 0.70cvss 9.8epss 0.43

    The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.

  • CVE-2015-8841CriApr 12, 2016
    Eset
    Nod32
    risk 0.65cvss 9.8epss 0.16

    Heap-based buffer overflow in the Archive support module in ESET NOD32 before update 11861 allows remote attackers to execute arbitrary code via a large number of languages in an EPOC installation file of type SIS_FILE_MULTILANG.

  • CVE-2015-8833CriApr 12, 2016
    Cypherpunks
    Pidgin Otr
    risk 0.65cvss 9.8epss 0.16

    Use-after-free vulnerability in the create_smp_dialog function in gtk-dialog.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 4.0.2 for Pidgin allows remote attackers to execute arbitrary code via vectors related to the "Authenticate buddy" menu item.

  • CVE-2015-8710CriApr 11, 2016
    Xmlsoft
    Libxml2
    risk 0.64cvss 9.8epss 0.05

    The htmlParseComment function in HTMLparser.c in libxml2 allows attackers to obtain sensitive information, cause a denial of service (out-of-bounds heap memory access and application crash), or possibly have unspecified other impact via an unclosed HTML comment.

  • CVE-2016-3065CriApr 11, 2016
    PostgreSQL
    PostgreSQL
    risk 0.59cvss 9.1epss 0.01

    The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service…

  • CVE-2016-2385CriApr 11, 2016
    Kamailio
    Kamailio
    risk 0.61cvss 9.8epss 0.21

    Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large…

  • CVE-2016-3154CriApr 8, 2016
    Spip
    Spip
    risk 0.64cvss 9.8epss 0.01

    The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

  • CVE-2016-3153CriApr 8, 2016
    Spip
    Spip
    risk 0.64cvss 9.8epss 0.01

    SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrer_entites function.

  • CVE-2016-2324CriApr 8, 2016
    Git
    Git
    risk 0.58cvss 9.8epss 0.22

    Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.

  • CVE-2016-2315CriApr 8, 2016
    Git
    Git
    risk 0.58cvss 9.8epss 0.18

    revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.

  • CVE-2016-2851CriApr 7, 2016
    Cypherpunks
    Libotr
    risk 0.68cvss 9.8epss 0.21

    Integer overflow in proto.c in libotr before 4.1.1 on 64-bit platforms allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a series of large OTR messages, which triggers a heap-based buffer overflow.

  • CVE-2016-2563CriApr 7, 2016
    Putty
    Putty
    risk 0.69cvss 9.8epss 0.27

    Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download…

  • CVE-2016-0791CriApr 7, 2016
    Jenkins Project
    Jenkins
    risk 0.64cvss 9.8epss 0.00

    Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.

  • CVE-2016-0788CriApr 7, 2016
    Jenkins Project
    Jenkins
    risk 0.60cvss 9.8epss 0.37

    The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.

  • CVE-2016-0729CriApr 7, 2016
    Apache
    Xerces C\+\+
    risk 0.66cvss 9.8epss 0.23

    Multiple buffer overflows in (1) internal/XMLReader.cpp, (2) util/XMLURL.cpp, and (3) util/XMLUri.cpp in the XML Parser library in Apache Xerces-C before 3.1.3 allow remote attackers to cause a denial of service (segmentation fault or memory corruption) or possibly execute…

  • CVE-2016-3974CriApr 7, 2016
    SAP
    Netweaver Application Server Java
    risk 0.63cvss 9.1epss 0.13

    XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial of service, conduct SMB Relay attacks, or access arbitrary files via a crafted XML request to…

  • CVE-2016-1019CriKEVApr 7, 2016
    Adobe Inc.
    Air SDK
    risk 0.86cvss 9.8epss 0.57

    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

  • CVE-2016-1313CriApr 6, 2016
    Cisco Systems, Inc.
    Ucs Invicta C3124sa Appliance
    risk 0.64cvss 9.8epss 0.01

    Cisco UCS Invicta C3124SA Appliance 4.3.1 through 5.0.1, UCS Invicta Scaling System and Appliance, and Whiptail Racerunner improperly store a default SSH private key, which allows remote attackers to obtain root access via unspecified vectors, aka Bug ID CSCun71294.

  • CVE-2016-1291CriApr 6, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.64cvss 9.8epss 0.02

    Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allow remote attackers to execute arbitrary code via crafted deserialized data in an HTTP POST request, aka Bug ID CSCuw03192.

  • CVE-2015-7921CriApr 6, 2016
    Pro Face
    GP-Pro EX EX-ED
    risk 0.59cvss 9.1epss 0.00

    The FTP server in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 has hardcoded credentials, which makes it easier for remote attackers to bypass authentication by leveraging knowledge of these…

  • CVE-2016-2000CriApr 5, 2016
    Microfocus
    Asset Manager Cloudsystem Chargeback
    risk 0.64cvss 9.8epss 0.01

    HPE Asset Manager 9.40, 9.41, and 9.50 and Asset Manager CloudSystem Chargeback 9.40 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

  • CVE-2015-8522CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.09

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8521.

