VYPR

CVEs

31,844 total · page 581 of 637

AllCriticalHighKEV
  • CVE-2016-4765HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759,…

  • CVE-2016-4762HigSep 25, 2016
    Apple Inc.
    iTunes
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4759HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4765,…

  • CVE-2016-4754HigSep 25, 2016
    Apple Inc.
    ServerDocs Server
    risk 0.49cvss 7.5epss 0.02

    ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

  • CVE-2016-4753HigSep 25, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-4750HigSep 25, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.01

    S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4738HigSep 25, 2016
    GNOME Foundation
    Libxslt
    risk 0.58cvss 8.8epss 0.04

    libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4737HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4736HigSep 25, 2016
    Libarchive
    Libarchive
    risk 0.57cvss 8.8epss 0.03

    libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted file.

  • CVE-2016-4735HigSep 25, 2016
    Apple Inc.
    WebKit in Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4733, and…

  • CVE-2016-4733HigSep 25, 2016
    Apple Inc.
    Webkit
    risk 0.51cvss 7.8epss 0.02

    WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4730, CVE-2016-4734, and…

  • CVE-2016-4731HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4729.

  • CVE-2016-4730HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and…

  • CVE-2016-4729HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.03

    WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4731.

  • CVE-2016-4728HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2016-4727HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4726HigSep 25, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4725HigSep 25, 2016
    Apple Inc.
    tvOS
    risk 0.53cvss 8.1epss 0.01

    IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a crafted web site.

  • CVE-2016-4724HigSep 25, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.01

    IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

  • CVE-2016-4723HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4716HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    diskutil in DiskArbitration in Apple OS X before 10.12 allows local users to gain privileges via unspecified vectors.

  • CVE-2016-4712HigSep 25, 2016
    Apple Inc.
    tvOS
    risk 0.51cvss 7.8epss 0.02

    CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted app.

  • CVE-2016-4711HigSep 25, 2016
    Apple Inc.
    iOS
    risk 0.49cvss 7.5epss 0.02

    CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leveraging a function call that specifies the same buffer for input and output.

  • CVE-2016-4710HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4709.

  • CVE-2016-4709HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.00

    WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vulnerability than CVE-2016-4710.

  • CVE-2016-4703HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4700HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4699.

  • CVE-2016-4699HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-4700.

  • CVE-2016-4698HigSep 25, 2016
    Apple Inc.
    iOS
    risk 0.51cvss 7.8epss 0.01

    AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

  • CVE-2016-4697HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

  • CVE-2016-4696HigSep 25, 2016
    Apple Inc.
    OS X
    risk 0.51cvss 7.8epss 0.01

    AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.

  • CVE-2016-4611HigSep 25, 2016
    Apple Inc.
    Safari
    risk 0.57cvss 8.8epss 0.02

    WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and…

  • CVE-2016-5793HigSep 24, 2016
    Moxa
    Active OPC Server
    risk 0.57cvss 8.8epss 0.00

    Unquoted Windows search path vulnerability in Moxa Active OPC Server before 2.4.19 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.

  • CVE-2016-4845HigSep 24, 2016
    I-O DATA
    HVL-A2.0
    risk 0.58cvss 8.8epss 0.02

    Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE HVL-A2.0, HVL-A3.0, HVL-A4.0, HVL-AT1.0S, HVL-AT2.0, HVL-AT3.0, HVL-AT4.0, HVL-AT2.0A, HVL-AT3.0A, and HVL-AT4.0A devices with firmware before 2.04 allows remote attackers to hijack the authentication of…

  • CVE-2016-6413HigSep 24, 2016
    Cisco Systems, Inc.
    Application Policy Infrastructure Controller \(apic\)
    risk 0.51cvss 7.8epss 0.00

    The installation procedure on Cisco Application Policy Infrastructure Controller (APIC) devices 1.3(2f) mishandles binary files, which allows local users to obtain root access via unspecified vectors, aka Bug ID CSCva50496.

  • CVE-2016-6411HigSep 24, 2016
    Cisco Systems, Inc.
    Firesight System Software
    risk 0.49cvss 7.5epss 0.01

    Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers to bypass intended do-not-decrypt settings via a crafted URL, aka Bug ID CSCva50585.

  • CVE-2016-6409HigSep 24, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.49cvss 7.5epss 0.02

    The Data in Motion (DMo) component in Cisco IOS 15.6(1)T and IOS XE, when the IOx feature set is enabled, allows remote attackers to cause a denial of service (out-of-bounds access) via crafted traffic, aka Bug ID CSCuy54015.

  • CVE-2016-6408HigSep 24, 2016
    Cisco Systems, Inc.
    Prime Home
    risk 0.49cvss 7.5epss 0.01

    Cisco Prime Home 5.2.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCvb17814.

  • CVE-2016-6414HigSep 22, 2016
    Cisco Systems, Inc.
    Cisco iOS
    risk 0.51cvss 7.8epss 0.00

    iox in Cisco IOS, possibly 15.6 and earlier, and IOS XE, possibly 3.18 and earlier, allows local users to execute arbitrary IOx Linux commands on the guest OS via crafted iox command-line options, aka Bug ID CSCuz59223.

  • CVE-2016-6373HigSep 22, 2016
    Cisco Systems, Inc.
    Cloud Services Platform 2100
    risk 0.47cvss 7.2epss 0.02

    The web-based GUI in Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote authenticated administrators to execute arbitrary OS commands as root via crafted platform commands, aka Bug ID CSCva00541.

  • CVE-2016-5284HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.48cvss 7.4epss 0.02

    Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for…

  • CVE-2016-5283HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.01

    Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

  • CVE-2016-5278HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.04

    Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an…

  • CVE-2016-5275HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.03

    Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.

  • CVE-2016-5273HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.02

    The mozilla::a11y::HyperTextAccessible::GetChildOffset function in the accessibility implementation in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2016-5272HigSep 22, 2016
    Mozilla Corporation
    Firefox
    risk 0.57cvss 8.8epss 0.02

    The nsImageGeometryMixin class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a…

  • CVE-2016-6669HigSep 22, 2016
    Huawei
    USG2100
    risk 0.49cvss 7.5epss 0.03

    Buffer overflow in the Authentication, Authorization and Accounting (AAA) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified security gateways with software before V300R001C10SPC600 allows remote authenticated RADIUS servers to execute arbitrary code by sending a…

  • CVE-2016-6340HigSep 22, 2016
    Red Hat
    Quickstart Cloud Installer
    risk 0.55cvss 8.4epss 0.00

    The kickstart file in Red Hat QuickStart Cloud Installer (QCI) forces use of MD5 passwords on deployed systems, which makes it easier for attackers to determine cleartext passwords via a brute-force attack.

  • CVE-2016-6322HigSep 22, 2016
    Red Hat
    Quickstart Cloud Installer
    risk 0.55cvss 8.4epss 0.00

    Red Hat QuickStart Cloud Installer (QCI) uses world-readable permissions for /etc/qci/answers, which allows local users to obtain the root password for the deployed system by reading the file.

  • CVE-2016-5247HigSep 22, 2016
    Lenovo
    ThinkCentre E93
    risk 0.51cvss 7.8epss 0.00

    The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240, TS440, and TS540 devices; and ThinkStation E32, P300, and P310 devices might allow local users or…