VYPR

CVEs

356,297 total · page 5822 of 7,126

AllCriticalHighKEV
  • CVE-2014-7066Oct 19, 2014
    Magzter
    Legalera
    risk 0.00cvss —epss 0.00

    The LegalEra (aka com.magzter.legalera) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7065Oct 19, 2014
    Ukbusinessaid
    Nigerias Business Directory
    risk 0.00cvss —epss 0.00

    The Nigerias Business Directory (aka com.wNigeriasBusinessDirectory) application 0.70.13414.17619 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7064Oct 19, 2014
    Ben10 Omniverse Walkthrough Project
    Ben10 Omniverse Walkthrough
    risk 0.00cvss —epss 0.00

    The ben10 omniverse walkthrough (aka com.wben10omniverse2walkthrough) application 0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7063Oct 19, 2014
    Bikersromagna
    Bikers Romagna
    risk 0.00cvss —epss 0.00

    The Bikers Romagna (aka com.bikers.romagna) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7062Oct 19, 2014
    Association Min Ajlik Project
    Association Min Ajlik
    risk 0.00cvss —epss 0.00

    The Association Min Ajlik (aka com.association.min.ajlik) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7061Oct 19, 2014
    Modsimconnected
    Modsim World 2014
    risk 0.00cvss —epss 0.00

    The MODSIM World 2014 (aka com.concursive.modsimworld) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7060Oct 19, 2014
    Yourtango
    Your Tango
    risk 0.00cvss —epss 0.00

    The Your Tango (aka com.your.tango) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7059Oct 19, 2014
    Thedevildoggamer Project
    Thedevildoggamer
    risk 0.00cvss —epss 0.00

    The TheDevildogGamer (aka com.wTheDevildogGamer) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7058Oct 19, 2014
    Efendimizin Sunnetleri Project
    Efendimizin Sunnetleri
    risk 0.00cvss —epss 0.00

    The Efendimizin Sunnetleri (aka com.wEfendimizinSunnetleri) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7057Oct 19, 2014
    Magzter
    Hong Kong Tatler Society
    risk 0.00cvss —epss 0.00

    The Hong Kong Tatler Society (aka com.magzter.hongkongtatlersociety) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7055Oct 19, 2014
    NCCI
    Annual Issues Symposium
    risk 0.00cvss —epss 0.00

    The NCCI's Annual Issues Symposium (aka com.quickmobile.ais14) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7054Oct 19, 2014
    Nobexrc
    Musica De Barrios Sonideros
    risk 0.00cvss —epss 0.00

    The musica de barrios sonideros (aka com.nobexinc.wls_93155702.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-7053Oct 19, 2014
    Citystar
    City Star Me
    risk 0.00cvss —epss 0.00

    The City Star ME (aka com.citystarme) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

  • CVE-2014-6116Oct 19, 2014
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.01

    The Telemetry Component in WebSphere MQ 8.0.0.1 before p000-001-L140910 allows remote attackers to bypass authentication by setting the JAASConfig property in an MQTT client configuration.

  • CVE-2014-6100Oct 19, 2014
    IBM
    Tivoli Directory Server
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Admin UI in IBM Tivoli Directory Server 6.1 before 6.1.0.64-ISS-ITDS-IF0064, 6.2 before 6.2.0.39-ISS-ITDS-FP0039, and 6.3 before 6.3.0.33-ISS-ITDS-IF0033, and IBM Security Directory Server 6.3.1 before 6.3.1.7-ISS-ISDS-IF0007,…

  • CVE-2014-5425Oct 19, 2014
    Ioserver
    Ioserver
    risk 0.00cvss —epss 0.01

    IOServer before Beta2112.exe allows remote attackers to cause a denial of service (out-of-bounds read and master entry consumption) via a null DNP3 header.

  • CVE-2014-5423Oct 19, 2014
    Carefusion
    Pyxis Supplystation
    risk 0.00cvss —epss 0.00

    CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 allows local users to obtain potentially sensitive information by reading a temporary (1) debugging file or (2) developer file.

  • CVE-2014-5422Oct 19, 2014
    Carefusion
    Pyxis Supplystation
    risk 0.00cvss —epss 0.02

    CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded service password, which makes it easier for remote attackers to obtain access via unspecified vectors.

  • CVE-2014-5421Oct 19, 2014
    Carefusion
    Pyxis Supplystation
    risk 0.00cvss —epss 0.00

    CareFusion Pyxis SupplyStation 8.1 with hardware test tool 1.0.16 and earlier has a hardcoded database password, which makes it easier for local users to gain privileges by leveraging cabinet access.

  • CVE-2014-5420Oct 19, 2014
    Carefusion
    Pyxis Supplystation
    risk 0.00cvss —epss 0.01

    CareFusion Pyxis SupplyStation 8.1 with hardware test tool before 1.0.16 has a hardcoded application password, which makes it easier for remote authenticated users to obtain application-file access via unspecified vectors.

  • CVE-2014-5331Oct 19, 2014
    Aptana
    Aflax
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Aflax allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-5330Oct 19, 2014
    Birdblog
    Birdblog
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in BirdBlog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-4840Oct 19, 2014
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.03

    IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL.

