VYPR

CVEs

100,075 total · page 1937 of 2,002

AllCriticalHighKEV
  • CVE-2016-7911HigNov 16, 2016
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.02

    Race condition in the get_task_ioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

  • CVE-2016-7910HigNov 16, 2016
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.03

    Use-after-free vulnerability in the disk_seqf_stop function in block/genhd.c in the Linux kernel before 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.

  • CVE-2015-8963HigNov 16, 2016
    Linux
    Kernel
    risk 0.39cvss 7.0epss 0.01

    Race condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.

  • CVE-2015-8962HigNov 16, 2016
    Linux
    Kernel
    risk 0.41cvss 7.3epss 0.02

    Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.

  • CVE-2015-8961HigNov 16, 2016
    Linux
    Kernel
    risk 0.44cvss 7.8epss 0.02

    The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.

  • CVE-2016-0909HigNov 15, 2016
    EMC Corporation
    Avamar Data Store
    risk 0.55cvss 8.4epss 0.00

    EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) versions 7.3 and older contain a vulnerability that may expose the Avamar servers to potentially be compromised by malicious users.

  • CVE-2016-8661HigNov 15, 2016
    Little Snitch
    Little Snitch
    risk 0.55cvss 8.4epss 0.00

    Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an escalation of privileges (EoP) and unauthorised ring0 access to the operating system. The buffer overflow is related to insufficient…

  • CVE-2016-8908HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2016-8907HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2016-8906HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2016-8905HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.

  • CVE-2016-8904HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2016-8903HigNov 14, 2016
    Dotcms
    Dotcms
    risk 0.57cvss 8.8epss 0.02

    SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

  • CVE-2016-9296HigNov 12, 2016
    7 Zip
    P7zip
    risk 0.49cvss 7.5epss 0.07

    A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z…

  • CVE-2016-9294HigNov 12, 2016
    Artifex
    Mujs
    risk 0.49cvss 7.5epss 0.03

    Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service (application crash)" attacks by using the "malformed labeled break/continue in JavaScript" approach, related to a "NULL pointer…

  • CVE-2016-9283HigNov 11, 2016
    Exponent
    Exponent CMS
    risk 0.49cvss 7.5epss 0.02

    SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue.

  • CVE-2016-9282HigNov 11, 2016
    Exponent
    Exponent CMS
    risk 0.49cvss 7.5epss 0.02

    SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.

  • CVE-2016-9277HigNov 11, 2016
    Samsung Mobile
    SystemUI
    risk 0.49cvss 7.5epss 0.01

    Integer overflow in SystemUI in KK(4.4) and L(5.0/5.1) on Samsung Note devices allows attackers to cause a denial of service (UI restart) via vectors involving APIs and an activity that computes an out-of-bounds array index, aka SVE-2016-6906.

  • CVE-2016-9274HigNov 11, 2016
    Git
    Git for Windows
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in Git 1.x for Windows allows local users to gain privileges via a Trojan horse git.exe file in the current working directory. NOTE: 2.x is unaffected.

  • CVE-2016-5195HigKEVNov 10, 2016
    Linux
    Kernel
    risk 0.60cvss 7.0epss 0.84

    Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

  • CVE-2016-9268HigNov 10, 2016
    Dotclear
    Dotclear
    risk 0.47cvss 7.2epss 0.05

    Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it…

  • CVE-2016-7490HigNov 10, 2016
    Teradata
    Studio Express
    risk 0.51cvss 7.8epss 0.01

    The installation script studioexpressinstall for Teradata Studio Express 15.12.00.00 creates files in /tmp insecurely. A malicious local user could create a symlink in /tmp and possibly clobber system files or perhaps elevate privileges.

  • CVE-2016-7488HigNov 10, 2016
    Teradata
    Virtual Machine
    risk 0.51cvss 7.8epss 0.01

    Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr. These could allow a local user to modify its contents and execute commands as root.

  • CVE-2016-7256HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.74cvss 8.8epss 0.65

    atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute…

  • CVE-2016-7255HigKEVNov 10, 2016
    Microsoft
    Windows
    risk 0.72cvss 7.8epss 0.81

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted…

  • CVE-2016-7254HigNov 10, 2016
    Microsoft
    SQL Server
    risk 0.58cvss 8.8epss 0.12

    Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

  • CVE-2016-7253HigNov 10, 2016
    Microsoft
    SQL Server
    risk 0.58cvss 8.8epss 0.12

    The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."

  • CVE-2016-7250HigNov 10, 2016
    Microsoft
    SQL Server
    risk 0.58cvss 8.8epss 0.12

    Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

  • CVE-2016-7249HigNov 10, 2016
    Microsoft
    SQL Server
    risk 0.58cvss 8.8epss 0.12

    Microsoft SQL Server 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

  • CVE-2016-7248HigNov 10, 2016
    Microsoft
    Windows
    risk 0.52cvss 7.8epss 0.22

    Microsoft Video Control in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted file, aka "Microsoft Video Control Remote Code Execution Vulnerability."

  • CVE-2016-7247HigNov 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.49cvss 7.5epss 0.06

    Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow physically proximate attackers to bypass the Secure Boot protection mechanism via a crafted boot policy, aka "Secure Boot Component…

  • CVE-2016-7246HigNov 10, 2016
    Microsoft
    Windows Server 2008
    risk 0.51cvss 7.8epss 0.03

    The kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-7245HigNov 10, 2016
    Microsoft
    Office
    risk 0.52cvss 7.8epss 0.20

    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, and Office 2016 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7243HigNov 10, 2016
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.15

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-7242HigNov 10, 2016
    Microsoft
    Edge
    risk 0.43cvss 7.5epss 0.16

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-7241HigNov 10, 2016
    Microsoft
    Internet Explorer
    risk 0.57cvss 7.5epss 0.71

    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."

  • CVE-2016-7240HigNov 10, 2016
    Microsoft
    Edge
    risk 0.50cvss 7.5epss 0.66

    The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than…

  • CVE-2016-7238HigNov 10, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.01

    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandle caching for NTLM password-change requests, which allows local users to…

  • CVE-2016-7236HigNov 10, 2016
    Microsoft
    Excel
    risk 0.52cvss 7.8epss 0.21

    Microsoft Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7235HigNov 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.20

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7234HigNov 10, 2016
    Microsoft
    Word
    risk 0.52cvss 7.8epss 0.22

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Excel for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server…

  • CVE-2016-7232HigNov 10, 2016
    Microsoft
    Word
    risk 0.53cvss 7.8epss 0.25

    Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7231HigNov 10, 2016
    Microsoft
    Excel
    risk 0.52cvss 7.8epss 0.19

    Microsoft Excel 2007 SP3, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7230HigNov 10, 2016
    Microsoft
    Powerpoint
    risk 0.52cvss 7.8epss 0.18

    Microsoft PowerPoint 2010 SP2, PowerPoint Viewer, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-7229HigNov 10, 2016
    Microsoft
    Excel
    risk 0.52cvss 7.8epss 0.19

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office…

  • CVE-2016-7228HigNov 10, 2016
    Microsoft
    Excel
    risk 0.53cvss 7.8epss 0.28

    Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory…

  • CVE-2016-7222HigNov 10, 2016
    Microsoft
    Windows Server 2016
    risk 0.51cvss 7.8epss 0.01

    Task Scheduler in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allows local users to gain privileges via a crafted UNC pathname in a task, aka "Task Scheduler Elevation of Privilege Vulnerability."

  • CVE-2016-7221HigNov 10, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    Input Method Editor (IME) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 mishandles DLL loading, which allows local users to…

  • CVE-2016-7217HigNov 10, 2016
    Microsoft
    Windows Server 2012
    risk 0.59cvss 8.8epss 0.22

    Media Foundation in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Media Foundation Memory Corruption Vulnerability."

  • CVE-2016-7215HigNov 10, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.03

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allow local users to gain privileges via a crafted…