  • CVE-2015-8521CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.09

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8520, and CVE-2015-8522.

  • CVE-2015-8520CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.09

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.

  • CVE-2015-8519CriApr 5, 2016
    IBM
    Tivoli Storage Manager Fastback
    risk 0.64cvss 9.8epss 0.09

    Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8520, CVE-2015-8521, and CVE-2015-8522.

  • CVE-2016-2343CriApr 1, 2016
    Patterson Dental
    Eaglesoft
    risk 0.64cvss 9.8epss 0.01

    Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient information via SQL statements.

  • CVE-2016-3141CriMar 31, 2016
    PHP
    PHP
    risk 0.69cvss 9.8epss 0.72

    Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize…

  • CVE-2016-1761CriMar 24, 2016
    Apple Inc.
    watchOS
    risk 0.65cvss 9.8epss 0.14

    libxml2 in Apple iOS before 9.3, OS X before 10.11.4, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

  • CVE-2016-1741CriMar 24, 2016
    Apple Inc.
    OS X
    risk 0.68cvss 9.8epss 0.17

    The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2015-6854CriMar 24, 2016
    Broadcom Corporation
    Single Sign On
    risk 0.59cvss 9.1epss 0.01

    The non-Domino web agents in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.

  • CVE-2015-6853CriMar 24, 2016
    Broadcom Corporation
    Single Sign On
    risk 0.59cvss 9.1epss 0.01

    The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service (daemon crash) or obtain sensitive…

  • CVE-2016-1998CriMar 22, 2016
    Microfocus
    Service Manager
    risk 0.64cvss 9.8epss 0.02

    HPE Service Manager (SM) 9.3x before 9.35 P4 and 9.4x before 9.41.P2 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-1997CriMar 22, 2016
    Microfocus
    Operations Orchestration
    risk 0.64cvss 9.8epss 0.03

    HPE Operations Orchestration 10.x before 10.51 and Operations Orchestration content before 1.7.0 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

  • CVE-2016-2245CriMar 19, 2016
    Microfocus
    Support Assistant
    risk 0.65cvss 9.8epss 0.14

    HP Support Assistant before 8.1.52.1 allows remote attackers to bypass authentication via unspecified vectors.

  • CVE-2016-1995CriMar 18, 2016
    Microfocus
    System Management Homepage
    risk 0.65cvss 9.8epss 0.16

    HPE System Management Homepage before 7.5.4 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-3191CriMar 17, 2016
    Pcre
    Pcre
    risk 0.64cvss 9.8epss 0.08

    The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial…

  • CVE-2016-2345CriMar 17, 2016
    SolarWinds
    Dameware Mini Remote Control
    risk 0.71cvss 9.8epss 0.53

    Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2016-1989CriMar 15, 2016
    Microfocus
    Network Automation
    risk 0.65cvss 9.8epss 0.14

    HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-1988.

  • CVE-2016-1988CriMar 15, 2016
    Microfocus
    Network Automation
    risk 0.65cvss 9.8epss 0.14

    HPE Network Automation 9.22 through 9.22.02 and 10.x before 10.00.02 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2016-1989.

  • CVE-2016-1962CriMar 13, 2016
    Mozilla Corporation
    Firefox
    risk 0.64cvss 9.8epss 0.02

    Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.

  • CVE-2016-1621CriMar 12, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.09

    libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files,…

  • CVE-2016-0816CriMar 12, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.02

    mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to decoder/ih264d_parse_islice.c and decoder/ih264d_parse_pslice.c, aka internal bug 25928803.

  • CVE-2016-0815CriMar 12, 2016
    Google
    Android
    risk 0.64cvss 9.8epss 0.02

    The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via…

  • CVE-2015-7411CriMar 12, 2016
    IBM
    Tivoli Monitoring
    risk 0.64cvss 9.9epss 0.01

    The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified vectors.

  • CVE-2016-1327CriMar 9, 2016
    Cisco Systems, Inc.
    DPC2203
    risk 0.64cvss 9.8epss 0.04

    Buffer overflow in the web server on Cisco DPC2203 and EPC2203 devices with firmware r1_customer_image allows remote attackers to execute arbitrary code via a crafted HTTP request, aka Bug ID CSCuv05935.

  • CVE-2016-1009CriMar 9, 2016
    Adobe Inc.
    Acrobat
    risk 0.64cvss 9.8epss 0.04

    Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat and Acrobat Reader DC Continuous before 15.010.20060 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via…