VYPR

CVEs

408,448 total · page 5489 of 8,169

AllCriticalHighKEV
  • CVE-2019-12916Mar 3, 2020
    risk 0.00cvss —epss —

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  • CVE-2019-12915Mar 3, 2020
    risk 0.00cvss —epss —

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  • CVE-2020-4198MedMar 3, 2020
    IBM
    Tivoli Netcool\/omnibus
    risk 0.35cvss 5.4epss 0.01

    IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2020-4197LowMar 3, 2020
    IBM
    Tivoli Netcool\/omnibus
    risk 0.16cvss 2.4epss 0.00

    IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174908.

  • CVE-2020-4196MedMar 3, 2020
    IBM
    Tivoli Netcool\/omnibus
    risk 0.35cvss 5.4epss 0.01

    IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM…

  • CVE-2019-3696HigMar 3, 2020
    OpenSUSE
    pcp
    risk 0.55cvss 8.4epss 0.00

    A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE…

  • CVE-2019-3695HigMar 3, 2020
    OpenSUSE
    pcp
    risk 0.55cvss 8.4epss 0.00

    A Improper Control of Generation of Code vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise…

  • CVE-2020-9751CriMar 3, 2020
    Naver
    Cloud Explorer
    risk 0.59cvss 9.1epss 0.00

    Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker's server and execute it during the upgrade.

  • CVE-2020-10018CriMar 2, 2020
    Webkitgtk
    Webkitgtk
    risk 0.64cvss 9.8epss 0.05

    WebKitGTK through 2.26.4 and WPE WebKit through 2.26.4 (which are the versions right before 2.28.0) contains a memory corruption issue (use-after-free) that may lead to arbitrary code execution. This issue has been fixed in 2.28.0 with improved memory handling.

  • CVE-2018-5951HigMar 2, 2020
    Mikrotik
    Routeros
    risk 0.49cvss 7.5epss 0.04

    An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 address of a RouterOS box with IP Protocol 97 will cause RouterOS to reboot imminently. All versions of RouterOS that supports EoIPv6 are vulnerable to this attack.

  • CVE-2018-20347Mar 2, 2020
    risk 0.00cvss —epss —

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  • CVE-2019-14893CriMar 2, 2020
    Fasterxml
    Jackson Databind
    risk 0.57cvss 9.8epss 0.04

    A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as…

  • CVE-2018-20343HigMar 2, 2020
    Ken Silverman
    Build Engine
    risk 0.51cvss 7.8epss 0.02

    Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a special map file to execute arbitrary code when the map file is loaded.

  • CVE-2018-19798HigMar 2, 2020
    Fleetco
    Fleet Maintenance Management
    risk 0.57cvss 8.8epss 0.03

    Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_add.php?submit=1 URI, as demonstrated by the value_Images_1 field, which leads to remote command execution on the remote…

  • CVE-2018-19658MedMar 2, 2020
    YXBJ
    YXBJ
    risk 0.35cvss 5.4epss 0.01

    The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YXBJ, not a vulnerability in Evernote.

  • CVE-2018-19599MedMar 2, 2020
    Monstra
    CMS
    risk 0.35cvss 5.4epss 0.01

    Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product.

  • CVE-2018-19284Mar 2, 2020
    risk 0.00cvss —epss —

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  • CVE-2018-18479Mar 2, 2020
    risk 0.00cvss —epss —

    Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  • CVE-2018-17572MedMar 2, 2020
    Influxdata
    Influxdb
    risk 0.31cvss 4.8epss 0.01

    InfluxDB 0.9.5 has Reflected XSS in the Write Data module.

  • CVE-2018-16357CriMar 2, 2020
    Pbootcmspro
    Pbootcms
    risk 0.64cvss 9.8epss 0.02

    An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.

  • CVE-2018-16356CriMar 2, 2020
    Pbootcmspro
    Pbootcms
    risk 0.64cvss 9.8epss 0.02

    An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.

  • CVE-2020-8778MedMar 2, 2020
    Alfresco
    Alfresco
    risk 0.38cvss 5.4epss 0.03

    Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.

  • CVE-2020-8777MedMar 2, 2020
    Alfresco
    Alfresco
    risk 0.38cvss 5.4epss 0.03

    Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

  • CVE-2020-8776MedMar 2, 2020
    Alfresco
    Alfresco
    risk 0.38cvss 5.4epss 0.03

    Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.

  • CVE-2020-8437HigMar 2, 2020
    Bittorrent
    uTorrent
    risk 0.50cvss 7.5epss 0.12

    The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of service.

  • CVE-2018-15820MedMar 2, 2020
    Easyio
    Easyio 30p Firmware
    risk 0.40cvss 6.1epss 0.01

    EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.

  • CVE-2018-15819HigMar 2, 2020
    Easyio
    Easyio 30p Firmware
    risk 0.49cvss 7.5epss 0.02

    EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js.

