VYPR

CVEs

31,844 total · page 578 of 637

AllCriticalHighKEV
  • CVE-2016-6673HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 30204201.

  • CVE-2016-6672HigOct 10, 2016
    LG
    Nexus 5X
    risk 0.51cvss 7.8epss 0.00

    The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 30537088.

  • CVE-2016-3940HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 6P and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 30141991.

  • CVE-2016-3939HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    drivers/video/msm/mdss/mdss_debug.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30874196 and Qualcomm internal bug CR…

  • CVE-2016-3938HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    drivers/video/msm/mdss/mdss_mdp_overlay.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30019716 and Qualcomm internal bug…

  • CVE-2016-3937HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30030994 and MediaTek internal bug ALPS02834874.

  • CVE-2016-3936HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019037 and MediaTek internal bug ALPS02829568.

  • CVE-2016-3935HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    Multiple integer overflows in drivers/crypto/msm/qcedev.c in the Qualcomm cryptographic engine driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug…

  • CVE-2016-3934HigOct 10, 2016
    Qualcomm
    camera driver
    risk 0.51cvss 7.8epss 0.01

    drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices relies on variable-length arrays, which allows attackers to gain privileges via a…

  • CVE-2016-3933HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    mediaserver in Android before 2016-10-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 29421408.

  • CVE-2016-3932HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    mediaserver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 29161895 and MediaTek internal bug ALPS02770870.

  • CVE-2016-3931HigOct 10, 2016
    Qualcomm
    QSEE Communicator driver
    risk 0.51cvss 7.8epss 0.01

    drivers/misc/qseecom.c in the Qualcomm QSEE Communicator driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29157595 and Qualcomm internal bug CR…

  • CVE-2016-3930HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    The NVIDIA MMC test driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28760138.

  • CVE-2016-3928HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019362 and MediaTek internal bug ALPS02829384.

  • CVE-2016-3922HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    libril/RilSapSocket.cpp in Telephony in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka internal bug 30202619.

  • CVE-2016-3921HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    libsysutils/src/FrameworkListener.cpp in Framework Listener in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 29831647.

  • CVE-2016-3917HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.00

    The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka…

  • CVE-2016-3916HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    camera/src/camera_metadata.c in the Camera service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30741779.

  • CVE-2016-3915HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    camera/src/camera_metadata.c in the Camera service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30591838.

  • CVE-2016-3914HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.00

    Race condition in providers/telephony/MmsProvider.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application that modifies a database…

  • CVE-2016-3913HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    media/libmediaplayerservice/MediaPlayerService.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate a certain static_cast operation, which allows attackers to gain privileges…

  • CVE-2016-3912HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.00

    The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allow attackers to gain privileges via a crafted application, aka internal bug 30202481.

  • CVE-2016-3911HigOct 10, 2016
    Google
    Android SDK
    risk 0.51cvss 7.8epss 0.01

    core/java/android/os/Process.java in Zygote in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30143607.

  • CVE-2016-3910HigOct 10, 2016
    Google
    mediaserver
    risk 0.51cvss 7.8epss 0.00

    services/soundtrigger/SoundTriggerHwService.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30148546.

  • CVE-2016-3909HigOct 10, 2016
    Google
    mediaserver
    risk 0.51cvss 7.8epss 0.01

    The SoftMPEG4 component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30033990.

  • CVE-2016-3905HigOct 10, 2016
    Qualcomm
    qcacld-2.0
    risk 0.51cvss 7.8epss 0.01

    CORE/HDD/src/wlan_hdd_main.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application that sends a SENDACTIONFRAME command, aka Android internal bug 28061823 and Qualcomm internal bug CR 1001449.

  • CVE-2016-3903HigOct 10, 2016
    Qualcomm
    camera driver
    risk 0.51cvss 7.8epss 0.01

    drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c in the Qualcomm camera driver in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug…

  • CVE-2016-3901HigOct 10, 2016
    Qualcomm
    Crypto Engine Driver
    risk 0.51cvss 7.8epss 0.01

    Multiple integer overflows in drivers/crypto/msm/qcedev.c in the Qualcomm cryptographic engine driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug…

  • CVE-2016-3900HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    cmds/servicemanager/service_manager.c in ServiceManager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not properly restrict service registration, which allows attackers to gain privileges via a crafted application, aka…

  • CVE-2015-8955HigOct 10, 2016
    Linux
    Kernel
    risk 0.40cvss 7.3epss 0.00

    arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.

  • CVE-2015-8951HigOct 10, 2016
    Google
    Android
    risk 0.51cvss 7.8epss 0.01

    Multiple use-after-free vulnerabilities in sound/soc/msm/qdsp6v2/msm-lsm-client.c in the Qualcomm sound driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug…

  • CVE-2015-0572HigOct 10, 2016
    Linux
    Kernel
    risk 0.46cvss 7.0epss 0.00

    Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of…

  • CVE-2016-1000001HigOct 7, 2016
    Flask Oidc Project
    Flask Oidc
    risk 0.41cvss 7.4epss 0.01

    flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect

  • CVE-2016-7040HigOct 7, 2016
    Red Hat
    Cloudforms Management Engine
    risk 0.57cvss 8.8epss 0.02

    Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter…

  • CVE-2016-6323HigOct 7, 2016
    GNU
    Glibc
    risk 0.49cvss 7.5epss 0.04

    The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on ARM EABI (32-bit) platforms, which might allow context-dependent attackers to cause a denial of service (hang), as demonstrated by…

  • CVE-2016-6273HigOct 7, 2016
    Revenera
    Flexnet Publisher
    risk 0.49cvss 7.5epss 0.02

    The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix License Server for Windows before 11.14.0.1 and Citrix License Server VPX before 11.14.0.1, allows remote attackers to cause a denial of…

  • CVE-2016-3699HigOct 7, 2016
    Red Hat
    Enterprise Mrg
    risk 0.48cvss 7.4epss 0.01

    The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

  • CVE-2015-5162HigOct 7, 2016
    OpenStack
    Nova
    risk 0.42cvss 7.5epss 0.03

    The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted…

  • CVE-2015-2080HigOct 7, 2016
    Eclipse
    Jetty
    risk 0.59cvss 7.5epss 0.75

    The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

  • CVE-2016-1000009HigOct 6, 2016
    TP-Link
    tplinklogin.net
    risk 0.49cvss 7.5epss 0.01

    TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on many of the devices.

  • CVE-2016-1000000HigOct 6, 2016
    Progress (organisation)
    Whatsup Gold
    risk 0.57cvss 8.8epss 0.01

    Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection

  • CVE-2015-1000013HigOct 6, 2016
    Csv2wpec Coupon Project
    Csv2wpec Coupon
    risk 0.51cvss 7.8epss 0.02

    Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1

  • CVE-2015-1000012HigOct 6, 2016
    Mypixs Project
    Mypixs
    risk 0.54cvss 7.5epss 0.09

    Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin

  • CVE-2015-1000010HigOct 6, 2016
    Simple Image Manipulator Project
    Simple Image Manipulator
    risk 0.51cvss 7.5epss 0.07

    Remote file download in simple-image-manipulator v1.0 wordpress plugin

  • CVE-2015-1000007HigOct 6, 2016
    Wptf Image Gallery Project
    Wptf Image Gallery
    risk 0.49cvss 7.5epss 0.02

    Remote file download vulnerability in wptf-image-gallery v1.03

  • CVE-2015-1000006HigOct 6, 2016
    Recent Backups Project
    Recent Backups
    risk 0.50cvss 7.5epss 0.04

    Remote file download vulnerability in recent-backups v0.7 wordpress plugin

  • CVE-2015-1000005HigOct 6, 2016
    Candidate Application Form Project
    Candidate Application Form
    risk 0.50cvss 7.5epss 0.09

    Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin

  • CVE-2015-1000002HigOct 6, 2016
    Modxcms
    Filedownload
    risk 0.54cvss 8.2epss 0.02

    Open Proxy in filedownload v1.4 wordpress plugin

  • CVE-2016-6653HigOct 6, 2016
    Cloudfoundry
    Cloud Foundry Cf Mysql
    risk 0.49cvss 7.5epss 0.01

    The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials.

  • CVE-2016-6434HigOct 6, 2016
    Cisco Systems, Inc.
    Firepower Management Center (FMC) Software
    risk 0.54cvss 7.8epss 0.01

    Cisco Firepower Management Center 6.0.1 has hardcoded database credentials, which allows local users to obtain sensitive information by leveraging CLI access, aka Bug ID CSCva30370.

VYPR — Vulnerability Intelligence