VYPR

CVEs

31,844 total · page 579 of 637

AllCriticalHighKEV
  • CVE-2016-6433HigOct 6, 2016
    Cisco Systems, Inc.
    Secure Firewall Management Center
    risk 0.66cvss 8.8epss 0.76

    The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.

  • CVE-2016-6428HigOct 6, 2016
    Cisco Systems, Inc.
    iOS Xr
    risk 0.51cvss 7.8epss 0.00

    Cisco IOS XR 6.1.1 allows local users to execute arbitrary OS commands as root by leveraging admin privileges, aka Bug ID CSCva38349.

  • CVE-2016-6427HigOct 6, 2016
    Cisco Systems, Inc.
    Unified Contact Center Express
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCuy75036…

  • CVE-2016-6422HigOct 6, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.01

    Cisco IOS 12.2(33)SXJ9 on Supervisor Engine 32 and 720 modules for 6500 and 7600 devices mishandles certain operators, flags, and keywords in TCAM share ACLs, which allows remote attackers to bypass intended access restrictions by sending packets that should have been recognized…

  • CVE-2016-6023HigOct 6, 2016
    IBM
    Sterling Secure Proxy
    risk 0.49cvss 7.5epss 0.02

    Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.

  • CVE-2015-6393HigOct 6, 2016
    Cisco Systems, Inc.
    Nx OS
    risk 0.49cvss 7.5epss 0.02

    Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs…

  • CVE-2015-0721HigOct 6, 2016
    Cisco Systems, Inc.
    Nx OS
    risk 0.52cvss 8.0epss 0.02

    Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an…

  • CVE-2015-6392HigOct 6, 2016
    Cisco Systems, Inc.
    Nx OS
    risk 0.49cvss 7.5epss 0.02

    Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via crafted IPv4 DHCP packets to the (1) DHCPv4 relay agent or (2) smart relay agent, aka Bug…

  • CVE-2016-7020HigOct 5, 2016
    Adobe Inc.
    Flash Player Desktop Runtime
    risk 0.58cvss 8.8epss 0.06

    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173,…

  • CVE-2016-6426HigOct 5, 2016
    Cisco Systems, Inc.
    Unified Contact Center Express
    risk 0.49cvss 7.5epss 0.01

    The j_spring_security_switch_user function in Cisco Unified Intelligence Center (CUIC) 8.5.4 through 9.1(1), as used in Unified Contact Center Express 10.0(1) through 11.0(1), allows remote attackers to create user accounts by visiting an unspecified web page, aka Bug IDs…

  • CVE-2016-6393HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.05

    The AAA service in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.1 through 3.18 and 16.2 allows remote attackers to cause a denial of service (device reload) via a failed SSH connection attempt that is mishandled during generation of an error-log message, aka…

  • CVE-2016-6391HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS 12.2 and 15.0 through 15.3 allows remote attackers to cause a denial of service (traffic-processing outage) via a crafted series of Common Industrial Protocol (CIP) requests, aka Bug ID CSCur69036.

  • CVE-2016-6385HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.03

    Memory leak in the Smart Install client implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.2 through 3.8 allows remote attackers to cause a denial of service (memory consumption) via crafted image-list parameters, aka Bug ID CSCuy82367.

  • CVE-2016-6380HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.53cvss 8.1epss 0.03

    The DNS forwarder in Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.15 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (data corruption or device reload) via a crafted DNS response, aka Bug ID…

  • CVE-2016-6379HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.03

    Cisco IOS 12.2 and IOS XE 3.14 through 3.16 and 16.1 allow remote attackers to cause a denial of service (device reload) via crafted IP Detail Record (IPDR) packets, aka Bug ID CSCuu35089.

  • CVE-2016-6378HigOct 5, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.49cvss 7.5epss 0.02

    Cisco IOS XE 3.1 through 3.17 and 16.1 through 16.2 allows remote attackers to cause a denial of service (device reload) via crafted ICMP packets that require NAT, aka Bug ID CSCuw85853.