  • CVE-2019-19608CriMar 2, 2020
    Mitel
    Micollab
    risk 0.64cvss 9.8epss 0.02

    A SQL injection vulnerability in in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the registeredList.cgi page. A successful exploit could allow an attacker to extract sensitive…

  • CVE-2019-19607CriMar 2, 2020
    Mitel
    Micollab
    risk 0.64cvss 9.8epss 0.02

    A SQL injection vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attack due to insufficient input validation for the session parameter. A successful exploit could allow an attacker to extract sensitive…

  • CVE-2019-19371MedMar 2, 2020
    Mitel
    Micollab
    risk 0.40cvss 6.1epss 0.01

    A cross-site scripting (XSS) vulnerability in the web conferencing component of Mitel MiCollab AWV before 8.1.2.2 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the join meeting interface. A…

  • CVE-2019-19370MedMar 2, 2020
    Mitel
    Micollab
    risk 0.40cvss 6.1epss 0.01

    A cross-site scripting (XSS) vulnerability in the web conferencing component of the Mitel MiCollab application before 9.0.15 for Android could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation in the file…

  • CVE-2019-18863MedMar 2, 2020
    Mitel
    6863i Firmware
    risk 0.38cvss 5.9epss 0.01

    A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the…

  • CVE-2020-8013LowMar 2, 2020
    SUSE S.A.
    Linux Enterprise Server
    risk 0.14cvss 2.2epss 0.00

    A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The…

  • CVE-2020-1731CriMar 2, 2020
    Red Hat
    Keycloak Operator
    risk 0.59cvss 9.1epss 0.01

    A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.

  • CVE-2019-18903HigMar 2, 2020
    OpenSUSE
    Leap
    risk 0.49cvss 7.5epss 0.02

    A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…

  • CVE-2019-18902HigMar 2, 2020
    OpenSUSE
    Leap
    risk 0.49cvss 7.5epss 0.02

    A Use After Free vulnerability in wicked of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Leap 15.1, Factory allows remote attackers to cause DoS or potentially code execution. This issue affects: SUSE Linux Enterprise Server 12 wicked versions prior…

  • CVE-2019-14892CriMar 2, 2020
    Fasterxml
    Jackson Databind
    risk 0.57cvss 9.8epss 0.06

    A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

  • CVE-2018-14384MedMar 2, 2020
    SEO Panel
    Website Manager
    risk 0.31cvss 4.8epss 0.01

    The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated attackers to inject arbitrary web script or HTML via the websites.php name parameter.

  • CVE-2020-8500HigMar 2, 2020
    Artica
    Pandorafms
    risk 0.47cvss 7.2epss 0.04

    In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality

  • CVE-2020-5249MedMar 2, 2020
    Puma
    puma
    risk 0.35cvss 6.5epss 0.02

    In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body.…

  • CVE-2019-20489CriMar 2, 2020
    Netgear
    WNR1000v4
    risk 0.64cvss 9.8epss 0.01

    An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. The web management interface (setup.cgi) has an authentication bypass and other problems that ultimately allow an attacker to remotely compromise the device from a malicious webpage. The attacker sends an…

  • CVE-2019-20488CriMar 2, 2020
    Netgear
    WNR1000v4
    risk 0.64cvss 9.8epss 0.02

    An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the web management interface (setup.cgi) are vulnerable to command injection, allowing remote attackers to execute arbitrary commands, as demonstrated by shell metacharacters in the sysDNSHost…

  • CVE-2019-20487HigMar 2, 2020
    Netgear
    WNR1000v4
    risk 0.57cvss 8.8epss 0.00

    An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple actions within the WNR1000V4 web management console are vulnerable to an unauthenticated GET request (exploitable directly or through CSRF), as demonstrated by the setup.cgi?todo=save_htp_account URI.

  • CVE-2019-20486MedMar 2, 2020
    Netgear
    WNR1000v4
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS, as demonstrated by the configuration of the UI language.

  • CVE-2019-18901MedMar 2, 2020
    SUSE S.A.
    Linux Enterprise Server
    risk 0.33cvss 5.1epss 0.00

    A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE…

  • CVE-2019-18897HigMar 2, 2020
    OpenSUSE
    salt-master
    risk 0.55cvss 8.4epss 0.00

    A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise…

  • CVE-2019-12183HigMar 2, 2020
    Safescan
    Timemoto
    risk 0.49cvss 7.5epss 0.02

    Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.

  • CVE-2017-12580HigMar 2, 2020
    Ultraedit
    Ultraedit
    risk 0.51cvss 7.8epss 0.00

    An issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on unpatched Windows systems, an attacker could include in the same directory as the affected executable a DLL using the name of a Windows DLL. This DLL must be preloaded by the executable…

  • CVE-2015-1583HigMar 2, 2020
    Atutor
    Atutor
    risk 0.50cvss 8.8epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator account via a request to mods/_core/users/admins/create.php or (2) create a user account…

  • CVE-2020-4292MedMar 2, 2020
    IBM
    Security Information Queue
    risk 0.35cvss 5.3epss 0.01

    IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 uses a cross-domain policy file that includes domains that should not be trusted which could disclose sensitive information. IBM X-Force ID: 176335.