VYPR

CVEs

28,537 total · page 513 of 571

AllCriticalHighKEV
  • CVE-2015-0572HigOct 10, 2016
    risk 0.46cvss 7.0epss 0.00

    Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.

  • CVE-2016-1000001HigOct 7, 2016
    risk 0.41cvss 7.4epss 0.00

    flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect

  • CVE-2016-7040HigOct 7, 2016
    risk 0.57cvss 8.8epss 0.01

    Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

  • CVE-2016-6323HigOct 7, 2016
    risk 0.49cvss 7.5epss 0.01

    The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by applications compiled using gccgo, related to backtrace generation.

  • CVE-2016-6273HigOct 7, 2016
    risk 0.49cvss 7.5epss 0.02

    The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause a denial of service (crash) via a type 2F packet with a '01 19' opcode.

  • CVE-2016-3699HigOct 7, 2016
    risk 0.48cvss 7.4epss 0.00

    The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

  • CVE-2015-5162HigOct 7, 2016
    risk 0.42cvss 7.5epss 0.04

    The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.

  • CVE-2015-2080HigOct 7, 2016
    risk 0.59cvss 7.5epss 0.92

    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

  • CVE-2016-1000009HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.00

    TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.

  • CVE-2016-1000000HigOct 6, 2016
    risk 0.57cvss 8.8epss 0.00

    Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection

  • CVE-2015-1000013HigOct 6, 2016
    risk 0.51cvss 7.8epss 0.06

    Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1

  • CVE-2015-1000012HigOct 6, 2016
    risk 0.54cvss 7.5epss 0.69

    Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin

  • CVE-2015-1000010HigOct 6, 2016
    risk 0.51cvss 7.5epss 0.32

    Remote file download in simple-image-manipulator v1.0 wordpress plugin

  • CVE-2015-1000007HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.09

    Remote file download vulnerability in wptf-image-gallery v1.03

  • CVE-2015-1000006HigOct 6, 2016
    risk 0.50cvss 7.5epss 0.11

    Remote file download vulnerability in recent-backups v0.7 wordpress plugin

  • CVE-2015-1000005HigOct 6, 2016
    risk 0.50cvss 7.5epss 0.21

    Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin

  • CVE-2015-1000002HigOct 6, 2016
    risk 0.54cvss 8.2epss 0.03

    Open Proxy in filedownload v1.4 wordpress plugin

  • CVE-2016-6653HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.00

    The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials.

  • CVE-2016-6434HigOct 6, 2016
    risk 0.54cvss 7.8epss 0.00

    Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access, aka Bug ID CSCva30370.

  • CVE-2016-6433HigOct 6, 2016
    risk 0.66cvss 8.8epss 0.70

    The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

  • CVE-2016-6428HigOct 6, 2016
    risk 0.51cvss 7.8epss 0.00

    Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349.

  • CVE-2016-6427HigOct 6, 2016
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036 and CSCuy81654.

  • CVE-2016-6422HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.00

    Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restrictions by sending packets that should have been recognized by a filter, aka Bug ID CSCuy64806.

  • CVE-2016-6023HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.00

    Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.

  • CVE-2015-6393HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs CSCuq39250, CSCus21733, CSCus21739, CSCut76171, and CSCux67182.

  • CVE-2015-0721HigOct 6, 2016
    risk 0.52cvss 8.0epss 0.00

    Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492.

  • CVE-2015-6392HigOct 6, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via crafted IPv4 DHCP packets to the (1) DHCPv4 relay agent or (2) smart relay agent, aka Bug IDs CSCuq24603, CSCur93159, CSCus21693, and CSCut76171.

  • CVE-2016-7020HigOct 5, 2016
    risk 0.58cvss 8.8epss 0.04

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

  • CVE-2016-6426HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.00

    The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs CSCuy75027 and CSCuy81653.

  • CVE-2016-6393HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.09

    The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a denial of service (device reload) via a failed SSH connection attempt that is mishandled during generation of an error-log message, aka Bug ID CSCuy87667.

  • CVE-2016-6391HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series of Common Industrial Protocol (CIP) requests, aka Bug ID CSCur69036.

  • CVE-2016-6385HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.02

    Memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote attackers to cause a denial of service (memory consumption) via crafted image-list parameters, aka Bug ID CSCuy82367.

  • CVE-2016-6380HigOct 5, 2016
    risk 0.53cvss 8.1epss 0.02

    The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID CSCup90532.

  • CVE-2016-6379HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Detail Record (IPDR) packets, aka Bug ID CSCuu35089.

  • CVE-2016-6378HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS XE 3.1 through 3.17 and 16.1 through 16.2 allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets that require NAT, aka Bug ID CSCuw85853.

  • CVE-2016-1455HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtain sensitive information via TCP or UDP traffic, aka Bug ID CSCuz05365.

  • CVE-2016-6417HigOct 5, 2016
    risk 0.57cvss 8.8epss 0.00

    Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636.

  • CVE-2016-6392HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a crafted IPv4 Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message, aka Bug ID CSCud36767.

  • CVE-2016-6386HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption and device reload) via fragmented IPv4 packets, aka Bug ID CSCux66005.

  • CVE-2016-6384HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257.

  • CVE-2016-6382HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.08

    Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet, aka Bug ID CSCuy16399.

  • CVE-2016-6381HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allow remote attackers to cause a denial of service (memory consumption or device reload) via fragmented IKEv1 packets, aka Bug ID CSCuy47382.

  • CVE-2016-7561HigOct 5, 2016
    risk 0.47cvss 7.2epss 0.00

    Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.

  • CVE-2016-4551HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.00

    The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621.

  • CVE-2016-1246HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.02

    Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.

  • CVE-2016-8343HigOct 5, 2016
    risk 0.50cvss 7.5epss 0.10

    Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-6419HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    SQL injection vulnerability in Cisco Firepower Management Center 4.10.3 through 5.4.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCur25485.

  • CVE-2016-5983HigOct 5, 2016
    risk 0.50cvss 7.5epss 0.14

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object.

  • CVE-2016-5085HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.03

    Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.

  • CVE-2016-5084HigOct 5, 2016
    risk 0.49cvss 7.5epss 0.01

    Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitive information by sniffing the network.