VYPR

CVEs

129,291 total · page 2405 of 2,586

AllCriticalHighKEV
  • CVE-2017-7341HigOct 26, 2017
    Fortinet
    Fortiwlc
    risk 0.47cvss 7.2epss 0.04

    An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via…

  • CVE-2017-15882HigOct 26, 2017
    Londontrustmedia
    Private Internet Access
    risk 0.49cvss 7.5epss 0.02

    The London Trust Media Private Internet Access (PIA) application before 1.3.3.1 for Android allows remote attackers to cause a denial of service (application crash) via a large VPN server-list file.

  • CVE-2017-12705HigOct 25, 2017
    Advantech
    WebOP
    risk 0.51cvss 7.8epss 0.00

    A Heap-Based Buffer Overflow issue was discovered in Advantech WebOP. A maliciously crafted project file may be able to trigger a heap-based buffer overflow, which may crash the process and allow an attacker to execute arbitrary code.

  • CVE-2017-15880HigOct 24, 2017
    Eyesofnetwork
    Eyesofnetwork
    risk 0.47cvss 7.2epss 0.02

    SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and…

  • CVE-2017-15879HigOct 24, 2017
    Keystonejs
    Keystone
    risk 0.61cvss 8.8epss 0.07

    CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.

  • CVE-2017-1583HigOct 24, 2017
    IBM
    Liberty
    risk 0.49cvss 7.5epss 0.03

    IBM WebSphere Application Server (IBM Liberty for Java for Bluemix 3.13)could allow a remote attacker to obtain sensitive information caused by improper error handling by MyFaces in JSF.

  • CVE-2017-1523HigOct 24, 2017
    IBM
    Infosphere Master Data Management
    risk 0.49cvss 7.5epss 0.02

    IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authentication. IBM X-Force ID: 129892.

  • CVE-2017-1375HigOct 24, 2017
    IBM
    Storwize Unified V7000
    risk 0.49cvss 7.5epss 0.01

    IBM System Storage Storwize V7000 Unified (V7000U) 1.5 and 1.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126868.

  • CVE-2017-1210HigOct 24, 2017
    IBM
    Daeja Viewone
    risk 0.49cvss 7.5epss 0.01

    IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 could allow an unauthenticated attacker to inject data into log files made to look legitimate. IBM X-Force ID: 123850.

  • CVE-2017-15871HigOct 24, 2017
    Serialize To Js Project
    Serialize To Js
    risk 0.49cvss 7.5epss 0.01

    The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE:…

  • CVE-2016-10517HigOct 24, 2017
    Redis
    Redis
    risk 0.41cvss 7.4epss 0.02

    networking.c in Redis before 3.2.7 allows "Cross Protocol Scripting" because it lacks a check for POST and Host: strings, which are not valid in the Redis protocol (but commonly occur when an attack triggers an HTTP request to the Redis TCP port).

  • CVE-2017-14696HigOct 24, 2017
    Saltstack
    Salt
    risk 0.42cvss 7.5epss 0.04

    SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.

  • CVE-2015-5173HigOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.57cvss 8.8epss 0.01

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."

  • CVE-2015-5170HigOct 24, 2017
    Cloudfoundry
    Uaa
    risk 0.50cvss 8.8epss 0.01

    Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery (CSRF) attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF…

  • CVE-2014-0691HigOct 24, 2017
    Cisco Systems, Inc.
    Webex Meetings Server
    risk 0.48cvss 7.3epss 0.01

    Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.

  • CVE-2017-12613HigOct 24, 2017
    Apache
    Portable Runtime
    risk 0.39cvss 7.1epss 0.02

    When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a…

  • CVE-2017-13772HigOct 23, 2017
    TP-Link
    WR940N
    risk 0.64cvss 8.8epss 0.51

    Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm.

  • CVE-2015-5533HigOct 23, 2017
    WordPress
    Count Per Day
    risk 0.43cvss 7.2epss 0.07

    SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpd_keep_month parameter to wp-admin/options-general.php. NOTE: this can be leveraged…

  • CVE-2015-2878HigOct 23, 2017
    Hexis
    HawkEye G
    risk 0.61cvss 8.8epss 0.04

    Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2)…

  • CVE-2014-3744HigOct 23, 2017
    Node.js
    Node.js
    risk 0.44cvss 7.5epss 0.34

    Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in an unspecified path.

  • CVE-2013-7377HigOct 23, 2017
    Codem Transcode Project
    Codem Transcode
    risk 0.53cvss 8.1epss 0.02

    The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe.