  • CVE-2014-4838Oct 19, 2014
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML…

  • CVE-2014-4837Oct 19, 2014
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted…

  • CVE-2014-4836Oct 19, 2014
    IBM
    Tririga Application Platform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a…

  • CVE-2014-4833Oct 19, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote authenticated users to gain privileges via invalid input.

  • CVE-2014-4830Oct 19, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

  • CVE-2014-4828Oct 19, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote attackers to conduct clickjacking attacks via a crafted HTTP request.

  • CVE-2014-4827Oct 19, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-4825Oct 19, 2014
    IBM
    QRadar SIEM
    risk 0.00cvss —epss 0.01

    IBM Security QRadar SIEM QRM 7.1 MR1 and QRM/QVM 7.2 MR2 does not properly implement secure connections, which allows man-in-the-middle attackers to discover cleartext credentials via unspecified vectors.

  • CVE-2014-4822Oct 19, 2014
    IBM
    Websphere Mq
    risk 0.00cvss —epss 0.00

    IBM WebSphere MQ classes for Java libraries 8.0 before 8.0.0.1 and Websphere MQ Explorer 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allow local users to discover preconfigured cleartext passwords via an unspecified trace operation.

  • CVE-2014-3568Oct 19, 2014
    OpenSSL Project
    OpenSSL
    risk 0.01cvss —epss 0.14

    OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.

  • CVE-2014-3567Oct 19, 2014
    OpenSSL Project
    OpenSSL
    risk 0.02cvss —epss 0.24

    Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.

  • CVE-2014-3513Oct 19, 2014
    OpenSSL Project
    OpenSSL
    risk 0.03cvss —epss 0.37

    Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.

  • CVE-2014-3408Oct 19, 2014
    Cisco Systems, Inc.
    Prime Optical
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the web framework in Cisco Prime Optical 10 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCuq80763.

  • CVE-2014-3406Oct 19, 2014
    Cisco Systems, Inc.
    Intrusion Prevention System
    risk 0.00cvss —epss 0.01

    Race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule, aka Bug ID CSCud82085.

  • CVE-2014-3397Oct 19, 2014
    Cisco Systems, Inc.
    Telepresence Mcu Software
    risk 0.00cvss —epss 0.04

    The network stack in Cisco TelePresence MCU Software before 4.3(2.30) allows remote attackers to cause a denial of service (memory consumption) via crafted TCP packets, aka Bug ID CSCtz35468.

  • CVE-2014-3381Oct 19, 2014
    Cisco Systems, Inc.
    Asyncos
    risk 0.00cvss —epss 0.02

    The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934.

  • CVE-2014-3370Oct 19, 2014
    Cisco Systems, Inc.
    Expressway Software
    risk 0.00cvss —epss 0.02

    Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service (device reload) via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447.

  • CVE-2014-3369Oct 19, 2014
    Cisco Systems, Inc.
    Expressway Software
    risk 0.00cvss —epss 0.02

    The SIP IX implementation in Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service (device reload) via crafted SDP packets, aka Bug ID CSCuo42252.

  • CVE-2014-3368Oct 19, 2014
    Cisco Systems, Inc.
    Expressway Software
    risk 0.00cvss —epss 0.04

    Cisco TelePresence Video Communication Server (VCS) and Expressway Software before X8.2 allow remote attackers to cause a denial of service (device reload) via a high rate of crafted packets, aka Bug ID CSCui06507.

  • CVE-2014-3021Oct 19, 2014
    IBM
    Websphere Application Server
    risk 0.00cvss —epss 0.02

    IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.35, 8.0 before 8.0.0.10, and 8.5 before 8.5.5.4 does not properly handle HTTP headers, which allows remote attackers to obtain sensitive cookie and authentication data via an unspecified HTTP method.

  • CVE-2014-2647Oct 19, 2014
    Microfocus
    Operations Agent
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in HP Operations Agent in HP Operations Manager (formerly OpenView Communications Broker) before 11.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-2358Oct 19, 2014
    Fox It
    Fox Datadiode
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative web interface in the proxy server on Fox-IT Fox DataDiode appliances before 1.7.2 allow remote attackers to hijack the authentication of administrators for requests that (1) create administrative…

  • CVE-2014-4447Oct 18, 2014
    Apple Inc.
    Mac OS X Server
    risk 0.00cvss —epss 0.00

    Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file after a (1) profile setup or (2) profile edit occurs.

  • CVE-2014-4446Oct 18, 2014
    Apple Inc.
    Mac OS X Server
    risk 0.00cvss —epss 0.01

    Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a change made by an administrator.

  • CVE-2014-4444Oct 18, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.00

    SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login.

  • CVE-2014-4443Oct 18, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.03

    Apple OS X before 10.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted ASN.1 data.

  • CVE-2014-4442Oct 18, 2014
    Apple Inc.
    OS X
    risk 0.00cvss —epss 0.00

    The kernel in Apple OS X before 10.10 allows local users to cause a denial of service (panic) via a message to a system control socket.