  • CVE-2016-1455HigOct 5, 2016
    Cisco Systems, Inc.
    Nx OS
    risk 0.49cvss 7.5epss 0.02

    Cisco NX-OS before 7.0(3)I2(2e) and 7.0(3)I4 before 7.0(3)I4(1) has an incorrect iptables local-interface configuration, which allows remote attackers to obtain sensitive information via TCP or UDP traffic, aka Bug ID CSCuz05365.

  • CVE-2016-6417HigOct 5, 2016
    Cisco Systems, Inc.
    Firesight System Software
    risk 0.57cvss 8.8epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 4.10.2 through 6.1.0 and Firepower Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCva21636.

  • CVE-2016-6392HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.03

    Cisco IOS 12.2 and 15.0 through 15.3 and IOS XE 3.1 through 3.9 allow remote attackers to cause a denial of service (device restart) via a crafted IPv4 Multicast Source Discovery Protocol (MSDP) Source-Active (SA) message, aka Bug ID CSCud36767.

  • CVE-2016-6386HigOct 5, 2016
    Cisco Systems, Inc.
    iOS Xe
    risk 0.49cvss 7.5epss 0.03

    Cisco IOS XE 3.1 through 3.17 and 16.1 on 64-bit platforms allows remote attackers to cause a denial of service (data-structure corruption and device reload) via fragmented IPv4 packets, aka Bug ID CSCux66005.

  • CVE-2016-6384HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.04

    Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257.

  • CVE-2016-6382HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.05

    Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet, aka Bug ID CSCuy16399.

  • CVE-2016-6381HigOct 5, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.03

    Cisco IOS 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.18 and 16.1 allow remote attackers to cause a denial of service (memory consumption or device reload) via fragmented IKEv1 packets, aka Bug ID CSCuy47382.

  • CVE-2016-7561HigOct 5, 2016
    Fortinet
    Fortiwlc
    risk 0.47cvss 7.2epss 0.01

    Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 allow administrators to obtain sensitive user credentials by reading the pam.log file.

  • CVE-2016-4551HigOct 5, 2016
    SAP
    Netweaver
    risk 0.49cvss 7.5epss 0.01

    The (1) SAP_BASIS and (2) SAP_ABA components 7.00 SP Level 0031 in SAP NetWeaver 2004s might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape, aka SAP Security Note 2190621.

  • CVE-2016-1246HigOct 5, 2016
    Dbd Mysql Project
    Dbd Mysql
    risk 0.42cvss 7.5epss 0.04

    Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message.

  • CVE-2016-8343HigOct 5, 2016
    Indasengineering
    Web SCADA
    risk 0.50cvss 7.5epss 0.04

    Directory traversal vulnerability in INDAS Web SCADA before 3 allows remote attackers to read arbitrary files via unspecified vectors.

  • CVE-2016-6419HigOct 5, 2016
    Cisco Systems, Inc.
    Firepower Management Center (FMC) Software
    risk 0.49cvss 7.5epss 0.01

    SQL injection vulnerability in Cisco Firepower Management Center 4.10.3 through 5.4.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCur25485.

  • CVE-2016-5983HigOct 5, 2016
    IBM
    Websphere Application Server
    risk 0.50cvss 7.5epss 0.04

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.43, 8.0 before 8.0.0.13, 8.5 before 8.5.5.11, 9.0 before 9.0.0.2, and Liberty before 16.0.0.4 allows remote authenticated users to execute arbitrary Java code via a crafted serialized object.

  • CVE-2016-5085HigOct 5, 2016
    Johnson & Johnson
    Animas OneTouch Ping
    risk 0.49cvss 7.5epss 0.04

    Johnson & Johnson Animas OneTouch Ping devices do not properly generate random numbers, which makes it easier for remote attackers to spoof meters by sniffing the network and then engaging in an authentication handshake.

  • CVE-2016-5084HigOct 5, 2016
    Johnson & Johnson
    Animas OneTouch Ping
    risk 0.49cvss 7.5epss 0.02

    Johnson & Johnson Animas OneTouch Ping devices do not use encryption for certain data, which might allow remote attackers to obtain sensitive information by sniffing the network.

