VYPR

CVEs

97,194 total · page 1920 of 1,944

AllCriticalHighKEV
  • CVE-2016-1024HigApr 9, 2016
    GNU
    Flash Player
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1023HigApr 9, 2016
    GNU
    Flash Player
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1022HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1021HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1020HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1018HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.08

    Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data.

  • CVE-2016-1017HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.06

    Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different…

  • CVE-2016-1016HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.06

    Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via a flash.geom.Matrix callback, a…

  • CVE-2016-1015HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.07

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different…

  • CVE-2016-1014HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.48cvss 7.3epss 0.01

    Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.

  • CVE-2016-1013HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.62cvss 8.8epss 0.23

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011,…

  • CVE-2016-1012HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.58cvss 8.8epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…

  • CVE-2016-1011HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.62cvss 8.8epss 0.26

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1013,…

  • CVE-2016-1006HigApr 9, 2016
    Adobe Inc.
    Air SDK
    risk 0.53cvss 8.1epss 0.04

    Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to bypass the ASLR protection mechanism via JIT data.

  • CVE-2016-3983HigApr 8, 2016
    McAfee
    Advanced Threat Defense
    risk 0.49cvss 7.5epss 0.01

    McAfee Advanced Threat Defense (ATD) before 3.4.8.178 might allow remote attackers to bypass malware detection by leveraging information about the parent process.

  • CVE-2016-2512HigApr 8, 2016
    Djangoproject
    Django
    risk 0.41cvss 7.4epss 0.04

    The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as…

  • CVE-2016-2381HigApr 8, 2016
    Perl Foundation
    Perl
    risk 0.49cvss 7.5epss 0.09

    Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

  • CVE-2015-5229HigApr 8, 2016
    Red Hat
    glibc
    risk 0.49cvss 7.5epss 0.02

    The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.

  • CVE-2016-3980HigApr 8, 2016
    SAP
    Java As
    risk 0.49cvss 7.5epss 0.07

    The Java Startup Framework (aka jstart) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (process crash) via a crafted HTTP request, aka SAP Security Note 2259547.

  • CVE-2016-3979HigApr 8, 2016
    SAP
    Java As
    risk 0.49cvss 7.5epss 0.06

    Internet Communication Manager (aka ICMAN or ICM) in SAP JAVA AS 7.2 through 7.4 allows remote attackers to cause a denial of service (heap memory corruption and process crash) via a crafted HTTP request, related to the IctParseCookies function, aka SAP Security Note 2256185.

  • CVE-2016-3188HigApr 8, 2016
    Prepopulate Project
    Prepopulate
    risk 0.48cvss 7.3epss 0.02

    The _prepopulate_request_walk function in the Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the (1) actions, (2) container, (3) token, (4) password, (5) password_confirm, (6) text_format, or (7) markup field type, and consequently have…

  • CVE-2016-3187HigApr 8, 2016
    Drupal
    Prepopulate
    risk 0.48cvss 7.3epss 0.02

    The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter.

  • CVE-2015-6541HigApr 8, 2016
    Zimbra
    Collaboration Server
    risk 0.60cvss 8.8epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Mail interface in Zimbra Collaboration Server (ZCS) before 8.5 allow remote attackers to hijack the authentication of arbitrary users for requests that change account preferences via a SOAP request to…

  • CVE-2015-8840HigApr 8, 2016
    SAP
    Netweaver As Java
    risk 0.57cvss 8.8epss 0.01

    The XML Data Archiving Service (XML DAS) in SAP NetWeaver AS Java does not check authorization, which allows remote authenticated users to obtain sensitive information, gain privileges, or possibly have unspecified other impact via requests to (1) webcontent/cas/cas_enter.jsp,…

  • CVE-2016-3976HigKEVApr 7, 2016
    SAP
    Netweaver As Java
    risk 0.67cvss 7.5epss 0.47

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

  • CVE-2016-2098HigApr 7, 2016
    Rubyonrails
    Rails
    risk 0.57cvss 7.3epss 0.81

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

  • CVE-2016-1531HigApr 7, 2016
    Exim
    Exim
    risk 0.49cvss 7.0epss 0.06

    Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

  • CVE-2016-0792HigApr 7, 2016
    Jenkins Project
    Jenkins
    risk 0.60cvss 8.8epss 0.83

    Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.

