VYPR

CVEs

113,579 total · page 2149 of 2,272

AllCriticalHighKEV
  • CVE-2017-9177HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.

  • CVE-2017-9176HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:370:25.

  • CVE-2017-9175HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:353:25.

  • CVE-2017-9174HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:21:23.

  • CVE-2017-9159HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_rawpbm function in input-pnm.c:391:15.

  • CVE-2017-9158HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_raw function in input-pnm.c:336:11.

  • CVE-2017-9157HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:306:14.

  • CVE-2017-9156HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:303:12.

  • CVE-2017-9155HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in input-pnm.c:243:3.

  • CVE-2017-9154HigMay 23, 2017
    Autotrace Project
    Autotrace
    risk 0.49cvss 7.5epss 0.02

    libautotrace.a in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:16:11.

  • CVE-2017-8915HigMay 23, 2017
    SAP
    Hana Xs
    risk 0.49cvss 7.5epss 0.03

    sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to cause a denial of service (assertion failure and service crash) by pushing a package with a filename containing a $ (dollar sign) or % (percent) character, aka SAP Security Note 2407694.

  • CVE-2017-8914HigMay 23, 2017
    SAP
    Hana Xs
    risk 0.54cvss 8.3epss 0.01

    sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694.

  • CVE-2017-8913HigMay 23, 2017
    SAP
    Netweaver Application Server Java
    risk 0.57cvss 8.8epss 0.01

    The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via a crafted XML document in a request to irj/servlet/prt/portal/prtroot/com.sap.visualcomposer.BIKit.default, aka SAP Security…

  • CVE-2017-8309HigMay 23, 2017
    QEMU
    Qemu
    risk 0.49cvss 7.5epss 0.05

    Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.

  • CVE-2016-9842HigMay 23, 2017
    Zlib
    Zlib
    risk 0.58cvss 8.8epss 0.05

    The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers.

  • CVE-2016-9840HigMay 23, 2017
    Zlib
    Zlib
    risk 0.58cvss 8.8epss 0.05

    inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic.

  • CVE-2016-5735HigMay 23, 2017
    pngquant
    pngquant
    risk 0.51cvss 7.8epss 0.02

    Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in pngquant 2.7.0 allows remote attackers to have unspecified impact via a crafted PNG file, which triggers a buffer overflow.

  • CVE-2016-5177HigMay 23, 2017
    Google
    Chrome
    risk 0.57cvss 8.8epss 0.01

    Use-after-free vulnerability in V8 in Google Chrome before 53.0.2785.143 allows remote attackers to cause a denial of service (crash) or possibly have unspecified other impact via unknown vectors.

  • CVE-2016-1876HigMay 23, 2017
    Lenovo
    Solution Center
    risk 0.51cvss 7.8epss 0.00

    The backend service process in Lenovo Solution Center (aka LSC) before 3.3.0002 allows local users to gain SYSTEM privileges via unspecified vectors.

  • CVE-2016-10073HigMay 23, 2017
    Vanilla Forums
    Vanilla Forums
    risk 0.58cvss 7.5epss 0.84

    The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.

  • CVE-2015-8089HigMay 23, 2017
    Huawei
    P7
    risk 0.51cvss 7.8epss 0.00

    The GPU driver in Huawei P7 phones with software P7-L00 before P7-L00C17B851, P7-L05 before P7-L05C00B851, and P7-L09 before P7-L09C92B851 allows local users to read or write to arbitrary kernel memory locations and consequently cause a denial of service (system crash) or gain…

  • CVE-2015-6817HigMay 23, 2017
    Pgbouncer
    Pgbouncer
    risk 0.46cvss 8.1epss 0.02

    PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.

  • CVE-2015-6586HigMay 23, 2017
    Huawei
    WLAN AC6005
    risk 0.49cvss 7.5epss 0.01

    The mDNS module in Huawei WLAN AC6005, AC6605, and ACU2 devices with software before V200R006C00SPC100 allows remote attackers to obtain sensitive information by leveraging failure to restrict processing of mDNS unicast queries to the link local network.

  • CVE-2015-5682HigMay 23, 2017
    WordPress
    Powerplay Gallery
    risk 0.49cvss 7.5epss 0.02

    upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.

  • CVE-2015-5469HigMay 23, 2017
    WordPress
    Mdc Youtube Downloader
    risk 0.43cvss 7.5epss 0.10

    Absolute path traversal vulnerability in the MDC YouTube Downloader plugin 2.1.0 for WordPress allows remote attackers to read arbitrary files via a full pathname in the file parameter to includes/download.php.

  • CVE-2015-5468HigMay 23, 2017
    WordPress
    Wp Ecommerce Shop Styling
    risk 0.47cvss 7.5epss 0.24

    Directory traversal vulnerability in the WP e-Commerce Shop Styling plugin before 2.6 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter to includes/download.php.

