VYPR

CVEs

102,253 total · page 1720 of 2,046

AllCriticalHighKEV
  • CVE-2018-13801HigOct 10, 2018
    Siemens Foundation
    ROX II
    risk 0.57cvss 8.8epss 0.03

    A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credentials for the target device could perform a privilege escalation and gain root privileges. Successful exploitation requires…

  • CVE-2018-13800HigOct 10, 2018
    Siemens Foundation
    SIMATIC S7-300 CPU family
    risk 0.48cvss 7.3epss 0.01

    A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user…

  • CVE-2018-18211HigOct 10, 2018
    Pbootcmspro
    Pbootcms
    risk 0.53cvss 8.1epss 0.01

    PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI.

  • CVE-2018-12131HigOct 10, 2018
    Intel
    NVMe
    risk 0.51cvss 7.8epss 0.00

    Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to potentially escalate privilege via local access.

  • CVE-2018-8531HigOct 10, 2018
    Microsoft
    Azure IoT Hub Device Client SDK
    risk 0.58cvss 8.8epss 0.15

    A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Device Client SDK Memory Corruption Vulnerability." This affects Hub Device Client SDK, Azure IoT Edge.

  • CVE-2018-8513HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8511HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8510HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8509HigOct 10, 2018
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.13

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8473.

  • CVE-2018-8505HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503,…

  • CVE-2018-8504HigOct 10, 2018
    Microsoft
    Word
    risk 0.59cvss 8.8epss 0.19

    A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Microsoft SharePoint Server, Office 365 ProPlus, Microsoft Office,…

  • CVE-2018-8503HigOct 10, 2018
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8505,…

  • CVE-2018-8502HigOct 10, 2018
    Microsoft
    Office
    risk 0.59cvss 8.8epss 0.20

    A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel.

  • CVE-2018-8501HigOct 10, 2018
    Microsoft
    Office
    risk 0.59cvss 8.8epss 0.19

    A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Office 365 ProPlus, PowerPoint Viewer, Microsoft…

  • CVE-2018-8497HigOct 10, 2018
    Microsoft
    Windows Kernel
    risk 0.51cvss 7.8epss 0.01

    An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.

  • CVE-2018-8495HigOct 10, 2018
    Microsoft
    Windows Shell
    risk 0.53cvss 7.5epss 0.51

    A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

  • CVE-2018-8494HigOct 10, 2018
    Microsoft
    XML Core Services
    risk 0.59cvss 8.8epss 0.22

    A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019,…

  • CVE-2018-8493HigOct 10, 2018
    Microsoft
    Windows TCP/IP Stack
    risk 0.49cvss 7.5epss 0.08

    An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10,…

  • CVE-2018-8491HigOct 10, 2018
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.13

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-8460.

  • CVE-2018-8490HigOct 10, 2018
    Microsoft
    Windows Hyper-V
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10,…

  • CVE-2018-8489HigOct 10, 2018
    Microsoft
    Hyper-V
    risk 0.55cvss 8.4epss 0.04

    A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2,…

  • CVE-2018-8484HigOct 10, 2018
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.01

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012,…

  • CVE-2018-8473HigOct 10, 2018
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.15

    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8509.

  • CVE-2018-8460HigOct 10, 2018
    Microsoft
    Internet Explorer
    risk 0.50cvss 7.5epss 0.19

    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11. This CVE ID is unique from CVE-2018-8491.

  • CVE-2018-8453HigKEVOct 10, 2018
    Microsoft
    Windows
    risk 0.77cvss 7.8epss 0.70

    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-8432HigOct 10, 2018
    Microsoft
    Graphics Component
    risk 0.52cvss 7.8epss 0.20

    A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Microsoft Office Word Viewer, Office 365…

  • CVE-2018-8423HigOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.53cvss 7.8epss 0.33

    A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server…

  • CVE-2018-8413HigOct 10, 2018
    Microsoft
    Windows Server 2008
    risk 0.57cvss 7.8epss 0.46

    A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,…

  • CVE-2018-8411HigOct 10, 2018
    Microsoft
    Windows 7
    risk 0.54cvss 7.8epss 0.03

    An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows…

  • CVE-2018-8333HigOct 10, 2018
    Microsoft
    Filter Manager
    risk 0.46cvss 7.0epss 0.02

    An Elevation of Privilege vulnerability exists in Filter Manager when it improperly handles objects in memory, aka "Microsoft Filter Manager Elevation Of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…

  • CVE-2018-8329HigOct 10, 2018
    Microsoft
    Windows Subsystem for Linux
    risk 0.51cvss 7.8epss 0.01

    An Elevation of Privilege vulnerability exists in Windows Subsystem for Linux when it fails to properly handle objects in memory, aka "Linux On Windows Elevation Of Privilege Vulnerability." This affects Windows 10, Windows 10 Servers.

  • CVE-2018-8292HigOct 10, 2018
    Microsoft
    Powershell
    risk 0.50cvss 7.5epss 0.15

    An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

  • CVE-2018-8265HigOct 10, 2018
    Microsoft
    Exchange Server
    risk 0.52cvss 7.8epss 0.20

    A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

  • CVE-2018-18206HigOct 10, 2018
    risk 0.42cvss 7.5epss 0.01

    In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, leading to a crash.

  • CVE-2018-18201HigOct 9, 2018
    Qibosoft
    qibosoft
    risk 0.57cvss 8.8epss 0.00

    qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.

  • CVE-2018-7632HigOct 9, 2018
    risk 0.49cvss 7.5epss 0.01

    Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to cause a denial of service attack remotely via a specially crafted GET request with a leading "/" in the URL.

  • CVE-2018-17962HigOct 9, 2018
    QEMU
    Qemu
    risk 0.49cvss 7.5epss 0.04

    Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

  • CVE-2018-17958HigOct 9, 2018
    QEMU
    Qemu
    risk 0.49cvss 7.5epss 0.06

    Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.

  • CVE-2018-11796HigOct 9, 2018
    Apache
    Apache
    risk 0.49cvss 7.5epss 0.07

    In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity…

  • CVE-2018-17858HigOct 9, 2018
    Joomla
    Joomla!
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the backend.

  • CVE-2018-17856HigOct 9, 2018
    risk 0.47cvss 7.2epss 0.03

    An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.

  • CVE-2018-17855HigOct 9, 2018
    Joomla
    Joomla!
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can approve admin verifications in the registration process, he can activate himself.

  • CVE-2018-10614HigOct 9, 2018
    risk 0.57cvss 8.8epss 0.01

    An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XML files.

  • CVE-2018-10610HigOct 9, 2018
    LeviStudioU
    LeviStudioU
    risk 0.57cvss 8.8epss 0.01

    An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project files.

  • CVE-2018-18196HigOct 9, 2018
    Libgig0
    Libgig
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in RIFF::List::GetListTypeString in RIFF.cpp.

  • CVE-2018-18194HigOct 9, 2018
    Libgig0
    Libgig
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.

  • CVE-2018-18193HigOct 9, 2018
    Libgig0
    Libgig
    risk 0.57cvss 8.8epss 0.01

    An issue was discovered in libgig 4.1.0. There is operator new[] failure (due to a big pWavePoolTable heap request) in DLS::File::File in DLS.cpp.

  • CVE-2018-18191HigOct 9, 2018
    Finecms Project
    Finecms
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password.

  • CVE-2018-18086HigOct 9, 2018
    Empire CMS
    Empire CMS
    risk 0.57cvss 8.8epss 0.01

    EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable by logged-in users.

  • CVE-2018-18074HigOct 9, 2018
    risk 0.42cvss 7.5epss 0.07

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.