  • CVE-2016-2216HigApr 7, 2016
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.07

    The HTTP header parsing code in Node.js 0.10.x before 0.10.42, 0.11.6 through 0.11.16, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allows remote attackers to bypass an HTTP response-splitting protection mechanism via UTF-8 encoded Unicode characters in the HTTP…

  • CVE-2016-2086HigApr 7, 2016
    Node.js
    Node.js
    risk 0.49cvss 7.5epss 0.06

    Node.js 0.10.x before 0.10.42, 0.12.x before 0.12.10, 4.x before 4.3.0, and 5.x before 5.6.0 allow remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

  • CVE-2016-2510HigApr 7, 2016
    BeanShell
    BeanShell
    risk 0.51cvss 8.1epss 0.70

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

  • CVE-2015-8681HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    The ovisp driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before…

  • CVE-2015-8680HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00…

  • CVE-2015-8319HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones…

  • CVE-2015-8318HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones…

  • CVE-2015-8307HigApr 7, 2016
    Huawei
    P8
    risk 0.51cvss 7.8epss 0.01

    The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00…

  • CVE-2016-1714HigApr 7, 2016
    QEMU
    Qemu
    risk 0.53cvss 8.1epss 0.06

    The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access…

  • CVE-2016-3948HigApr 7, 2016
    Squid Cache
    Squid
    risk 0.52cvss 7.5epss 0.35

    Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers.

  • CVE-2016-3947HigApr 7, 2016
    Squid Cache
    Squid
    risk 0.54cvss 8.2epss 0.15

    Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and 4.x before 4.0.8 allows remote servers to cause a denial of service (performance degradation or transition failures) or write sensitive information to log…

  • CVE-2016-0888HigApr 7, 2016
    EMC Corporation
    Documentum D2
    risk 0.57cvss 8.8epss 0.03

    EMC Documentum D2 before 4.6 lacks intended ACLs for configuration objects, which allows remote authenticated users to modify objects via unspecified vectors.

  • CVE-2016-2290HigApr 6, 2016
    Pro Face
    GP-Pro EX EX-ED
    risk 0.57cvss 8.8epss 0.02

    Heap-based buffer overflow in Pro-face GP-Pro EX EX-ED before 4.05.000, PFXEXEDV before 4.05.000, PFXEXEDLS before 4.05.000, and PFXEXGRPLS before 4.05.000 allows remote attackers to execute arbitrary code via unspecified vectors.

  • CVE-2016-2272HigApr 6, 2016
    Eaton
    Eg2 Web Control
    risk 0.49cvss 7.5epss 0.01

    Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie.

  • CVE-2016-1290HigApr 6, 2016
    Cisco Systems, Inc.
    Prime Infrastructure
    risk 0.53cvss 8.1epss 0.01

    The web API in Cisco Prime Infrastructure 1.2.0 through 2.2(2) and Cisco Evolved Programmable Network Manager (EPNM) 1.2 allows remote authenticated users to bypass intended RBAC restrictions and gain privileges via an HTTP request that is inconsistent with a pattern filter, aka…

  • CVE-2016-1174HigApr 6, 2016
    Hiniarata
    Casebook Plugin
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Menubook plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-1172HigApr 6, 2016
    Basercms
    Basercms
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Recruit plugin before 0.9.3 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-1170HigApr 6, 2016
    Basercms
    Casebook
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Casebook plugin before 0.9.4 for baserCMS allows remote attackers to hijack the authentication of administrators.

  • CVE-2016-0871HigApr 6, 2016
    Eaton
    Eg2 Web Control
    risk 0.49cvss 7.5epss 0.02

    Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request.

  • CVE-2015-6313HigApr 6, 2016
    Cisco Systems, Inc.
    Mobility Services Engine
    risk 0.49cvss 7.5epss 0.03

    Cisco TelePresence Server 4.1(2.29) through 4.2(4.17) on 7010; Mobility Services Engine (MSE) 8710; Multiparty Media 310, 320, and 820; and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted HTTP…

  • CVE-2015-6312HigApr 6, 2016
    Cisco Systems, Inc.
    Mobility Services Engine
    risk 0.49cvss 7.5epss 0.02

    Cisco TelePresence Server 3.1 on 7010, Mobility Services Engine (MSE) 8710, Multiparty Media 310 and 320, and Virtual Machine (VM) devices allows remote attackers to cause a denial of service (device reload) via malformed STUN packets, aka Bug ID CSCuv01348.

  • CVE-2016-3125HigApr 5, 2016
    Proftpd
    Proftpd
    risk 0.49cvss 7.5epss 0.07

    The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile directive, which might cause a weaker than intended Diffie-Hellman (DH) key to be used and consequently allow attackers to have unspecified impact via unknown…