  • CVE-2012-4568HigOct 23, 2017
    Letodms Project
    Letodms
    risk 0.57cvss 8.8epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) before 3.3.8 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

  • CVE-2011-4334HigOct 23, 2017
    Labwiki Project
    Labwiki
    risk 0.61cvss 8.8epss 0.06

    edit.php in LabWiki 1.1 and earlier does not properly verify uploaded user files, which allows remote authenticated users to upload arbitrary PHP files via a PHP file with a .gif extension in the userfile parameter.

  • CVE-2017-15808HigOct 23, 2017
    PhpMyAdmin
    Phpmyfaq
    risk 0.60cvss 8.8epss 0.01

    In phpMyFaq before 2.9.9, there is CSRF in admin/ajax.config.php.

  • CVE-2010-2232HigOct 23, 2017
    Apache
    Derby
    risk 0.49cvss 7.5epss 0.04

    In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.

  • CVE-2017-9946HigOct 23, 2017
    Siemens Foundation
    APOGEE PXC
    risk 0.51cvss 7.5epss 0.25

    A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. An attacker with network access to the integrated web server (80/tcp and 443/tcp) could bypass the authentication and download sensitive information from…

  • CVE-2017-15805HigOct 23, 2017
    Cisco Systems, Inc.
    Small Business SA520 and SA540
    risk 0.49cvss 7.5epss 0.02

    Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files.

  • CVE-2017-15567HigOct 23, 2017
    Idemia
    MorphoSmart 1300 Series
    risk 0.51cvss 7.8epss 0.00

    The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command…

  • CVE-2017-15378HigOct 23, 2017
    E Sic
    E-Sic
    risk 0.57cvss 8.8epss 0.01

    SQL Injection exists in the E-Sic 1.0 password reset parameter (aka the cpfcnpj parameter to the /reset URI).

  • CVE-2017-15377HigOct 23, 2017
    Openinfosecfoundation
    Suricata
    risk 0.49cvss 7.5epss 0.02

    In Suricata before 4.x, it was possible to trigger lots of redundant checks on the content of crafted network traffic with a certain signature, because of DetectEngineContentInspection in detect-engine-content-inspection.c. The search engine doesn't stop when it should after no…

  • CVE-2017-14332HigOct 23, 2017
    Extremenetworks
    Exos
    risk 0.53cvss 8.1epss 0.01

    Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to hijack sessions by determining SessionID values.

  • CVE-2017-14328HigOct 23, 2017
    Extremenetworks
    Exos
    risk 0.49cvss 7.5epss 0.01

    Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.

  • CVE-2017-7149HigOct 23, 2017
    Apple Inc.
    Mac OS X
    risk 0.51cvss 7.8epss 0.01

    An issue was discovered in certain Apple products. macOS before 10.13 Supplemental Update is affected. The issue involves the "StorageKit" component. It allows attackers to discover passwords for APFS encrypted volumes by reading Disk Utility hints, because the stored hint value…

  • CVE-2017-7137HigOct 23, 2017
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.02

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

  • CVE-2017-7136HigOct 23, 2017
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.02

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

  • CVE-2017-7135HigOct 23, 2017
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.02

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

  • CVE-2017-7134HigOct 23, 2017
    Apple Inc.
    Xcode
    risk 0.51cvss 7.8epss 0.02

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

  • CVE-2017-7133HigOct 23, 2017
    Apple Inc.
    Iphone OS
    risk 0.49cvss 7.5epss 0.01

    An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "MobileBackup" component. It allows remote attackers to obtain sensitive cleartext information in opportunistic circumstances by leveraging read access to a backup archive that…

  • CVE-2017-7127HigOct 23, 2017
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. iCloud before 7.0 on Windows is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "SQLite" component. It allows attackers to…

  • CVE-2017-7120HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7117HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.61cvss 8.8epss 0.10

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7116HigOct 23, 2017
    Apple Inc.
    tvOS
    risk 0.49cvss 7.5epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Wi-Fi" component. It might allow remote attackers to read data from kernel memory locations via crafted Wi-Fi traffic.

  • CVE-2017-7115HigOct 23, 2017
    Apple Inc.
    tvOS
    risk 0.56cvss 8.1epss 0.08

    An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. The issue involves the "Wi-Fi" component. It might allow remote attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption)…

  • CVE-2017-7114HigOct 23, 2017
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.01

    An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged…

  • CVE-2017-7111HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7107HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7104HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7102HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7100HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…

  • CVE-2017-7099HigOct 23, 2017
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows…