VYPR

CVEs

128,308 total · page 2536 of 2,567

AllCriticalHighKEV
  • CVE-2016-0182HigMay 11, 2016
    Microsoft
    Windows
    risk 0.52cvss 7.8epss 0.20

    Windows Journal in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8.1, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted Journal (aka .jnt) file, aka "Windows Journal Memory Corruption Vulnerability."

  • CVE-2016-0180HigMay 11, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.01

    The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles symbolic links, which allows local users to gain privileges via a crafted…

  • CVE-2016-0179HigMay 11, 2016
    Microsoft
    Windows Server 2012
    risk 0.53cvss 7.8epss 0.24

    Windows Shell in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Shell Remote Code Execution Vulnerability."

  • CVE-2016-0178HigMay 11, 2016
    Microsoft
    Windows
    risk 0.59cvss 8.8epss 0.17

    The RPC NDR Engine in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles free operations, which allows remote attackers to execute arbitrary code…

  • CVE-2016-0176HigMay 11, 2016
    Microsoft
    Windows Server 2008
    risk 0.51cvss 7.8epss 0.02

    dxgkrnl.sys in the DirectX Graphics kernel subsystem in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted…

  • CVE-2016-0174HigMay 11, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.02

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0173HigMay 11, 2016
    Microsoft
    Windows
    risk 0.54cvss 7.8epss 0.04

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0171HigMay 11, 2016
    Microsoft
    Windows
    risk 0.54cvss 7.8epss 0.04

    The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka "Win32k…

  • CVE-2016-0170HigMay 11, 2016
    Microsoft
    Windows
    risk 0.64cvss 8.8epss 0.49

    GDI in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows remote attackers to execute arbitrary code via a crafted document, aka "Windows Graphics…

  • CVE-2016-0152HigMay 11, 2016
    Microsoft
    Windows
    risk 0.51cvss 7.8epss 0.04

    Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."

  • CVE-2016-0140HigMay 11, 2016
    Microsoft
    Office
    risk 0.52cvss 7.8epss 0.19

    Microsoft Office 2007 SP3, Office 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-0126HigMay 11, 2016
    Microsoft
    Office
    risk 0.52cvss 7.8epss 0.20

    Microsoft Office 2013 SP1, 2013 RT SP1, and 2016 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

  • CVE-2016-4556HigMay 10, 2016
    Squid Cache
    Squid
    risk 0.51cvss 7.5epss 0.23

    Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.

  • CVE-2016-4555HigMay 10, 2016
    Squid Cache
    Squid
    risk 0.50cvss 7.5epss 0.18

    client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.

  • CVE-2016-4554HigMay 10, 2016
    Squid Cache
    Squid
    risk 0.59cvss 8.6epss 0.39

    mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.

  • CVE-2016-4553HigMay 10, 2016
    Squid Cache
    Squid
    risk 0.62cvss 8.6epss 0.80

    client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.

  • CVE-2016-3105HigMay 9, 2016
    Mercurial
    Mercurial
    risk 0.57cvss 8.8epss 0.03

    The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

  • CVE-2016-4477HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or…

  • CVE-2016-4476HigMay 9, 2016
    W1.fi
    Hostapd
    risk 0.49cvss 7.5epss 0.03

    hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.

  • CVE-2016-2462HigMay 9, 2016
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173.

  • CVE-2016-2461HigMay 9, 2016
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bugs 27324690 and 27696681.

  • CVE-2016-2456HigMay 9, 2016
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27275187.

  • CVE-2016-2453HigMay 9, 2016
    Google
    Android One
    risk 0.46cvss 7.0epss 0.00

    The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27549705.

  • CVE-2016-2452HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by…

  • CVE-2016-2451HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as…

  • CVE-2016-2450HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as…

  • CVE-2016-2449HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as…

  • CVE-2016-2448HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted…

  • CVE-2016-2446HigMay 9, 2016
    Nvidia
    NVIDIA media driver
    risk 0.46cvss 7.0epss 0.00

    The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27441354.

  • CVE-2016-2445HigMay 9, 2016
    Google
    Android
    risk 0.46cvss 7.0epss 0.00

    The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27253079.

  • CVE-2016-2444HigMay 9, 2016
    Nvidia
    NVIDIA media driver
    risk 0.46cvss 7.0epss 0.00

    The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27208332.

  • CVE-2016-2443HigMay 9, 2016
    Qualcomm
    MDP driver
    risk 0.46cvss 7.0epss 0.00

    The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 26404525.

  • CVE-2016-2442HigMay 9, 2016
    Qualcomm
    buspm driver
    risk 0.46cvss 7.0epss 0.00

    The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26494907.

  • CVE-2016-2441HigMay 9, 2016
    Qualcomm
    buspm driver
    risk 0.46cvss 7.0epss 0.00

    The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26354602.

  • CVE-2016-2440HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.

  • CVE-2016-2439HigMay 9, 2016
    Google
    Android
    risk 0.57cvss 8.8epss 0.01

    Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.

  • CVE-2016-2437HigMay 9, 2016
    Nvidia
    Video Driver
    risk 0.51cvss 7.8epss 0.01

    The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27436822.

  • CVE-2016-2436HigMay 9, 2016
    Nvidia
    Video Driver
    risk 0.51cvss 7.8epss 0.00

    The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27299111.

  • CVE-2016-2435HigMay 9, 2016
    Nvidia
    Video Driver
    risk 0.51cvss 7.8epss 0.01

    The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27297988.

  • CVE-2016-2434HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27251090.

  • CVE-2016-2432HigMay 9, 2016
    Qualcomm
    TrustZone
    risk 0.51cvss 7.8epss 0.00

    The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 6 and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 25913059.

  • CVE-2016-2431HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.02

    The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 5, Nexus 6, Nexus 7 (2013), and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 24968809.

  • CVE-2016-2430HigMay 9, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236.

  • CVE-2016-2060HigMay 9, 2016
    Qualcomm
    netd
    risk 0.51cvss 7.8epss 0.00

    server/TetherController.cpp in the tethering controller in netd, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly validate upstream interface names, which allows attackers to bypass intended access…

  • CVE-2015-0571HigMay 9, 2016
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.01

    The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted…

  • CVE-2015-0570HigMay 9, 2016
    Linux
    Kernel
    risk 0.51cvss 7.8epss 0.02

    Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to…

  • CVE-2015-0569HigMay 9, 2016
    Linux
    Kernel
    risk 0.54cvss 7.8epss 0.06

    Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows…

  • CVE-2016-2353HigMay 7, 2016
    Accellion
    File Transfer Appliance
    risk 0.51cvss 7.8epss 0.00

    The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors.

  • CVE-2016-2352HigMay 7, 2016
    Accellion
    File Transfer Appliance
    risk 0.58cvss 8.8epss 0.05

    The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.

  • CVE-2016-2014HigMay 7, 2016
    HPE
    Network Node Manager i
    risk 0.53cvss 8.1epss 0.02

    HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.