  • CVE-2015-5401HigMay 23, 2017
    Teradata
    Gateway
    risk 0.49cvss 7.5epss 0.02

    Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.

  • CVE-2015-5383HigMay 23, 2017
    Roundcube
    Webmail
    risk 0.42cvss 7.5epss 0.04

    Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

  • CVE-2015-4704HigMay 23, 2017
    WordPress
    Zip Attachments
    risk 0.49cvss 7.5epss 0.05

    Directory traversal vulnerability in the Download Zip Attachments plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the File parameter to download.php.

  • CVE-2015-4054HigMay 23, 2017
    Pgbouncer
    Pgbouncer
    risk 0.42cvss 7.5epss 0.04

    PgBouncer before 1.5.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by sending a password packet before a startup packet.

  • CVE-2015-4046HigMay 23, 2017
    Alienvault
    Ossim
    risk 0.47cvss 7.2epss 0.03

    The asset discovery scanner in AlienVault OSSIM before 5.0.1 allows remote authenticated users to execute arbitrary commands via the assets array parameter to netscan/do_scan.php.

  • CVE-2015-1529HigMay 23, 2017
    Google
    Android
    risk 0.49cvss 7.5epss 0.01

    Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.

  • CVE-2017-1289HigMay 22, 2017
    IBM
    SDK
    risk 0.54cvss 8.2epss 0.04

    IBM SDK, Java Technology Edition is vulnerable XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources. IBM X-Force ID: 125150.

  • CVE-2016-6112HigMay 22, 2017
    IBM
    Marketing Platform
    risk 0.57cvss 8.8epss 0.01

    IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282.

  • CVE-2017-9149HigMay 22, 2017
    Metadata Anonymisation Toolkit Project
    Metadata Anonymisation Toolkit
    risk 0.49cvss 7.5epss 0.02

    Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to obtain sensitive information by reading a file for which cleaning had been…

  • CVE-2017-6891HigMay 22, 2017
    GNU
    Libtasn1
    risk 0.58cvss 8.8epss 0.06

    Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

  • CVE-2017-9146HigMay 22, 2017
    Ytnef Project
    Ytnef
    risk 0.57cvss 8.8epss 0.02

    The TNEFFillMapi function in lib/ytnef.c in libytnef in ytnef through 1.9.2 does not ensure a nonzero count value before a certain memory allocation, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have…

  • CVE-2017-5657HigMay 22, 2017
    Apache
    Archiva
    risk 0.52cvss 8.0epss 0.01

    Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same…

  • CVE-2017-2175HigMay 22, 2017
    Empirical Project Monitor
    Empirical Project Monitor - eXtended
    risk 0.51cvss 7.8epss 0.01

    Untrusted search path vulnerability in Empirical Project Monitor - eXtended all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2016-7804HigMay 22, 2017
    7 Zip
    7 Zip
    risk 0.51cvss 7.8epss 0.02

    Untrusted search path vulnerability in 7 Zip for Windows 16.02 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2016-4904HigMay 22, 2017
    Wp Olivecart
    Olivecart
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in WP-OliveCart versions prior to 3.1.3 and WP-OliveCartPro versions prior to 3.1.8 allows remote attackers to hijack the authentication of a user to perform unintended operations via unspecified vectors.

  • CVE-2016-4901HigMay 22, 2017
    E Tax Software
    e-Tax Software
    risk 0.51cvss 7.8epss 0.02

    Untrusted search path vulnerability in The installer of e-Tax Software all versions allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2016-4900HigMay 22, 2017
    Evernote
    Evernote
    risk 0.51cvss 7.8epss 0.02

    Untrusted search path vulnerability in Evernote for Windows versions prior to 6.3 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

  • CVE-2016-4854HigMay 22, 2017
    L 04D
    L-04D firmware
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in L-04D firmware version V10a and V10b allows remote attackers to hijack the authentication of administrators to perform arbitrary operations via unspecified vectors.

  • CVE-2017-4915HigMay 22, 2017
    VMware
    Workstation
    risk 0.54cvss 7.8epss 0.05

    VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Successful exploitation of this issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.

  • CVE-2017-6999HigMay 22, 2017
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.05

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause…

  • CVE-2017-6998HigMay 22, 2017
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.04

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause…

  • CVE-2017-6997HigMay 22, 2017
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.05

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause…

  • CVE-2017-6996HigMay 22, 2017
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.04

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause…

  • CVE-2017-6995HigMay 22, 2017
    Apple Inc.
    tvOS
    risk 0.54cvss 7.8epss 0.04

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "AVEVideoEncoder" component. It allows attackers to execute arbitrary code in a privileged context or cause…