  • CVE-2016-4390HigOct 5, 2016
    Microfocus
    Keyview
    risk 0.53cvss 8.1epss 0.05

    The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4388, and CVE-2016-4389.

  • CVE-2016-4389HigOct 5, 2016
    Microfocus
    Keyview
    risk 0.53cvss 8.1epss 0.05

    The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4388, and CVE-2016-4390.

  • CVE-2016-4388HigOct 5, 2016
    Microfocus
    Keyview
    risk 0.53cvss 8.1epss 0.05

    The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4387, CVE-2016-4389, and CVE-2016-4390.

  • CVE-2016-4387HigOct 5, 2016
    Microfocus
    Keyview
    risk 0.53cvss 8.1epss 0.09

    The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4388, CVE-2016-4389, and CVE-2016-4390.

  • CVE-2016-2308HigOct 5, 2016
    American Auto Matrix
    Aspect-Nexus Building Automation Front-End Solutions
    risk 0.56cvss 8.6epss 0.01

    American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application store passwords in cleartext, which allows remote attackers to obtain sensitive information by reading a file.

  • CVE-2016-2307HigOct 5, 2016
    American Auto Matrix
    Aspect-Nexus Building Automation Front-End Solutions
    risk 0.49cvss 7.5epss 0.01

    American Auto-Matrix Aspect-Nexus Building Automation Front-End Solutions application before 3.0.0 and Aspect-Matrix Building Automation Front-End Solutions application allow remote attackers to read arbitrary files via unspecified vectors, as demonstrated by the configuration…

  • CVE-2016-6645HigOct 5, 2016
    EMC Corporation
    Unisphere for VMAX Virtual Appliance
    risk 0.57cvss 8.8epss 0.04

    The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via crafted input to the (1) GeneralCmdRequest, (2)…

  • CVE-2016-8278HigOct 3, 2016
    Huawei
    USG9520
    risk 0.49cvss 7.5epss 0.01

    Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a denial of service (device restart) via an unspecified URL.

  • CVE-2016-7141HigOct 3, 2016
    Curl
    Libcurl
    risk 0.49cvss 7.5epss 0.08

    curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no…

  • CVE-2013-4119HigOct 3, 2016
    Freerdp
    Freerdp
    risk 0.42cvss 7.5epss 0.04

    FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by disconnecting before authentication has finished.

  • CVE-2013-4118HigOct 3, 2016
    Freerdp
    Freerdp
    risk 0.42cvss 7.5epss 0.04

    FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

  • CVE-2016-7401HigOct 3, 2016
    risk 0.42cvss 7.5epss 0.06

    The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.

  • CVE-2016-7031HigOct 3, 2016
    Ceph
    Ceph
    risk 0.49cvss 7.5epss 0.02

    The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL.

  • CVE-2016-6352HigOct 3, 2016
    GNOME Foundation
    Gdkpixbuf
    risk 0.49cvss 7.5epss 0.04

    The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via crafted dimensions in an ICO file.

  • CVE-2016-1244HigOct 3, 2016
    Unadf Project
    Unadf
    risk 0.58cvss 8.8epss 0.05

    The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.

  • CVE-2016-7445HigOct 3, 2016
    Uclouvain
    Openjpeg
    risk 0.49cvss 7.5epss 0.04

    convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.

  • CVE-2016-3658HigOct 3, 2016
    LibTIFF
    Libtiff
    risk 0.49cvss 7.5epss 0.04

    The TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving the ma variable.

  • CVE-2016-3634HigOct 3, 2016
    LibTIFF
    Libtiff
    risk 0.49cvss 7.5epss 0.02

    The tagCompare function in tif_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to field_tag matching.

  • CVE-2016-3633HigOct 3, 2016
    LibTIFF
    Libtiff
    risk 0.49cvss 7.5epss 0.02

    The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the src variable.

VYPR — Vulnerability Intelligence