VYPR

CVEs

102,253 total · page 1726 of 2,046

AllCriticalHighKEV
  • CVE-2018-17336HigSep 22, 2018
    udisks
    udisks
    risk 0.51cvss 7.8epss 0.01

    UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as…

  • CVE-2018-17332HigSep 22, 2018
    agambier
    libsvg2
    risk 0.49cvss 7.5epss 0.01

    An issue was discovered in libsvg2 through 2012-10-19. The svgGetNextPathField function in svg_string.c returns its input pointer in certain circumstances, which might result in a memory leak caused by wasteful malloc calls.

  • CVE-2018-14891HigSep 21, 2018
    Vectra Networks
    Cognito Brain and Sensor
    risk 0.51cvss 7.8epss 0.00

    Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability.

  • CVE-2018-14889HigSep 21, 2018
    Vectra Networks
    Cognito Brain and Sensor
    risk 0.51cvss 7.8epss 0.01

    CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability.

  • CVE-2018-12169HigSep 21, 2018
    Intel
    Platform sample code firmware
    risk 0.49cvss 7.6epss 0.01

    Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to…

  • CVE-2018-17050HigSep 21, 2018
    Polyai AI
    Polyai
    risk 0.49cvss 7.5epss 0.01

    The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.

  • CVE-2018-15613HigSep 21, 2018
    Avaya
    Aura Orchestration Designer
    risk 0.54cvss 8.3epss 0.01

    A cross-site scripting (XSS) vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could result in malicious content being returned to the user. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.

  • CVE-2018-15612HigSep 21, 2018
    Avaya
    Aura Orchestration Designer
    risk 0.54cvss 8.3epss 0.00

    A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1.

  • CVE-2018-14732HigSep 21, 2018
    risk 0.42cvss 7.5epss 0.03

    An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message…

  • CVE-2018-14731HigSep 21, 2018
    risk 0.42cvss 7.5epss 0.02

    An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the…

  • CVE-2018-14730HigSep 21, 2018
    risk 0.49cvss 7.5epss 0.02

    An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a…

  • CVE-2018-12511HigSep 21, 2018
    Substratum
    Substratum
    risk 0.49cvss 7.5epss 0.01

    In the mintToken function of a smart contract implementation for Substratum (SUB), an Ethereum ERC20 token, the administrator can control mintedAmount, leverage an integer overflow, and modify a user account's balance arbitrarily.

  • CVE-2018-16793HigSep 21, 2018
    Microsoft
    Exchange Server
    risk 0.57cvss 8.6epss 0.11

    Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

  • CVE-2018-3915HigSep 21, 2018
    Samsung Mobile
    SmartThings Hub STH-ETH-250
    risk 0.53cvss 8.2epss 0.00

    An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 64…

  • CVE-2018-3914HigSep 21, 2018
    Samsung Mobile
    SmartThings Hub STH-ETH-250
    risk 0.51cvss 7.8epss 0.00

    An exploitable stack-based buffer overflow vulnerability exists in the retrieval of database fields in the video-core HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy call overflows the destination buffer, which has a size of 2000…

  • CVE-2018-3906HigSep 21, 2018
    Samsung Mobile
    SmartThings
    risk 0.53cvss 8.2epss 0.00

    An exploitable stack-based buffer overflow vulnerability exists in the retrieval of a database field in video-core's HTTP server of Samsung SmartThings Hub. The video-core process insecurely extracts the shard.videoHostURL field from its SQLite database, leading to a buffer…

  • CVE-2018-3894HigSep 21, 2018
    Samsung Mobile
    SmartThings
    risk 0.57cvss 8.8epss 0.02

    An exploitable buffer overflow vulnerability exists in the /cameras/XXXX/clips handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy call overflows the destination buffer, which has a size of 52 bytes. An attacker can…

  • CVE-2018-16784HigSep 21, 2018
    Dedecms
    Dedecms
    risk 0.47cvss 7.2epss 0.02

    DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.

  • CVE-2018-3876HigSep 21, 2018
    Samsung Mobile
    SmartThings
    risk 0.57cvss 8.8epss 0.02

    An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The strncpy overflows the destination buffer, which has a size of 64 bytes. An attacker can send an…

  • CVE-2018-1711HigSep 21, 2018
    IBM
    Db2
    risk 0.55cvss 8.4epss 0.00

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 146369.

  • CVE-2018-1710HigSep 21, 2018
    IBM
    Db2
    risk 0.55cvss 8.4epss 0.01

    IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364.

  • CVE-2018-14645HigSep 21, 2018
    risk 0.49cvss 7.5epss 0.03

    A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a remote crash and denial of service.

  • CVE-2018-17297HigSep 21, 2018
    risk 0.49cvss 7.5epss 0.03

    The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

  • CVE-2018-17293HigSep 21, 2018
    Wavm
    Wavm
    risk 0.00cvss 8.8epss 0.02

    An issue was discovered in WAVM before 2018-09-16. The run function in Programs/wavm/wavm.cpp does not check whether there is Emscripten memory to store the command-line arguments passed by the input WebAssembly file's main function, which allows attackers to cause a denial of…

  • CVE-2018-17283HigSep 21, 2018
    Zoho
    ManageEngine OpUtils
    risk 0.54cvss 7.5epss 0.66

    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or…

  • CVE-2018-16752HigSep 20, 2018
    LINK-NET
    LW-N605R
    risk 0.61cvss 8.8epss 0.43

    LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.

  • CVE-2018-16282HigSep 20, 2018
    Moxa
    EDR-810
    risk 0.58cvss 8.8epss 0.05

    A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.

  • CVE-2018-15832HigSep 20, 2018
    Ubisoft
    Uplay Desktop Client
    risk 0.57cvss 8.8epss 0.04

    upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the…

  • CVE-2018-6505HigSep 20, 2018
    Microfocus
    Arcsight Management Center
    risk 0.49cvss 7.5epss 0.03

    A potential Unauthenticated File Download vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Unauthenticated File Downloads.

  • CVE-2018-6504HigSep 20, 2018
    Microfocus
    Arcsight Management Center
    risk 0.57cvss 8.8epss 0.01

    A potential Cross-Site Request Forgery (CSRF) vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be exploited to allow for Cross-Site Request Forgery (CSRF).

  • CVE-2018-14827HigSep 20, 2018
    Rockwellautomation
    RSLinx Classic
    risk 0.49cvss 7.5epss 0.04

    Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to…

  • CVE-2018-14821HigSep 20, 2018
    Rockwellautomation
    RSLinx Classic
    risk 0.49cvss 7.5epss 0.04

    Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually…

  • CVE-2018-14796HigSep 20, 2018
    risk 0.49cvss 7.5epss 0.01

    Tec4Data SmartCooler, all versions prior to firmware 180806, the device responds to a remote unauthenticated reboot command that may be used to perform a denial of service attack.

  • CVE-2018-6500HigSep 20, 2018
    Microfocus
    Arcsight Management Center
    risk 0.49cvss 7.5epss 0.04

    A potential Directory Traversal Security vulnerability has been identified in ArcSight Management Center (ArcMC) in all versions prior to 2.81. This vulnerability could be remotely exploited to allow Directory Traversal.

  • CVE-2018-3865HigSep 20, 2018
    Samsung Mobile
    SmartThings
    risk 0.57cvss 8.8epss 0.02

    An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an…

  • CVE-2018-3864HigSep 20, 2018
    Samsung Mobile
    SmartThings Hub STH-ETH-250
    risk 0.57cvss 8.8epss 0.02

    An exploitable buffer overflow vulnerability exists in the Samsung WifiScan handler of video-core's HTTP server of Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The strcpy overflows the destination buffer, which has a size of 40 bytes. An attacker can send an…

  • CVE-2018-5837HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.49cvss 7.5epss 0.01

    In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660,…

  • CVE-2018-11982HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.57cvss 8.8epss 0.00

    In Snapdragon (Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 835,…

  • CVE-2018-11292HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820A, SDM429, SDM439, SDM630, SDM632,…

  • CVE-2018-11291HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.49cvss 7.5epss 0.01

    In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810,…

  • CVE-2018-11290HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.49cvss 7.5epss 0.01

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820A, SD 845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20,…

  • CVE-2018-11285HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.01

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, SDM429, SDM439, SDM630, SDM632,…

  • CVE-2018-11277HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, the com.qualcomm.embms is a vendor package deployed in the system image…

  • CVE-2018-11269HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660,…

  • CVE-2018-11268HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660,…

  • CVE-2018-11267HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD…

  • CVE-2017-18280HigSep 20, 2018
    Qualcomm
    Snapdragon
    risk 0.51cvss 7.8epss 0.00

    In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has…

  • CVE-2018-17231HigSep 19, 2018
    Telegramdesktop
    Desktop
    risk 0.49cvss 7.5epss 0.02

    Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because…

  • CVE-2018-3831HigSep 19, 2018
    Elastic
    Elasticsearch
    risk 0.57cvss 8.8epss 0.02

    Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens,…

  • CVE-2018-3828HigSep 19, 2018
    Elastic
    Cloud Enterprise
    risk 0.49cvss 7.5epss 0.01

    Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An…